EU AI Act Conformity Declaration
Effective: 2026-05-02 · Version 1.0, corrected for factual accuracy on 2026-10-16 · Owned, developed, and copyright-protected by Aitech International ApS, Denmark.
QMS Nordic embeds AI features that assist regulated quality-management work — clinical evaluation reports (EU MDR Article 61), post-market clinical follow-up plans (Annex XIV Part B), predicate device search, software-bill-of-materials vulnerability scanning, customer-support drafting, hazard suggestions, root-cause suggestions, and document drafting. Several of these touch decisions about medical devices and could be classified as high-risk AI systems under the EU AI Act when used as the sole input to a regulated decision. This declaration sets out how Aitech International ApS designs and operates these features so that customers — manufacturers, providers, and deployers — can satisfy their own obligations under Articles 9–50 of the AI Act.
1. Human oversight (Article 14)
No AI draft in QMS Nordic is auto-approved. Every CER section, PMCF section, predicate candidate, SBOM vulnerability finding, helpdesk reply draft, hazard suggestion, and root-cause suggestion lands as a labelled draft requiring an explicit human Approve / Edit / Reject decision. Per-user role gates restrict who can approve. Activation gates refuse to advance the owning record (e.g., a CER cannot become active) until every AI-drafted section is approved. Two AI outputs are not drafts: the assistant's answers and helpdesk triage; and an SBOM can be activated with medium- or low-severity findings still open (section 4).
2. Transparency + provenance (Article 13 + 50)
AI document drafts are recorded with the model, the prompt and a hash of the output, against the document they produced. Other AI-assisted sections record who generated them and when. A comparable-device search records how many searches it ran, and each candidate keeps the address of the page it came from. CER, PMCF and PMS drafts run no search, so they carry no citations. The hash-chained audit log captures the AI run, every human edit, and the final approval signature.
3. Data governance (Article 10)
Only two features search the web, and each is limited to an allowlist: the comparable-device finder, to regulator, registry and literature websites (among them FDA, EUDAMED, EMA, MHRA, PubMed and ClinicalTrials.gov), and the SBOM vulnerability scan, to vulnerability sources (NIST NVD, GitHub Security Advisories, CISA KEV, MITRE). Both use the Anthropic web-search tool with an explicit list of allowed domains, so other web pages cannot enter the AI's context window. CER, PMCF and PMS drafts are written from the model's own knowledge, without a search. Document RAG retrieves only over the tenant's own approved documents.
4. Risk management + monitoring (Article 9 + 17)
AI token use is counted per organisation against the annual budget shown in Admin → AI Drafting, and each AI document draft keeps its own token counts. AI drafts — documents and their translations (both labelled as AI drafts); CER, PMCF and PMS sections; predicate candidates; SBOM vulnerability findings; helpdesk replies; hazard and root-cause suggestions; and the suggested internal-audit scope, management-review agenda and GSPR applicability — take effect only after a person accepts them (approves, triages, sends or saves them), and the record shows who did. Exceptions: the assistant's answers (chat and voice) are advisory and are not reviewed; helpdesk triage sets a ticket's category, priority, suspected-complaint flag and SLA due date automatically, which a person can change; and SBOM findings the AI grades medium or low severity do not block the SBOM's activation, so they can stay open with no decision recorded — only critical and high findings must be decided first.
Risk classification per feature
| Feature | AI Act category | Mitigation |
|---|---|---|
| CER section auto-populate | High-risk (clinical decision support) | Human approval required per section · no search: drafted from the model's own knowledge, with no citations · provenance retained · activation gated |
| PMCF plan auto-populate | High-risk (post-market clinical evidence) | Same controls as CER |
| AI Suggest Hazards (Risk file) | Medium · supports ISO 14971 §5.4 | Suggestions never auto-write; reviewer accepts hazard chains explicitly |
| AI Suggest Root Cause (CAPA) | Medium | Captured as a draft investigation note; never closes the CAPA |
| Predicate device finder | Limited · transparency only | A person accepts or rejects each candidate. Accepting one records a comparable device, not an equivalence decision: a 510(k) predicate or an MDR equivalence claim is the manufacturer's to decide and evidence |
| SBOM AI vulnerability scan | Limited · transparency only | AI web search limited to vulnerability sources (NIST NVD, GitHub Security Advisories, CISA KEV, MITRE); a reviewer triages each finding explicitly |
| Helpdesk Copilot | Limited · customer-facing chat | Every reply requires a human to send it, in every mode and on every intake route · the confidence threshold marks a draft ready for review, never for sending |
| Document AI drafting | Medium · QMS document generation | AI drafts are labelled · the label stays through edits and clears on a direct approval; a document released through an approval route keeps the label; an approval signature (Part 11 §11.50) is required to make it effective · a revision created as a new document version carries its own label · the AI generation record is kept |
Customer obligations
If you deploy QMS Nordic's AI features in a way that makes the AI's output the sole input to a regulated decision (for example, marking a CER active without a human review of the AI-drafted sections), you — the deployer — are the AI Act controller for that decision. QMS Nordic's design refuses to let this happen by default: every approve/edit/reject is gated and signed. We document this position so you can provide it to your notified body or competent authority on request.
Supporting documents
- Security overview · controls, encryption, RLS isolation, hash-chained audit log
- Privacy policy · what data we process, where it lives, and what the AI sees
- Sub-processors · including Anthropic (model inference) and OpenAI (embeddings only)
- Audit log specification · hash-chained immutable per-tenant log; export available via
Admin → Bulk export
Contact
Questions about this declaration: info@qmsnordic.com. For regulators: info@qmsnordic.com.
© 2026 Aitech International ApS · Denmark. QMS Nordic™ is owned, developed, and copyright-protected by Aitech International ApS. This declaration will be updated when the AI Act phases in (final transparency obligations from August 2026, high-risk obligations from August 2027) or when our system materially changes.