Back to Blog

AI for Medical Device Manufacturers: Use Cases, MDR Documentation, and the 2026 Tool Landscape

Henri Jung, Co-founder at Superkind
Henri Jung

Co-founder at Superkind

A row of identical precision-machined medical implant screws with one marked by an orange ring, representing AI across the traceable records of medical device manufacturing

A single Class III technical file under the EU Medical Device Regulation can run to tens of thousands of pages, every one of which must be traceable, current, and defensible in front of a notified body. A single product complaint has to be logged, categorised, assessed for reportability, and investigated against a regulatory clock. A single CAPA can sit open for weeks while a quality engineer chases context across systems that do not talk to each other. Medical device manufacturers run on documents, data, and deadlines - and they run short of the people to handle all three.

This is exactly where AI pays back. McKinsey finds that nearly half of medtech companies deploying generative AI already see measurable productivity benefits, and estimates the technology could unlock 60 to 110 billion dollars a year across the pharmaceutical and medical products industries5. In Germany the pressure is acute: the medical technology sector turned over roughly 41 billion euros in 2024, yet 51 percent of companies expect falling profits and 86 percent are demanding a moratorium on bureaucratic burden, with the MDR named as the single biggest drag13. The tools to relieve that burden exist. The gap is in how they are strung together, and in what happens to your hard-won regulatory expertise when a senior person walks out the door.

This guide is the honest version for the quality, regulatory, operations, or IT leader at a medical device manufacturer or contract manufacturer (Medizintechnik). The real processes where AI works, the real 2026 tool landscape named by name, the regulated-industry constraints that actually matter, and the connective layer most point tools leave out.

TL;DR

The value is real and mostly unclaimed - nearly half of medtech companies using gen AI see measurable productivity gains, but only a fraction have turned it into consistent financial impact.5

Seven processes pay back first - complaint handling, CAPA and deviations, MDR technical documentation, post-market surveillance, design controls, audit readiness, and knowledge search.

The tool landscape is crowded and named - Greenlight Guru, MasterControl, Veeva, TrackWise, Matrix Requirements, Ketryx, Rimsys, Celegence, Climedo, Copilot, Glean - but no tool remembers your company.

The missing layer is a Company Brain - a private memory of how your experts write files, handle complaints, and investigate, so AI employees and new hires reuse it instead of starting from zero.

Compliance is the gate, not the blocker - AI drafts, a qualified person reviews and signs, every action is logged, and the system is validated under ISO 13485 and the incoming FDA QMSR.14

The Medtech Documentation Paradox

Medical device manufacturers are, on paper, the perfect candidates for AI: process-driven, data-rich, and buried in repetitive, high-volume document work. And yet they adopt more slowly than almost any other manufacturing sector, for reasons that are entirely rational. The same rigour that makes a device safe makes its paperwork hard to automate casually - and the MDR made that paperwork far heavier.

  • Revenue is up, profit is squeezed - German medtech turned over about 41 billion euros in 2024 and roughly 70 percent of firms expect higher revenue in 2025, but 51 percent expect lower profits as certification, bureaucracy, and personnel costs climb.13
  • The MDR is the number-one burden - 86 percent of German medtech companies demand a moratorium on new bureaucratic load, and improving and de-bureaucratising the MDR tops the sector’s policy asks.14
  • Certification is a bottleneck - across the EU, about 33,175 MDR applications had been submitted to notified bodies against only 17,549 certificates issued, leaving an estimated 15,000-plus in the pipeline.6
  • Technical files are expensive - bringing a Class III device through European conformity assessment can require investment exceeding 120,000 dollars, driven largely by documentation and clinical evidence.7
  • The talent gap is structural - 56 percent of German medtech firms name the growing skilled-labour shortage as a drag on their business, and experienced quality and regulatory staff are among the hardest roles to fill.1
  • The value is on the table - McKinsey finds nearly half of medtech gen AI adopters already see productivity benefits, yet only about 15 percent report a positive impact on the P&L, meaning most of the prize is unclaimed.5

Key Data Point

Notified bodies had issued only 17,549 MDR certificates against roughly 33,175 applications, with 15,000-plus still waiting.6 Even the European Commission conceded the point, publishing a 2025 proposal to simplify the MDR and IVDR and improve the predictability and cost efficiency of conformity assessment.89 The constraint is not whether AI can help. It is whether a regulated manufacturer can deploy it safely and connect it to the systems it already runs.

This is the paradox: the companies with the most documentation to produce are the ones with the most reasons to be careful about automating it. The answer is not to lower the bar. It is to bring AI up to the bar - validated, audited, and grounded in the manufacturer’s own knowledge.

IndicatorCurrent StateSource
German medtech revenue (2024)~41 billion eurosBVMed1
Firms expecting lower profits51%BVMed1
Firms demanding a bureaucracy moratorium86%BVMed1
Firms citing skilled-labour shortage56%BVMed1
MDR certificates issued vs applications17,549 of ~33,175MedDeviceGuide6
Medtech gen AI adopters seeing productivity gains~50%McKinsey5

Why Regulatory Knowledge Is the Asset

A medical device company sells products, but it runs on knowledge: how to structure a technical file the notified body will accept, how to categorise a complaint and judge reportability, how to scope a CAPA without over-investigating, how to build the traceability from a user need to a design output to a test. That knowledge is the actual engine, and it has a dangerous property - most of it lives in individual heads and in systems that do not talk to each other.

  • The workforce is ageing out - a large wave of experienced quality and regulatory staff is approaching retirement, and there are not enough new entrants to replace the expertise they carry.1
  • The gap is already structural - 56 percent of German medtech firms cite the skilled-labour shortage, with senior regulatory affairs and quality roles among the hardest to fill.1
  • Knowledge is trapped in silos - the eQMS, the PLM, the complaint database, the design history file, the ERP, and a thousand SharePoint folders each hold a slice, and none holds the whole.
  • Tribal knowledge never gets written down - how a veteran RA lead reads a specific notified body’s expectations, or how a quality engineer spots the real root cause, rarely makes it into any document.
  • Every exit is a small crisis - when a senior person leaves, the next team relearns what the company already knew, adding delay and audit risk to the next submission or investigation.
  • Reuse is the profit lever - manufacturers that capture and reuse past technical files, complaint patterns, and investigation logic move faster and more consistently than those starting from a blank page each time.

Why This Matters For AI

AI is only as good as what it can draw on. A generic model drafting a clinical evaluation section from a blank prompt gives you generic output. The same model drafting from your own past technical files, approved templates, and prior investigations gives you a usable first draft that reads like your company and cites your evidence. The value is not the model. It is the reusable regulatory knowledge you feed it - and keeping that knowledge inside your controlled environment.

What actually needs capturing

Reusable expertise in a medical device company is not a folder of old files. It is the working knowledge that makes the company effective and compliant, and most of it is never formally recorded.

  • How you build a technical file - the structure, evidence standard, and level of detail that gets a file through a specific notified body without a cycle of deficiency questions.
  • How you handle complaints - the way an experienced handler categorises an event, judges reportability, and decides when a complaint becomes a vigilance case.
  • How you investigate - the way a quality engineer scopes a CAPA, avoids over-investigation, and lands on a root cause that holds up in an audit.
  • How you trace - the tacit rules that keep design inputs, outputs, risks, and verification linked so a change never breaks the record.
  • Who knows what - the map of which person led which submission, validation, or investigation, so the next team finds the expert, not just the file.
  • What went wrong before - the lessons from findings, field actions, and rejected submissions that shape good judgment but rarely reach a document.

A Scenario Every Manufacturer Recognises

Your most experienced regulatory affairs lead, who has carried every MDR transition for your portfolio, retires. She knew how your notified body reads a clinical evaluation, which arguments survived the last deficiency round, and where the last file nearly stalled. Six weeks later she is gone, and none of it was written down. The next technical file is drafted from a blank template by someone who has never faced that reviewer. Nothing about that loss was inevitable - it was simply never captured.

This is the lens for everything that follows. Every AI use case below is really a question of turning individual expertise into company expertise the whole team - and its AI employees - can reuse, inside a system an auditor would accept.

7 AI Use Cases That Deliver in Medical Device Manufacturing

These are the processes where medical device manufacturers see the clearest return today. Each is a routine, high-volume task that eats expert time, sits on top of knowledge the company already owns, and already has a human review step where AI can slot in safely.

1. Complaint handling and vigilance intake

  • The problem - complaints arrive by email, portal, and phone in many languages, each needing intake, categorisation, a reportability assessment, and an investigation against a regulatory clock.19
  • What AI does - reads the incoming complaint, extracts the structured fields, suggests a category and a reportability view, and drafts the acknowledgement and investigation; AI agents now ship in production QMS platforms to triage complaints and generate audit-ready records.
  • Why it pays - complaint intake is the highest-volume, most repetitive step in post-market quality, and it directly feeds vigilance and Medical Device Reporting deadlines you cannot miss.19
  • Real example - a handler opens a pre-populated complaint record with extracted fields, a suggested category, and three similar past cases, and spends their time on the reportability decision rather than transcription.
  • Watch for - seriousness and reportability stay a human call; AI accelerates intake, it does not decide whether an event is reportable.

2. CAPA, deviations and nonconformances

  • The problem - a busy site generates a steady stream of deviations and nonconformances, each needing classification, investigation, and a linked CAPA, and each taking weeks to close by hand.
  • What AI does - classifies events by severity, suggests likely root causes from similar past cases, and drafts the investigation and CAPA; AI agents inside QMS platforms auto-summarise CAPA investigations and link related records.
  • Why it pays - CAPA and deviation handling is document-heavy and pattern-rich, and grounding the model in your own quality history turns a blank-page task into a reviewed draft.
  • Real example - a quality engineer opens a new deviation and receives a suggested classification, similar historical cases, and a draft investigation grounded in the site’s own history.
  • Watch for - treating the AI suggestion as the decision; classification and CAPA closure remain a qualified reviewer’s call, logged in the audit trail.

3. MDR technical documentation and regulatory writing

  • The problem - the MDR technical file (Annex II and III) demands far more detail on risk management, clinical evaluation, and post-market surveillance than the old MDD, pulling scarce RA writers into repetitive, template-driven drafting.7
  • What AI does - assembles file sections, drafts clinical evaluation and GSPR content from source data, maps requirements, and gap-checks against MDR annexes; Ketryx reports reducing documentation burden by up to 90 percent with validated AI agents, and Celegence CAPTIS supports MDR/IVDR medical writing.1022
  • Why it pays - documentation is the single biggest MDR cost and the top complaint of the sector, so cutting drafting and gap-finding time attacks the burden directly.4
  • Real example - an RA writer receives a first-draft clinical evaluation section assembled from the company’s past files and current data, ready to refine, plus a list of gaps against the annex.
  • Watch for - confident but wrong text; any AI touching a submission record must be validated and a qualified writer owns the final file.10

4. Post-market surveillance and PMCF

  • The problem - MDR post-market surveillance means continuously gathering complaints, field data, and literature, then trending them into PSURs and post-market clinical follow-up reports.
  • What AI does - monitors literature and complaint data for signals, drafts the periodic safety update, and flags trends for a reviewer; platforms like Climedo support clinical validation and post-market surveillance data capture.23
  • Why it pays - PMS is continuous and easy to fall behind on, and a trend missed in the data becomes a finding or a field action later.
  • Real example - a reviewer opens a drafted PSUR with the complaint trend, the literature summary, and the flagged signals already assembled, and spends time on the assessment rather than the collation.
  • Watch for - signal assessment and any field-safety decision stay human; AI surfaces the trend, it does not decide the action.

5. Design controls, requirements and traceability

  • The problem - the design history file must keep user needs, requirements, risks, verification, and validation linked, and every change has to ripple through cleanly under ISO 13485 and IEC 62304.
  • What AI does - drafts requirements, suggests trace links, checks coverage between requirements, risks, and tests, and flags broken traceability; Matrix Requirements, Jama Connect, Codebeamer, and Ketryx govern this engineering record.20
  • Why it pays - traceability gaps are a classic audit finding, and maintaining the web of links by hand is slow and error-prone across design changes.
  • Real example - an engineer changes a requirement and the tool surfaces every linked risk, test, and document that now needs review, with draft updates for each.
  • Watch for - AI-suggested links still need engineering review; the trace matrix is a controlled record, not a convenience.

6. Audit and inspection readiness

  • The problem - ISO 13485 audits, the incoming FDA QMSR, and notified body assessments turn into a scramble to assemble evidence, confirm CAPAs are closed, and find who owns what.14
  • What AI does - pulls the evidence for a requirement, checks CAPA closure and linkage, flags documents drifting out of their review cycle, and answers auditor-style questions by surfacing the exact record and its owner.
  • Why it pays - it turns inspection readiness from a periodic fire drill into a continuous state, and captures how past findings were handled for the next audit.
  • Real example - a quality manager asks how the company closed a similar finding last time and gets the CAPA, the evidence, and the person who led it in seconds.
  • Watch for - the human still leads the audit and owns every answer; AI assembles the evidence, it does not represent the company.

7. Knowledge search across the QMS and technical files

  • The problem - the answer to a question usually exists somewhere in the eQMS, the PLM, email, or SharePoint, but nobody can find it or the person who wrote it.
  • What AI does - indexes past work across connected systems so anyone can ask a question and get the right SOP, the past investigation, and the expert behind it, respecting access controls.
  • Why it pays - it directly attacks the knowledge that would otherwise leave with retiring staff and sits fragmented across quality and regulatory silos.
  • Real example - a new hire asks how the company handled a similar nonconformance and gets the past investigation, the SOP, and the person who led it.
  • Watch for - search must honour the same permissions as the underlying systems, so confidential design and complaint data stay walled correctly.
Use CasePrimary GainKnowledge ReusedHuman Oversight
Complaint handlingFaster intake and triageComplaint history, categoriesReportability decision
CAPA and deviationsShorter cycle timesQuality historyQA classification, closure
MDR technical documentationUp to 90% less doc burdenPast files, templatesRA writer sign-off
Post-market surveillanceDrafted PSUR, trend signalsComplaints, literatureSignal assessment
Design controlsMaintained traceabilityRequirements, risks, testsEngineering review
Audit readinessContinuous inspection stateAll past evidenceAudit lead owns answers
Knowledge searchFind precedent and personAll past workAccess controls

None of these seven is exotic. Every one is a task your company already does by hand every week, on top of knowledge you already own, with a human review step already built in. That is exactly why they pay back and why they are the right place to start rather than a moonshot project that never reaches operations.

“When we say an AI agent is validated, we mean we’ve defined a specific task - such as classifying complaints or tracing risks - and we’ve demonstrated, with audit-ready evidence, that the agent can perform that task reliably and safely.”

- Erez Kaminski, Founder and CEO of Ketryx11

See what AI could take off your quality team’s plate

Book a 30-minute call. We will map your highest-return regulated workflow together.

Book a Demo →
Stacked machined metal discs building into one unit, representing fragmented quality and regulatory records consolidated into one company memory

AI by Company Type: Where to Start

Medical device manufacturing is not one thing. A high-volume Class I maker, an implant manufacturer, a software-as-a-medical-device company, a contract manufacturer, and a distributor live on different work, so the first AI move differs. What stays constant is the pattern: automate the routine, capture the expertise, keep judgment and sign-off human, and validate the system.

Class I and IIa high-volume manufacturers

  • The bottleneck - high complaint and documentation volume across many SKUs, where efficiency beats novelty.
  • Best first move - complaint intake and CAPA drafting, where volume is highest and a review step already exists.
  • The knowledge risk - repetitive work masks how much sits in undocumented routine; capture it before the people who know it leave.

Class III and implant manufacturers

  • The bottleneck - enormous, high-stakes technical files with deep clinical evidence and long notified body reviews.
  • Best first move - MDR technical documentation and post-market surveillance, where the file burden and the cost are largest.7
  • The knowledge risk - a handful of senior RA and clinical experts carry the file logic; a connected memory keeps it when they retire.

Software as a medical device (SaMD) and AI device makers

  • The bottleneck - IEC 62304 lifecycle, design controls, and, where AI is in the product, dual MDR and AI Act obligations.17
  • Best first move - design controls, requirements traceability, and validated documentation generation across the software record.10
  • The knowledge risk - key-person dependence in engineering is extreme; capture the design rationale as work happens.

Contract manufacturers and OEM suppliers

  • The bottleneck - high deviation and change-control volume across many clients, each with its own quality expectations.
  • Best first move - deviation and CAPA drafting plus knowledge search across the QMS, where cycle time is directly billable.
  • The knowledge risk - client-specific process know-how lives in a few heads; a shared brain keeps it across staff turnover.

Distributors and importers

  • The bottleneck - economic-operator obligations, complaint forwarding, vigilance, and multi-manufacturer documentation under the MDR.
  • Best first move - complaint routing, document management, and knowledge search across product lines and manufacturers.
  • The knowledge risk - product and manufacturer knowledge scatters across teams; a shared brain makes it reusable across the portfolio.
Company TypeTop First Use CaseBiggest Knowledge RiskKey Constraint
Class I / IIa high-volumeComplaints, CAPA draftingUndocumented routineThin margins, high volume
Class III / implantsMDR technical files, PMSSenior RA and clinical expertiseDocumentation and cost
SaMD / AI deviceDesign controls, traceabilityEngineering key-person riskMDR plus AI Act
Contract manufacturerDeviation and CAPA draftingClient-specific process know-howMulti-client quality
Distributor / importerComplaint routing, document mgmtProduct knowledge across teamsEconomic-operator duties

The 2026 AI Tool Landscape for Medical Devices

The market is crowded and moving fast. Below is an honest map of the real, current tools medical device manufacturers actually use, grouped by the job they do. No single tool covers a company end to end, and most run several. Superkind appears in exactly one place - the knowledge layer underneath - and we will be clear about where the specialist platforms are the better fit.

Quality management, complaints and CAPA

These run the eQMS - document control, complaints, CAPA, deviations, change control - increasingly with AI triage and summaries on top.

  • Greenlight Guru - a purpose-built medtech eQMS aligned to ISO 13485, EU MDR, ISO 14971, and the FDA QMSR, with Greenlight Guru AI adding auto-generated summaries for quality events and documents.1314
  • MasterControl and Veeva Vault QMS - established life sciences quality platforms adding AI analytics and agents across quality workflows.
  • Honeywell TrackWise and ComplianceQuest - high-volume quality and complaint platforms with AI-assisted categorisation and post-market surveillance.

Design controls, requirements and the technical record

These govern the engineering record - what the device must do and how each requirement links to risk and test.

  • Matrix Requirements - application lifecycle management built for medical device design controls, risk, and traceability.20
  • Jama Connect and Codebeamer - requirements and ALM platforms widely used for complex, software-led devices.
  • Ketryx - ALM plus validated AI agents that generate traceability and documentation, reporting up to 90 percent less manual compliance work.1011

Regulatory information and MDR writing

These manage submissions, registrations, and the medical writing the MDR demands.

  • Rimsys - regulatory information management built specifically for medtech, digitising registrations and the regulatory record.21
  • Celegence CAPTIS - a web application that assists medical writers with EU MDR/IVDR regulatory documentation.22

Post-market and clinical

These cover clinical data, PMCF, and the surveillance the MDR requires after launch.

  • Climedo - a European platform for clinical validation and post-market surveillance data capture, including eCOA and PMCF surveys.23
  • Literature and signal tools - increasingly AI-assisted for the literature monitoring that feeds PSURs.

Horizontal and knowledge

These sit across everything, help people find and draft, and are closest to the knowledge layer without retaining living know-how.

  • Microsoft 365 Copilot and Glean - drafting and enterprise search across connected apps and documents.
  • ChatGPT Enterprise - general reasoning and drafting, with data excluded from training under enterprise terms.
CategoryRepresentative ToolsBest ForLimitation
Quality, complaints, CAPAGreenlight Guru, MasterControl, TrackWiseRunning the eQMSSiloed from design and RA
Design controls and ALMMatrix Requirements, Jama, KetryxRequirements and traceabilityScoped to engineering
Regulatory and writingRimsys, Celegence CAPTISRegistrations and MDR filesDoes not know your wider knowledge
Post-market and clinicalClimedoPMS and PMCF dataFocused on the clinical slice
Horizontal searchCopilot, GleanFinding and draftingFinds files, not living know-how
Knowledge layerSuperkind Company BrainRetaining and reusing expertiseNot a self-serve point tool

The Pattern To Notice

Every category above is strong at its job and blind to the others. The complaint database does not know your design history. The eQMS does not see the technical file. The writing tool does not read the PLM. Each is a validated silo, which is exactly what a quality system demands - and exactly why a shared memory that all of them could draw on is the missing piece, not another point tool.

How to evaluate a tool for a regulated manufacturer

Before adding another platform, run it through five questions that matter more than the feature list.

  1. Can it be validated? - does the vendor support computer system validation under your ISO 13485 quality system and the incoming FDA QMSR, with documented testing? For regulated records this is the first filter, not the last.14
  2. Where does the data go? - does complaint, patient, and proprietary design data stay in your environment, and is it excluded from public model training?
  3. Is the audit trail sound? - are AI actions computer-generated, time-stamped, and tamper-evident, as your quality system requires?
  4. Can it see your real work? - a tool that only works from a blank prompt gives generic output; one that connects to your QMS and files reuses what the company knows.
  5. Does the knowledge stay? - when the subscription ends or the person leaves, does anything the tool learned about your company remain, or does it walk out with them?

A Simple Rule

Buy a specialist platform for a job that is the same at every company - running a QMS, managing registrations. Build a connected layer for the parts specific to your company - how you write for your notified body, handle your complaints, and investigate your deviations. The first is a validated commodity; the second is your competitive edge and the thing you keep losing to turnover.

The Missing Layer: A Company Brain

A Company Brain is a private, living memory of your organisation - the people-knowledge, processes, and past work that normally lives in individual heads and scattered systems. It is the layer that turns a pile of point tools into a system that actually knows your company, and it is where AI employees get the context to do useful work inside a controlled environment.

  • It retains expertise - captures how your best writers, quality engineers, and complaint handlers work, so their know-how stays when they retire or move on.1
  • It grounds every AI tool - a CAPA draft, a technical file section, or a complaint assessment is only as good as the company knowledge behind it; the brain provides that context.
  • It connects your systems - email, Teams, SharePoint, the eQMS, the PLM, the ERP, and the complaint database, so knowledge is drawn from where work already happens.
  • It learns from feedback - every corrected draft and every reused investigation teaches it what good looks like at your company.
  • It powers AI employees - with the brain underneath, an AI employee can read a complaint, pull the related device history, and draft the investigation in one flow.
  • It stays under your control - private to your company, with access controls and audit logs, so complaint, patient, and proprietary design data never reaches a public model.
  • It works across functions - the same layer that helps quality also helps regulatory, design, and post-market, because they all draw on the same company memory.
  • It shortens onboarding - a new hire asks the brain how the company does things instead of interrupting a senior colleague, reaching productive faster.
  • It compounds - unlike a tool that resets with each task, the brain gets more valuable the longer the company uses it, because it holds more of what the company knows.

Point Tools Alone vs Point Tools On a Company Brain

Point Tools Alone

  • Knowledge stays siloed - each system holds a slice, none holds the whole
  • Generic output - drafts read like anyone’s, not your company’s
  • Expertise still leaves - a tool does not remember a retiring RA lead
  • Subscription sprawl - many platforms, no shared memory

On a Company Brain

  • One shared memory - every tool and person draws on the same context
  • On-brand output - drafts reuse your real methodology and language
  • Expertise retained - know-how survives retirements and departures
  • AI employees can act - context turns copilots into colleagues

This is the distinction between an AI copilot and an AI employee. A copilot helps a person inside one app. An AI employee, grounded in a Company Brain and supervised by your people, takes over a routine job across your systems with human checkpoints where they matter.

The AI employees a medtech manufacturer actually deploys

In practice, the AI employees map to the routine roles that fill a company’s week - each grounded in the Company Brain, validated, and supervised by a qualified person.

  • The complaint handler - reads incoming complaints, extracts and categorises the case, and drafts the investigation for a reviewer to assess and sign.
  • The quality investigator - classifies a deviation, surfaces similar past cases, and drafts the CAPA for a QA reviewer.
  • The regulatory writer - turns data and templates into a first-draft technical file section in the company’s house style, ready for an RA writer to refine.
  • The post-market analyst - monitors complaints and literature, drafts the PSUR, and flags trends for a reviewer.
  • The knowledge keeper - captures decisions, investigations, and context as work happens, so nothing leaves with the person who did it.

“The SME-dominated industry is suffocating under bureaucratic burdens and reporting requirements, without this contributing to any improvement in patient care or safety.”

- Dr. Marc-Pierre Moell, CEO of BVMed, the German Medical Technology Association1

MDR, ISO 13485, and the EU AI Act

In a regulated industry, the question is never just “does the AI work” but “can you prove it, and who signs”. There are two separate worlds here, and confusing them is the most common mistake. AI that helps your team is validated software inside your quality system. AI that is part of the device is a regulatory project in its own right. Here is what actually applies to each.

AI in your operations (the subject of this guide)

  • AI that touches a regulated record is validated software - a complaint, CAPA, deviation, design control, or technical file brings the AI into computer system validation under your ISO 13485 quality system.
  • The FDA QMSR raises the bar in 2026 - the Quality Management System Regulation takes effect on 2 February 2026 and incorporates ISO 13485:2016 by reference, so a US-facing manufacturer aligns validation to it.14
  • Audit trails are non-negotiable - AI actions must be computer-generated, time-stamped, and tamper-evident, and a named person signs the record.
  • It is generally low-risk under the AI Act - operational AI for drafting, triage, and search falls into the minimal or limited-risk tiers, with light obligations such as transparency and AI literacy training.18
  • Data sovereignty is the real constraint - keeping complaint, patient, and proprietary design data inside a controlled environment matters more than the model choice.

AI inside the device (a different route entirely)

  • It follows the MDR conformity route - AI that is a medical device or software as a medical device is certified under the MDR/IVDR, as it is today.17
  • The AI Act adds a layer - where the AI is a safety component, it is high-risk under the AI Act and both frameworks apply at once, requiring integrated technical documentation, data governance, and human oversight.1617
  • Regulators are aligning the two - the Commission drafted high-risk classification guidance and the Medical Device Coordination Group issued guidance to align AI Act and MDR documentation.1516
  • The high-risk clock is later than you think - AI Act obligations for high-risk AI embedded in products apply from August 2028, and as of 2026 AI-enabled devices are still certified under the MDR/IVDR.17
ConcernWeak SetupSound Setup
Where data livesPasted into a public chatbotProcessed in your controlled environment
Training on your dataConsumer terms, unclearEnterprise terms, data excluded
ValidationNone, treated as a toyRisk-based CSV under ISO 13485 / QMSR
Audit trailNo record of AI actionsTime-stamped, tamper-evident
AccountabilityUnclear who owns the outputQualified person signs every record

Sovereignty Is the Real Constraint

For a medical device manufacturer, a data or compliance breach is not a bug - it is a regulatory event. That is why sovereignty and architecture matter more than the model. A private, permission-aware Company Brain lets you get the productivity of AI without ever putting complaint, patient, or proprietary design data somewhere it should not be, and without disabling an audit trail an auditor will ask to see.

How to Build Your AI Stack

The manufacturers that get value do not buy the most tools - they validate one workflow well and expand from there. Here is a practical sequence that avoids subscription sprawl and pilot purgatory, without cutting a compliance corner.

  1. Pick one high-return, review-backed workflow - choose a routine, high-volume task where the return is obvious and a human already reviews the output: complaint intake, CAPA drafting, or knowledge search. One workflow, not five.
  2. Baseline the current cost - measure the hours and cycle time the workflow eats today and the quality problems it creates. You cannot prove value against a number you never took.
  3. Set the compliance frame first - agree the validation approach, the data-sovereignty rules, and the human sign-off points before any tool touches a regulated record.
  4. Start the knowledge layer - point the Company Brain at the systems this workflow already uses - the eQMS, the complaint database, SharePoint - so drafts reuse real company knowledge from day one.
  5. Add the specialist tool where it fits - use the best validated platform for the task on top of that context, rather than a generic model working from a blank prompt.
  6. Keep a qualified human in the loop - define the checkpoints where a person reviews and signs before anything is filed. Non-negotiable for accuracy and accountability.
  7. Measure time saved, not tools bought - track hours recovered and cycle time against the baseline, and log everything for the eventual audit.
  8. Capture as you go - every reviewed draft and correction feeds the brain, so the next investigation or file starts further ahead.
  9. Expand to the next workflow - once the first runs in a validated state, reuse the same knowledge layer for the next. The context compounds.

Medtech AI Readiness Checklist

  • You can name the three tasks that eat the most quality and RA time
  • At least one of them reuses knowledge the company already owns
  • The target workflow already has a human review and sign-off step
  • Your systems have API or connector access to their data
  • You have a quality or IT owner who will champion validation
  • You can define what a qualified person must review before filing
  • You have a way to keep complaint and patient data out of public models
  • Leadership will fund one validated workflow with a defined metric

Buy Specialist Platforms vs Build a Connected Layer

Buy Specialist Platforms

  • Validation support out of the box - built for medtech from the start
  • Deep domain features - specialists do one job well
  • Vendor carries the roadmap - agents ship on their timeline
  • No shared memory - knowledge stays siloed per system
  • Sprawl - cost and integration multiply per platform

Build a Connected Layer

  • Retains expertise - knowledge survives retirements
  • Grounded output - drafts read like your company
  • Powers AI employees - context to act, not just assist
  • Needs process access - requires mapping real workflows
  • Not instant - value builds over weeks, not minutes

For most manufacturers the answer is both: specialist platforms for validated tasks, sitting on a connected knowledge layer so their output is grounded in the company rather than the open internet.

Common mistakes to avoid

Most AI disappointment in medtech traces back to the same handful of avoidable errors.

  • Buying tools before mapping the workflow - a platform does not fix a process nobody has looked at; map the work first, then choose the tool.
  • Skipping validation and hoping - unvalidated AI on a regulated record is a finding waiting to happen; set the compliance frame before you start.
  • Pasting regulated data into public chatbots - the fastest route to a data-sovereignty breach; decide where data may go before anyone touches real records.
  • Confusing operational AI with device AI - treating a drafting tool like a device build, or a device build like a drafting tool, wastes months on the wrong compliance path.
  • Skipping the baseline - without a before number, you can never prove the after, and the pilot dies in a debate about whether it worked.
  • Treating AI output as final - confident, wrong drafts reach a file when human review is optional; make the sign-off mandatory.
  • Ignoring adoption - the best platform nobody opens returns nothing; put AI inside the systems people already use.
  • Not capturing what the AI learns - if corrections and reused work do not feed a shared brain, the company relearns the same lessons on every project.

A 90-day path to your first win

You do not need a multi-year transformation programme. A focused quarter takes one validated workflow from idea to a measured result.

  1. Weeks 1 to 3: choose, baseline, and frame - pick the single workflow, map how it runs today, record the hours and cycle time, and agree the validation approach and data rules before any tool touches a record.
  2. Weeks 4 to 8: connect and build - point the knowledge layer at the systems the workflow already uses, add the right platform on top, and define the human sign-off points. Your team works with it on real cases and gives feedback.
  3. Weeks 9 to 12: measure and expand - compare hours and cycle time against the baseline, document the validation evidence, capture the knowledge produced, and decide the next workflow. The first win funds and de-risks the second.
PhaseFocusOutput
Weeks 1-3Choose, baseline, frameOne workflow, a metric, a validation and data plan
Weeks 4-8Connect and buildWorking draft on real cases, sign-off points defined
Weeks 9-12Measure and expandProven time saved, validation evidence, next workflow chosen

How Superkind Fits

Superkind builds two things for medical device manufacturers: a Company Brain that retains your organisation’s expertise, and AI employees that take over routine work on top of it. The approach is process-first - we start from how your teams actually write files, handle complaints, and investigate, not from a generic product you have to adapt to.

  • Company Brain - a private, living memory of your people-knowledge, processes, and past work that stays even when a senior RA or quality specialist retires.
  • AI employees - agents that draft complaints, CAPAs, technical file sections, and PSURs, and capture knowledge, grounded in the brain and supervised by your people.
  • Connected to your systems - email, Teams, SharePoint, the eQMS, the PLM, the ERP, and the complaint database, so work happens where it already lives.
  • Process-first discovery - we map the real workflow with the people who do it before building anything. No templates, no slideware.
  • Built for regulated environments - runs in your controlled environment with access controls and audit trails, so complaint, patient, and proprietary design data never reaches a public model.
  • Learns by daily feedback - your team corrects and reuses, and the system sharpens to how your company actually works.
  • More output without headcount - the goal is more done, and less expertise lost, from the people you already have.
  • Outcome-based pricing - priced per use case against measurable results, not per seat.
  • Model-agnostic - the brain is not tied to one AI provider, so you can use the best model for each task without rebuilding your knowledge layer.
  • Starts small - one validated workflow proves the value before you expand, so the risk is contained and the first result funds the next.
DimensionGeneric AI Point ToolSuperkind
What it isA tool for one taskA knowledge layer plus AI employees
KnowledgeForgets when staff leaveRetains company expertise
ContextBlank prompt or single appGrounded in your real work
IntegrationIts own siloConnects your existing systems
Data controlOften a public modelYour environment, audit-logged
ScopeAssists a personOwns a routine job with oversight

Superkind

Pros

  • Retains expertise - the Company Brain keeps know-how in the company
  • Process-first - built around your workflows, not a template
  • Connected - works on top of your existing systems
  • Sovereign by design - regulated data stays in your control
  • Outcome pricing - pay for results, not seats

Cons

  • Not self-serve - requires engagement with our team
  • Not instant - the brain builds value over weeks
  • Needs process access - we map real workflows, not just docs
  • Not a validated eQMS of record - we sit alongside your Greenlight Guru or MasterControl, not instead of it

If you only need a validated eQMS or a regulatory information system of record, buy the specialist platform. Superkind is for manufacturers that want to stop losing expertise and give their AI something real, and controlled, to work from.

What stays human

The point of this is not to remove people from medtech. It is to remove the routine so people do the work only they can do. In a regulated industry the line is not just good practice - it is the law.

  • The reportability and safety judgment - deciding whether a complaint is a vigilance case or a field action is the expert work AI drafts toward but never owns.
  • The regulatory strategy - how to position a technical file and answer a notified body is human judgment built over years.
  • Accountability and sign-off - a qualified person carries responsibility for every filed record; an AI cannot be liable to a regulator.
  • The final review - every document that leaves the company passes a human who owns its accuracy and compliance.
  • The judgment calls under uncertainty - the situations no template covers run on experience the machine supports but does not replace.

The Honest Division of Labour

AI does the first draft, the extraction, the summary, and the routine. People do the reportability call, the regulatory decision, and the sign-off. A manufacturer that keeps that line clear gets faster without getting less compliant; one that blurs it ships confident, wrong work into a file a notified body will read.

Decision Framework: What Should Your Company Do Now?

Not every manufacturer needs the same thing. Here is a framework to match your situation to a sensible first move.

SignalWhat It MeansAction
Complaints pile up faster than headcountIntake is the bottleneck, and it is repetitiveStart with AI-assisted complaint intake and triage
CAPAs take weeks to closeQuality capacity is trapped in manual investigationDraft CAPAs and deviations on your QMS history
MDR technical files are drowning the RA teamDocumentation is your biggest cost and delayAdd validated documentation drafting and gap-checking
A senior RA or quality expert is about to retireYou are about to lose expertise nobody wrote downCapture their know-how into a Company Brain now
You bought tools nobody usesSubscription sprawl without adoptionConsolidate onto one connected, validated workflow
You are a small manufacturer with a lean teamSpecialist platforms may be enough for nowStart with a strong eQMS and off-the-shelf AI features

Acting Now vs Waiting

Acting Now

  • Compounding advantage - reused expertise makes every file and investigation faster
  • Knowledge captured - you keep what retiring experts know instead of losing it
  • Capacity recovered - AI absorbs the MDR workload you cannot hire for
  • Compliance built in - validate and audit from the start, not retrofitted

Waiting

  • Competitor gap widens - peers move from pilots to production while you experiment
  • Knowledge keeps leaving - every retirement is unrecovered expertise
  • Capacity stays trapped - manual documentation keeps eating expert time
  • Burden keeps rising - MDR obligations do not pause while you wait4

Frequently Asked Questions

There is no single best tool - most manufacturers run several by function. For the quality system, complaints, and CAPA, Greenlight Guru, MasterControl, Veeva Vault QMS, Honeywell TrackWise, and ComplianceQuest lead. For design controls, requirements, and the technical file, Matrix Requirements, Jama Connect, Codebeamer, and Ketryx are common. Ketryx also offers validated AI agents for compliance documentation. For regulatory information management and MDR writing, Rimsys and Celegence CAPTIS appear often, and Climedo covers post-market clinical follow-up. On top sit horizontal tools like Microsoft 365 Copilot and Glean. The gap they all leave is a shared company memory that survives staff turnover and connects across the QMS, the technical files, and the regulatory record, which is why a Company Brain layer sits underneath the rest.

Yes, as a first-draft assistant with a qualified person reviewing and signing. AI can assemble sections of a technical file, draft a clinical evaluation report from source data, map requirements to the General Safety and Performance Requirements, and check documents for gaps against MDR Annex II and III. It cannot own the file. Under ISO 13485 and the MDR a named person is accountable for what is submitted to a notified body, so the practical rule is simple: AI drafts and cross-checks, a regulatory expert reviews and signs, and every action is logged. Tools like Ketryx report reducing documentation burden by up to 90 percent while keeping a human in the loop.

Complaint handling is high-volume, deadline-bound, and repetitive, which makes it one of the clearest AI wins in medtech. AI reads incoming complaints from email, portals, and phone notes in many languages, extracts the structured fields a complaint record needs, suggests a category and a reportability assessment, and drafts the acknowledgement and investigation for a quality reviewer. A human still decides seriousness, makes the vigilance and Medical Device Reporting call, and signs the record. The gain comes from grounding the AI in your own complaint history and product knowledge, not a generic model.

A Company Brain is a private, living memory of your organisation - the people-knowledge, processes, and past work that normally lives in individual heads and scattered systems like the QMS, the eQMS, the PLM, and countless SharePoint folders. Medtech is unusually exposed to knowledge loss: the sector is short of skilled staff, the workforce is ageing, and MDR piled years of documentation on top of legacy systems. A Company Brain captures how your best regulatory writers, quality engineers, and complaint handlers actually work, so AI employees and new hires reuse it instead of starting from a blank page, and it keeps that knowledge inside your controlled, auditable environment.

If the AI touches a regulated record - a complaint, a CAPA, a deviation, a design control, a technical file - then it is subject to computer system validation under your ISO 13485 quality system and, for the US, the FDA Quality Management System Regulation that takes effect in February 2026. You follow a risk-based lifecycle: a validation plan, qualification testing that challenges the tool against known cases, defined human review points, tamper-evident audit trails, and monitoring for drift. This is separate from the question of AI inside the device itself, which follows the MDR conformity route and, increasingly, the EU AI Act.

They are two different regulatory worlds. AI that helps your team write documents, handle complaints, or run CAPA is a productivity tool inside your quality system, validated like any other software and generally low-risk under the EU AI Act. AI that is part of the device or is software as a medical device follows the full MDR conformity route, and where it is a safety component it is treated as high-risk under the AI Act, with both frameworks applying at once. This article is about the first kind - AI that takes routine documentation and quality work off your team - not about building AI into a product.

It depends on where the AI sits. AI used in operations - drafting, complaint triage, knowledge search, internal automation - falls into the minimal or limited-risk tiers, which carry light obligations such as transparency and AI literacy training. AI that is a safety component of a device, or is itself software as a medical device, is high-risk, and both the AI Act and the MDR apply simultaneously. The Commission and the Medical Device Coordination Group issued guidance in 2025 to align the two, and the high-risk obligations for AI embedded in products apply from August 2028. For most manufacturers the near-term work is governance and AI literacy, not a new conformity assessment.

No, but it changes what they do. AI takes the first draft, the data extraction, and the routine document work that fills their week, while the regulatory judgment, the reportability decision, and the sign-off stay human. In a regulated industry a qualified person must own every record that reaches a notified body or an authority, and an AI cannot be accountable to a regulator. The manufacturers that win pair AI employees with their experts so the experts spend their time on assessment and decisions rather than formatting, transcription, and chasing documents.

Horizontal seats like Microsoft 365 Copilot or ChatGPT Enterprise run from roughly 20 to 60 euros per user per month. Specialist medtech platforms for the QMS, RIM, or design controls price per module or per organisation and cost far more, because they carry validation support and domain depth. A custom Company Brain and AI employees are priced per use case tied to measurable outcomes rather than per seat. The larger hidden cost is fragmentation: buying many disconnected tools that each hold one slice of your quality and regulatory knowledge and none of the whole.

Start with one high-volume, lower-risk workflow where the return is obvious and a human already reviews the output: complaint intake and triage, CAPA and deviation drafting, MDR technical documentation gap-checking, or knowledge search across your QMS. Baseline the current hours and cycle time, prove the saving against that number, and capture the knowledge as you go. Resist the urge to buy ten tools at once. One validated, connected workflow that people actually use beats a shelf of unused subscriptions.

Yes. CAPA and deviation handling is document-heavy and pattern-rich, which suits AI well. A model grounded in your historical quality data can classify a new event by severity, suggest likely root causes from similar past cases, and draft the investigation and CAPA for a quality reviewer, who still owns classification and closure. AI agents are now shipping inside production QMS platforms to auto-summarise CAPA investigations, triage complaints, and generate audit-ready records. The gain comes from your own quality history, not a generic model, which is why the knowledge layer underneath matters as much as the tool.

AI makes inspection readiness a continuous state rather than a scramble. It can pull the evidence for a given requirement, check that CAPAs are closed and linked, flag documents that drift out of their review cycle, and answer an auditor-style question by surfacing the exact record and the person who owns it. It also captures how your team handled past findings so the next audit reuses that knowledge. The human still leads the audit and owns every answer, but the hours lost assembling evidence and rediscovering where things live drop sharply.

Related Articles

Sources

  1. BVMed - Ergebnisse der BVMed-Herbstumfrage 2025
  2. BVMed - Die Lage der MedTech-Branche 2025
  3. Rebmann Research - BVMed-Herbstumfrage 2025: MedTech-Branche waechst, doch Buerokratie bremst
  4. ingenieur.de - Die deutsche Medizintechnik schlaegt Alarm
  5. McKinsey - Strategies for Scaling Generative AI in the Medtech Industry
  6. MedDeviceGuide - EU MDR Notified Body Capacity Crisis 2026-2027
  7. MedEnvoy - What Is the Cost of Medical Device Approval in Europe?
  8. European Commission - MDR/IVDR Simplification, SWD(2025) 1050 final
  9. Baker McKenzie - The EU 2025 Proposal to Simplify the MDR/IVDR
  10. Ketryx - AI/ML Medical Device Compliance Software
  11. Ketryx - Ketryx Wants Its Validated AI Agents to Accelerate Compliance Workflows (Erez Kaminski)
  12. Medical Device Network - Ketryx Raises $39m to Advance AI Compliance Platform
  13. Greenlight Guru - Greenlight Guru with AI
  14. Greenlight Guru - eQMS for Medical Devices (FDA QMSR effective February 2026)
  15. RAPS - EU Commission Drafts Guidelines on Classifying High-Risk Systems Under the AI Act
  16. DQS - AI Act and AI-Enabled Medical Devices: Regulatory Status 2026
  17. IntuitionLabs - EU MDR and AI Act Compliance for AI Medical Devices
  18. MedDeviceGuide - EU AI Act for Medical Devices: Compliance Guide for MedTech (2026)
  19. SimplerQMS - Medical Device Complaint Handling Process
  20. Matrix Requirements - Application Lifecycle Management for Medical Devices
  21. Rimsys - RIM vs eQMS Software for Medical Device Manufacturers
  22. Celegence - AI Solutions for Regulatory Compliance in the Medical Device Industry (CAPTIS)
  23. Climedo - Clinical Validation and Post-Market Surveillance Platform
Henri Jung, Co-founder at Superkind
Henri Jung

Co-founder of Superkind, where he helps SMEs and enterprises deploy custom AI agents that actually fit how their teams work. Henri is passionate about closing the gap between what AI can do and the value it creates in real companies. He believes the Mittelstand has everything it needs to lead in AI - it just needs the right approach.

Ready to put AI to work without losing control of your data?

Book a 30-minute call with Henri. We will find your highest-return regulated workflow and show how a Company Brain keeps what your experts know - no commitment, no sales pitch.

Book a Demo →