Matrix Req: Continuous Design Control and Traceability for Medical Device Teams

Medical device teams don't typically fail audits because their engineering was wrong. They fail because their documentation doesn't accurately reflect their engineering — or because reconstructing what actually happened requires hours of cross-referencing across Word documents, Excel risk files, and a QMS that wasn't designed to talk to either. The design history file — the documentary backbone of every FDA 21 CFR Part 820 and ISO 13485 product submission — must demonstrate that design inputs were identified, design outputs were verified against them, risks were assessed and mitigated, and the entire chain is traceable. When those artifacts live in disconnected tools, the DHF doesn't exist until someone builds it: assembled once, under time pressure, by whoever understands the project well enough to know what should be in it. That person becomes a single point of failure for every audit the organization faces. Matrix Req's premise is that the DHF should be continuously present, not periodically assembled. As requirements are captured, linked to risks, traced to test cases, and verified with results, the trace chain exists in the system in real time. The design history file at any given moment reflects the actual state of the project — exportable as a formatted PDF package whenever it's needed, not just when a submission deadline forces it. Audit readiness becomes a byproduct of how the team works, not a separate compliance sprint.

The working model is requirement-centric. Regulatory requirements, user needs, and design inputs are captured in a unified repository with automatic version control. Each requirement links directly to design outputs, risks assessed under ISO 14971-aligned templates, test cases built for IEC 62304 verification, and V&V results. When a requirement changes, the system surfaces every downstream artifact affected: risks that reference it, test cases that verify it, design outputs that address it — the impact chain is visible before the change is made. Risk management is embedded rather than separate. ISO 14971-aligned templates with configurable risk scoring mean the risk management file is a live, linked view of project data — hazard identification, risk controls, and residual risk assessment all connected to the requirements they address. The trace table auditors ask for is a query of the same data, not a separate document prepared for submission. Document generation is output, not process. Trace tables, design control summaries, and technical documentation packages export as formatted PDFs from live project state. Electronic signatures and a complete audit trail meet 21 CFR Part 11 requirements — every change, review, and approval is logged with timestamp and user attribution. Templates aligned with ISO 13485, ISO 14971, and IEC 62304 ship with the platform, eliminating the pre-engagement consulting work that typically falls on a regulatory manager before a generic ALM tool becomes usable for device development.

Two AI tools are built into Matrix Req, both designed specifically for the IP-sensitivity constraints of regulated medical device development. The Compliance Checker addresses a specific bottleneck: knowing whether your current documentation satisfies the exact requirements of a standard. The tool extracts requirements from the applicable standard — FDA QSR 21 CFR Part 820, EU MDR, ISO 13485, ISO 14971, or IEC 62304 — identifies gaps in your project documentation against those requirements, and suggests modifications to close them. For teams navigating both FDA and EU MDR pathways simultaneously — common for Class II and Class III devices entering global markets — that cross-standard gap analysis would otherwise require manual cross-referencing by a regulatory expert, typically a significant billable-hours engagement. Matrix Mind is an in-platform AI assistant that helps teams author requirements, risks, and test cases and answers questions about the project in plain language. For quality engineers and regulatory managers authoring the same structured artifact types repeatedly — risk assessments, verification protocols, traceability justifications — the assistant surfaces coverage gaps and reduces authoring time without removing the regulatory judgment that makes those artifacts defensible in a submission. Both tools operate under a zero data retention agreement with the LLM provider (AWS Bedrock) — design data, regulatory documentation, and IP-sensitive project content are not retained by the AI provider's systems and are not used to train any models. For medical device companies protecting pre-submission intellectual property, that agreement is the meaningful distinction between adopting AI tools and exposing IP to external model training.

Medical device companies running active software development programs typically have established issue tracking in Jira, Azure DevOps, or GitHub. Asking an engineering team to migrate its core workflow to a compliance-first platform is a disruption that often results in adoption failure: the compliance tool becomes an audit artifact repository that nobody keeps current, rather than the working system it was meant to be. Matrix Req connects bi-directionally to Jira, Azure DevOps, GitHub, and GitLab — software defects opened in Jira surface in Matrix Req with their traceability context; test execution results in Azure DevOps update corresponding test cases; GitHub commits can be linked to the requirements they address. Confluence and TFS are also supported as integration targets. The quality and regulatory team has a compliance-structured view of the project; the engineering team keeps their existing workflow. Traceability is captured at the integration boundary without requiring either team to change their primary tooling. For multi-product organizations, the Compose module adds a shared base-library of regulatory requirements that automatically propagate to all products in a device family. Requirements written once for a shared platform architecture are referenced — not duplicated — across individual product DHFs, with traceability maintained across shared artifacts. Device families and platform architectures can grow their product portfolio without rebuilding the compliance record from scratch for each variant.

The clearest fit is a medical device development team of 5 or more people — typically spanning regulatory affairs, quality engineering, and software development — working on Class II or Class III devices under FDA or EU MDR oversight where documented design controls, risk management files, and DHF packages are not optional compliance overhead but submission evidence requirements. SaMD (Software as a Medical Device) teams get specific value from the alignment between Matrix Req's IEC 62304-structured templates and its direct integration with software development tooling. GitHub, GitLab, and Azure DevOps connections mean the software development workflow and the IEC 62304 documentation requirement share a traceability layer rather than running in parallel systems that must be reconciled at submission time. Teams entering both FDA and EU MDR pathways simultaneously benefit from the Compliance Checker's multi-standard gap analysis — the manual work of reconciling two regulatory frameworks against a single documentation set is where regulatory consultant hours accumulate fastest, and automated gap identification addresses that directly. Multi-product organizations building device families benefit from the Compose module's shared requirements library, which prevents requirements duplication and keeps the compliance record consistent across products without manual synchronization. The fit is weaker for early-stage pre-product teams, solo compliance managers without an engineering team in the platform, or those building Class I medical devices with minimal formal QMS requirements. The platform's depth and implementation investment are calibrated for the full design control lifecycle of regulated Class II and Class III development. Evaluating 6-12 months before your next audit milestone — not during the submission sprint — gives the implementation timeline room to work.