Software as a medical device,traced in Jira and Confluence.
Your pre-submission meeting is months away, and the trace matrix is a spreadsheet only your consultant understands. We link clinical and user feedback, design decisions, requirements, risk controls, tests and releases in Jira and Confluence, so the evidence builds as you work, and your regulatory lead can rely on it.
What is software as a medical device?
Software as a medical device (SaMD) is software intended for a medical purpose that runs on its own, not as part of a hardware device. It is regulated like a device: design controls, risk management under ISO 14971 and a software lifecycle under IEC 62304. That means every requirement needs a traceable path to its design, risk controls, tests and release.
The night before the regulator meeting
Did you ever open the trace matrix the night before a regulator meeting, and realize you weren’t sure it was true?
Not wrong, exactly. Just… not sure.
Row 214 says requirement REQ-014 is verified by test TST-022. But TST-022 was rewritten in the spring. Was it run again on the model you’re actually submitting? Somebody would know. That somebody is on holiday.
So you do what every SaMD team does. You open Jira in one tab, Confluence in another, the spreadsheet in a third and the risk file in a fourth. You start clicking. At 11:40 pm you find it: the test passed, on a build from three releases ago.
You fix the row. You don’t sleep well.
| REQ-014 | see v3 doc? | TST-022 |
| REQ-015 | — | TST-023 |
| REQ-016 | RC-009 | TBD |
What’s actually going on
Your team didn’t do anything wrong.
They wrote the requirements. They ran the tests. They controlled the risks. The work is real. What’s missing is the thread between the pieces, so every time someone asks for proof, a person has to walk the whole chain by hand, from memory, under deadline.
That’s why the matrix is always a few weeks out of date. That’s why every auditor question costs a developer a day. And that’s why “are we on track for the submission?” is the one question you answer with “yes” while thinking “probably”.
What if the matrix built itself?
Picture the same night, a few months from now.
You open one Jira filter. Every requirement for the release, with its test, its result and the risk control it carries, already linked, because the links were made while the work happened, not the night before.
The gaps are a list: three requirements without a test, one risk control without verification. Your team has seen that list every sprint for months, so it’s short.
The matrix is a view of the work, not a separate document someone maintains. Your regulatory lead reviews it. Your consultant writes the documents from it. Your engineers never touch a spreadsheet.
You close the laptop at 7 pm.
That’s not a new tool. It’s the Jira and Confluence you already pay for, set up around how a SaMD team actually builds. That’s what we do.
| REQ-014 | TST-022 | Passed | RC-007 |
| REQ-015 | TST-023 | Passed | RC-008 |
| REQ-016 | TST-024 | Passed | RC-009 |
Gaps: 3 requirements without a test · 1 risk control without verification
What we set up in Jira and Confluence
Requirements, risk controls, tests and releases as linked work items in Jira, with the links your regulatory lead needs made required. Design history and controlled documents in Confluence, versioned and approved. A loop that takes clinical and post-market feedback back to design. And a clear switch point where research becomes design control, so model and data changes are traced too.
FB-112Clinical feedbackTracedDEC-031Design decisionTracedREQ-014RequirementTracedRC-007Risk controlTracedTST-022VerificationTracedREL-2.4ReleaseTracedWhen SaMD teams usually call us
- A pre-submission or audit is comingA pre-submission meeting, a notified-body or approved-body review in the next few months, and a trace matrix nobody wants to defend.
- Someone asked a question you couldn’t answerA mock audit, an investor’s due diligence or a clinical partner asked which test verifies which requirement, and the answer took a week.
- Your first quality lead found the spreadsheetA full-time head of quality or regulatory joined and is now accountable for a process that lives in Jira, where they can’t change anything.
- The model or the market changedA new AI model version, a second market (UK to US, or the reverse) or a new product, and the evidence has to cover it.
Are you the head of quality?
You keep the decisions and the sign-off. We build the process in Jira and Confluence around your quality system: the work item types, required links, approvals and release records, so you can see the evidence without asking an engineer. We work alongside your regulatory consultant, not instead of them, and we don’t touch your eQMS.
Trace reportLinked
Risk controls verified12 / 12
ApprovalHead of quality ✓
How we work with SaMD teams.
The same five stages, shaped around IEC 62304 and your design history.
Flywheel
Your current flow mapped against the IEC 62304 lifecycle; gaps listed, with a way forward.
A trace model for requirements, risk controls and tests, with one feature traced live.
Jira and Confluence set up, with design history and controlled documents in place.
Automated trace checks, release evidence and Rovo agents.
A health review before each release or audit.
- Then back to Teardown before the next major release.
A first engagement usually starts with Teardown, a fixed-scope look at how your work flows today. Scope agreed on the review call.
Find out where your chain breaks, in six minutes
You don’t need a call to find out where your chain breaks. You need six minutes.
The SaMD Traceability Check asks 18 questions about how your team works today: no documents, no screenshots, no confidential details. Your score shows right away, area by area. You don’t need to give your email to see it.
You’ll find out:
- which of six areas is putting your submission at risk, and which is quietly fine;
- whether your AI and data work is traced like the rest of your software, or living in a separate world;
- the one gap auditors tend to sample first, and whether you have it;
- whether your trace chain is something a new head of quality could take over tomorrow, or something that leaves with one person.
If the score is good, you’ve lost six minutes and gained some sleep. If it isn’t, you’ll know exactly where to start, before the regulator tells you.
Take the SaMD Traceability Check
P.S. We’re not a regulatory consultancy, and we’ll never tell you you’re “compliant”. Your regulatory lead keeps that call. We build the flow in Jira and Confluence so their evidence is easy to produce and easy to show.
58/100
- Full traceabilityPartly
- Risk managementGap
- AI and dataGap
- Engineering connectedIn place
Questions SaMD teams ask
How do I build a traceability matrix in Jira for IEC 62304?
Keep user needs, requirements, hazards, risk controls and tests as their own linked work item types in Jira, with link types named by meaning (verifies, mitigates, implements) and required where they matter. The matrix is then a query or a report per release, not a spreadsheet rebuilt by hand. Our traceability matrix guide walks through it.
How do you trace AI and machine-learning models?
Treat the model like any other part of the design: each model version links to the data, code and parameters that produced it, to the requirements it meets and to the tests that verified it. The hard part is deciding when an experiment becomes design work. We help your team set that switch point, so research stays fast and design control starts on purpose.
Can Jira be used for medical device software development?
Yes. Many SaMD teams run their software lifecycle in Jira, with requirements, risk controls, tests and releases as linked work items and Confluence for design history and controlled documents. What matters is the setup: clear work item types, enforced links and a release record your regulatory team can review.
Do we need an eQMS as well as Jira and Confluence?
It depends on your size and what your regulators expect: the FDA in the US, your notified body in the EU. Many small SaMD teams run design controls in Jira and controlled documents in Confluence with an e-signature app, and keep CAPA, training and supplier records elsewhere.
Who signs off on our regulatory evidence?
Your RA/QA lead. We design the flow and the evidence trail; your team owns sign-off.
Find out where your chain breaks.
A free 45-minute review call with Ewa. We look at how your requirements, risk controls and tests connect today, and what to fix first.