medical-ai-compliance-gatelisted

# Medical AI compliance gate (GDPR · MDR · ISO 27001 · SOC 2, verified) Prepare a medical/health-AI system for compliance and **prove the machine-decidable part** — gaps are surfaced by a scanner that runs over the repo, fixed by severity, and re-scanned until green; then a mandatory human attestation completes the gate. ## Core principle **Gaps are measured, not assumed.** The loop is: scan → triage by severity → fix the cause → re-scan, until the automated gate is green; then complete the manual attestation before any readiness claim. **Be honest about scope (this is the rule that keeps the skill correct):** this is **engineering assistance to prepare for compliance**, nothing more. It is **NOT** legal advice, **NOT** a regulatory certification, **NOT** an EU MDR conformity assessment or CE marking, **NOT** a Notified Body audit, **NOT** an ISO 27001 certification, and **NOT** a SOC 2 attestation. MDR conformity for medical-device software (MDSW) additionally requires a QMS (ISO 13485), risk management (ISO 14971), a clinical evaluation, and — for most classes — a Notified Body, none of which this replaces. Heuristics have false positives and negatives. **Passing the gate ≠ compliant.** Never report "GDPR/MDR/ISO/SOC 2 compliant" on a green scan — report "0 blocking automated controls; manual attestation pending/complete." → `references/01-frameworks-and-scope.md` ## When to use vs. not - Use for: a compliance/readiness **gap analysis** of a health-AI codebase or data