Platform

One platform for the firm, and a workspace for each client.

SMEDTEC OS runs the regulatory firm: the practice and its statutory mandates in one workspace, workable from your AI assistant. Each client keeps its own workspace, with its own document vault and immutable log, and connects to the firm only with consent.

01 · Practice

Run the firm, from enquiry to deliverable

The operating system for a regulatory consultancy — from enquiry to numbered deliverable, with the firm's knowledge on file and its consultant network inside the same workspace.

For consultancies

  • Enquiries → clients → engagements → milestones → deliverables, with my-work and team-work views
  • Document Studio: document families, versions, approvals and shared reference numbering
  • Positions and constraints filed, reviewed and reused; a Practice Assistant that answers only from reviewed knowledge in the firm's own writing style
  • Consultant network: CV intake, a controlled four-axis skill taxonomy, published opportunities, work orders and invoices into a commercial ledger
  • Consultant Radar: a fortnightly regulatory digest for every seated consultant, built only from the public catalogue
  • Payables, operations reports and per-client commercial metrics

02 · Rep Hub

Hold representation mandates to the statute

For firms acting as EU Authorised Representative, UK Responsible Person, US Agent or TGA Sponsor: one engagement per client and per role.

For representativesFor consultancies

  • Obligation sets instantiated per engagement from a library in which every obligation cites the provision that creates it, queued across every mandate at once
  • SRN, MHRA, FDA and ARTG identifiers recorded against each registration, with their renewal cadence and retention clock
  • One deadline board: renewals, confirmations, retention, vigilance timers and authority response targets, plus a daily sweep into alerts
  • Vigilance intake and forwarding to the manufacturer, with the elapsed time evidenced and TGA reporting clocks derived from receipt
  • Authority communication log for competent-authority, MHRA, FDA and TGA requests, samples and inspection scheduling
  • FSCA, recall and CAPA coordination — authority notified, FSN issued, proof of receipt, effectiveness check
  • Client workspaces under the firm, with read-only access for client contacts to their own products, documents and status
  • Mandate termination with authority-notification steps tracked
  • Briefing Studio: market-access briefing notes with every claim traced to a recorded source or flagged for confirmation

03 · Assistant & connector

Datum in the workspace. Your firm in your AI assistant.

Datum is a workspace assistant that retrieves before it answers and refuses to answer from nothing. The SMEDTEC OS connector puts your firm's enquiry cards, quotations and mandates inside an AI assistant that supports MCP, working as you. Neither ever sees another organisation's data.

For manufacturersFor representativesFor consultancies

  • The SMEDTEC OS connector is a standard MCP server: add it to an assistant that supports MCP connectors, such as Claude, and it works in your firm's workspace with your own access
  • Practice from your assistant: find and open enquiries, log correspondence, add contacts, record scope and fee, finalise the Quotation from your house template and mark it as sent
  • Rep Hub from your assistant: your portfolio, mandates, deadlines and obligations; complete or add a deadline; log a new vigilance case
  • Nothing the connector does sends email, terminates a mandate or deletes data
  • Forced retrieval: the planning step cannot produce prose, only searches over your own data
  • Abstention gate: no evidence, no model call — Datum says it cannot answer rather than guessing
  • Sealed synthesis: the answer is written from the question and the evidence, never from the running transcript
  • Citations resolved against the retrieved evidence and dropped if they do not resolve
  • Every retriever hard-scoped to the caller's organisation; AI access follows the plan tier

04 · Client workspaces

Your clients' regulatory record

For the manufacturers your firm serves: their own workspace, connected to yours when they approve, or one your firm runs on their behalf. One record per device, and everything a regulatory team does hangs off it: pathways, registrations, post-market cycles, evidence and cost.

For manufacturers

  • Product record with classifications, SKUs, target markets and lifecycle stage
  • Regulatory pathways broken into phased work items with owners, due dates and dependencies — EU MDR, 510(k), De Novo, PMA, UKCA, MHRA, TGA, Health Canada
  • Country registrations tracked per product and market (MHRA, TGA, Health Canada, EUDAMED and more); launch-readiness gates the move from launching to selling
  • Post-market lifecycle: surveillance programmes that start their cycles at launch, significant-change assessments, design dossier maintenance, audit programmes
  • Document vault with approvals and supersession tracking, and audit packs with a SHA-256 manifest on every export
  • Intake portal so the rest of the business raises regulatory requests with provenance; AI-assisted triage; one-step conversion into tracked work
  • Cost estimates, certificates, calendar, personal task queue and alerts

05 · Intelligence

Know what is changing

A daily, personalised signal feed routed against your markets and device classes, and a public newsletter built from the same catalogue.

For manufacturersFor consultancies

  • Regulatory developments from MHRA, FDA, MDCG, the European Commission, TGA and more
  • Competitor clearances from FDA 510(k)/PMA, BfArM, Swissmedic and EUDAMED
  • Market access: HTA and reimbursement decisions — the commercial signal most compliance tools omit
  • Predicates, adverse-event signals, FDA-recognised consensus standards and EMDN nomenclature
  • Command Centre with a deadline horizon, today's brief and portfolio-level insights
  • SMEDTEC Intelligence, the free public digest at /intelligence

06 · Security and trust

Built to hold up in front of a notified body

Tenant isolation is enforced in the database, not in application code, and the evidence for that claim is a structured test rather than a statement.

For manufacturersFor representativesFor consultancies

  • Row-Level Security on every multi-tenant table, with SECURITY DEFINER RPCs for privileged paths
  • Direct-API RLS penetration test, 1 April 2026: 15 of 15 cross-organisation and unauthenticated attempts refused; log retained and available under NDA
  • Immutable audit trail written by database triggers — before/after snapshots, actor, timestamp — that application code cannot bypass
  • SHA-256 audit-pack manifests hashed in the browser at upload; an auditor can re-compute every digest
  • Data at rest in eu-west-2 (London), AES-256; TLS 1.2+ and HSTS on every surface
  • Five roles — Owner, Admin, Member, Viewer, Requester — enforced by RLS policies, plus a client-book dimension for consultancy admins
  • Platform Validation Statement SMEDTEC-VAL-001 and a self-serve Validation Kit (VAL-000–VAL-006) in the Trust Centre; DPA published at /dpa

Seven structural properties that matter in a procurement conversation

These are architectural facts about the platform, not positioning statements.

  1. 01

    Multi-tenant isolation is enforced in the database

    Not in middleware, not in application code. Every table carries Row-Level Security, and a structured penetration test of the production endpoint is what backs the claim.

  2. 02

    Every export carries a SHA-256 manifest

    Audit packs and vault downloads are tamper-evident. A notified body can re-compute every digest and confirm no file changed after export.

  3. 03

    Each party owns its workspace

    Manufacturers, representatives and consultancies each work in their own isolated workspace. A firm connects to a client's workspace only when the client approves, sees only the product records the client switches on, read-only, and loses access the moment the client ends it.

  4. 04

    The intake portal is a first-class citizen

    Sales, engineering and marketing raise regulatory requests with full provenance from submission through triage to tracked work.

  5. 05

    AI that retrieves before it speaks

    Datum, the Practice Assistant and Briefing Studio all work from recorded evidence, cite it, and abstain or flag when it is missing. Every call is token-capped and logged per organisation.

  6. 06

    Human-readable entity references throughout

    Sequential identifiers appear in every report, export and external communication, so a piece of evidence means the same thing in a notified-body submission as it does in the platform.

  7. 07

    Built by people who run regulatory engagements

    The same team advises manufacturers through EU MDR transitions, 510(k) submissions and notified-body audits. The entity model and terminology come from that work.

Five roles. Distinct permissions. Enforced at every layer.

Every role is defined in the database and enforced by Row-Level Security policies — not by application checks that can be bypassed. Consultancy admins gain a further dimension: acting across each managed client, with isolation preserved between clients.

RoleTypical userAccess scope
OwnerFounder, RA Director, consultancy principalEverything in the organisation, including billing and plan management.
AdminRA Manager, Quality ManagerFull operational access including team management; no billing.
MemberRA Specialist, Quality Engineer, consultantFull operational access to products, pathways, evidence and reports; no team management.
ViewerAuditor, executive observer, client contactRead-only, optionally scoped to specific products; read-only access to their own products, documents and status for managed clients.
RequesterSales, engineering, marketingIntake portal only — submit and track their own regulatory requests.

What SMEDTEC OS is not

It is not an eQMS. There is no CAPA, complaints handling or training-record management. SMEDTEC OS is the regulatory operations and intelligence layer that sits alongside the quality system you already run, and complements it rather than replacing it.

Platform questions

Is SMEDTEC OS one product or several?

One platform with layers. A firm's workspace runs the Practice layer and Rep Hub, can be worked from an AI assistant through the SMEDTEC OS connector, and can manage a workspace on a client's behalf. A manufacturer's workspace runs operations and intelligence. Every workspace has its own audit trail, document vault and assistant, kept to its own organisation.

Does the AI see data from other organisations?

No. Every retriever is scoped to the calling organisation at the database level. Datum and the Practice Assistant answer only from your own vault, products and reviewed knowledge, cite what they used, and abstain when they have nothing to cite.

How do you evidence the security claims?

A structured direct-API penetration test of Row-Level Security was run against the production endpoint on 1 April 2026 — 15 of 15 cross-organisation and unauthenticated attempts were refused, and the log is available under NDA. The platform validation statement and the self-serve validation kit are available in the Trust Centre; the DPA is published.

Which certifications do you hold?

SMEDTEC OS runs on SOC 2 compliant infrastructure and its controls are mapped to ISO 27001:2022, with ISMS documentation published. We do not currently hold our own ISO 27001 or SOC 2 certificate and do not claim one.

See it with your own clients.

Start your firm's trial with everything switched on for fourteen days, or take the four-minute interactive demo on fictional data first.

Start your firm's trial