MHRA SaMD & AI Change Program

MHRA SaMD & AI Change Program — 100% of in-scope requirements covered.

41 requirements · 41 in scope (41 enforced). The 100% is weighted over the in-scope base.

MHRA SaMD & AI Change Program: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

intended-purpose-shift · enforced

Change-class trigger — material shift in intended purpose
Audit events: kye.purpose.permission.v1, kye.agency_drift.event.v1 · Constitution: 12 purpose permission
capability-expansion · enforced

Change-class trigger — capability expansion beyond declared profile
Audit events: kye.model.capability_profile.v1, kye.agency_drift.event.v1 · Constitution: 25 edge governance
model-parameter-drift · enforced

Change-class trigger — model_params drift beyond envelope
Audit events: kye.evidence.model_params.v1, kye.model.influence_envelope.v1, kye.signal.drift.detected.v1 · Constitution: 13 resilience loop
indication-expansion · enforced

Change-class trigger — clinical indication or patient population expansion
Audit events: kye.purpose.permission.v1, kye.risk_assessment.v1 · Constitution: 12 purpose permission
algorithm-architecture-change · enforced

Change-class trigger — architectural change (model type swap, weights replacement)
Audit events: kye.evidence.model_params.v1, kye.compliance.attestation.v1 · Constitution: 13 resilience loop
deployment-region-shift · enforced

Change-class trigger — deployment region / jurisdiction change
Audit events: kye.jurisdiction.attestation.v1 · Constitution: 25 edge governance

How this widget is built

Demonstrates

KYE™ Compliance Mapping Rail™

Components

Framework requirement (clause)
Coverage status
KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)

Flow

Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram

Used on

/compliance/mhra-samd-change-programme/: On every framework page, after its opening.

Source: MHRA Software and AI as a Medical Device Change Program (2023) — 15 work-packages covering qualification, classification, PCCP, clinical evidence, post-market scrutiny, transparency, bias, cybersecurity, real-world performance, AI Airlock, adaptive control, failure-mode analysis

By category

Category	Reqs	Enforced	Coverage
Change-Class Triggers	9	9	100%
Software and AI as Medical Device Change Program	15	15	100%
Oversight + Bias Mitigation	4	4	100%
Predetermined Change Control Plan (PCCP)	7	7	100%
Transparency Obligations	6	6	100%

Every requirement → the KYE™ artefact that enforces it

ID	Title	Status	KYE™ enforcement
`mhra-samd-change-programme.cct.intended-purpose-shift`	Change-class trigger — material shift in intended purpose	enforced	audit_events: `kye.purpose.permission.v1`, `kye.agency_drift.event.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`mhra-samd-change-programme.cct.capability-expansion`	Change-class trigger — capability expansion beyond declared profile	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.agency_drift.event.v1` engines: `internal`, `internal` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`mhra-samd-change-programme.cct.model-parameter-drift`	Change-class trigger — model_params drift beyond envelope	enforced	audit_events: `kye.evidence.model_params.v1`, `kye.model.influence_envelope.v1`, `kye.signal.drift.detected.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.cct.training-data-shift`	Change-class trigger — training data distribution shift	enforced 1 unverified citation	audit_events: `kye.signal.stable_drift.detected.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.cct.performance-degradation`	Change-class trigger — performance degradation past threshold	enforced 1 unverified citation	audit_events: `kye.signal.drift.detected.v1`, `kye.assurance.review_cycle.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.cct.indication-expansion`	Change-class trigger — clinical indication or patient population expansion	enforced	audit_events: `kye.purpose.permission.v1`, `kye.risk_assessment.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`mhra-samd-change-programme.cct.algorithm-architecture-change`	Change-class trigger — architectural change (model type swap, weights replacement)	enforced	audit_events: `kye.evidence.model_params.v1`, `kye.compliance.attestation.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.cct.dataset-bias-shift`	Change-class trigger — bias profile shift across subgroups	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation, `kye.signal.drift.detected.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.cct.deployment-region-shift`	Change-class trigger — deployment region / jurisdiction change	enforced	audit_events: `kye.jurisdiction.attestation.v1` engines: `internal` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`mhra-samd-change-programme.wp-1.scope`	Scope of AI/ML as SaMD declared	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.entity_passport.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`mhra-samd-change-programme.wp-2.qualification`	Software qualification (is it a medical device?)	enforced 1 unverified citation	audit_events: `kye.risk_assessment.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal`, `internal` dictionaries: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.wp-3.classification`	Classification (Rule 11 SaMD)	enforced	audit_events: `kye.risk_assessment.v1` engines: `internal`, `internal` dictionaries: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.wp-4.pccp`	Predetermined Change Control Plan (PCCP) declared	enforced 2 unverified citations	audit_events: `kye.assurance.adoption_stage.v1`, `kye.assurance.model_validation.v1` unverified citation, `kye.assurance.management_review.v1` unverified citation engines: `internal`, `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.wp-5.change-control`	Change-control evidence (what can change without re-assessment)	enforced 2 unverified citations	audit_events: `kye.assurance.adoption_stage.v1`, `kye.resilience.drift.detected.v1` unverified citation, `kye.assurance.management_review.v1` unverified citation engines: `internal`, `internal` workers: `kye-drift-detector` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.wp-6.clinical-evidence`	Clinical evidence (sufficient, current, representative)	enforced 2 unverified citations	audit_events: `kye.evidence.pack.v1`, `kye.evidence.healthcare.cdss.v1` unverified citation, `kye.assurance.model_validation.v1` unverified citation engines: `internal`, `internal` workers: `kye-evidence-pack-assembler` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`mhra-samd-change-programme.wp-7.post-market-scrutiny`	Post-market scrutiny (continuous monitoring)	enforced 3 unverified citations	audit_events: `kye.resilience.drift.detected.v1` unverified citation, `kye.resilience.measurement_record.v1` unverified citation, `kye.report.quarterly_drift.v1` unverified citation engines: `internal`, `internal`, `internal` workers: `kye-drift-detector`, `kye-reporting-worker` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.wp-8.transparency-explainability`	Transparency and explainability	enforced	audit_events: `kye.evidence.decision_map.v1`, `kye.evidence.pack.v1` engines: `internal`, `internal` governedui_modules: `kye.governedui.module.evidence_timeline.v1` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.wp-9.human-interpretation`	Human-interpretation support	enforced 1 unverified citation	audit_events: `kye.decision.record.v1`, `kye.consent.receipt.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.critical_point_review.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`mhra-samd-change-programme.wp-10.bias-fairness`	Bias-and-fairness considerations	enforced 1 unverified citation	audit_events: `kye.risk_assessment.v1`, `kye.resilience.drift.detected.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`mhra-samd-change-programme.wp-11.cybersecurity`	Cybersecurity of AI-SaMD	enforced 1 unverified citation	audit_events: `kye.audit.event.v1`, `kye.audit.event.appended.v1` unverified citation engines: `internal`, `internal`, `internal` workers: `kye-gateway`, `kye-audit-chain-worker` probes: `security-headers`, `tls-valid` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`mhra-samd-change-programme.wp-12.real-world-performance`	Real-world-performance monitoring	enforced 3 unverified citations	audit_events: `kye.resilience.measurement_record.v1` unverified citation, `kye.report.monthly_decision_summary.v1` unverified citation, `kye.report.quarterly_drift.v1` unverified citation engines: `internal`, `internal` workers: `kye-reporting-worker` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`mhra-samd-change-programme.wp-13.ai-airlock`	AI Airlock alignment (regulatory sandbox)	enforced	audit_events: `kye.decision.shadow_evaluation.v1`, `kye.assurance.adoption_stage.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.wp-14.adaptive-algorithm-control`	Adaptive-algorithm change control	enforced 2 unverified citations	audit_events: `kye.assurance.adoption_stage.v1`, `kye.resilience.drift.detected.v1` unverified citation, `kye.assurance.model_validation.v1` unverified citation engines: `internal`, `internal` workers: `kye-drift-detector` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.wp-15.failure-mode-analysis`	Failure-mode analysis	enforced 1 unverified citation	audit_events: `kye.assurance.threat_model.v1` unverified citation, `kye.risk_assessment.v1`, `kye.assurance.audit_replay_report.v1` engines: `internal`, `internal` agents: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.ob.subgroup-performance`	Subgroup performance reporting (age, sex, ethnicity, comorbidity)	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation, `kye.evidence.pack.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.ob.bias-mitigation-plan`	Bias mitigation plan + ongoing fairness monitoring	enforced 1 unverified citation	audit_events: `kye.signal.drift.detected.v1`, `kye.assurance.review_cycle.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.ob.human-in-the-loop-at-critical-point`	Human-in-the-loop required at clinical critical points	enforced	audit_events: `kye.governedui.critical_point_review.v1`, `kye.governedui.approval.v1` engines: `internal` constitution_refs: `constitution/36-GOVERNEDUI.md`
`mhra-samd-change-programme.ob.override-capture`	Capture clinician override + dissent	enforced	audit_events: `kye.evidence.observed_action.v1`, `kye.governedui.critical_point_review.v1` engines: `internal` constitution_refs: `constitution/36-GOVERNEDUI.md`
`mhra-samd-change-programme.pccp.declared-changes`	PCCP — declared adaptive-algorithm changes (scope envelope)	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`mhra-samd-change-programme.pccp.modification-protocol`	PCCP — modification protocol describing data/test/release criteria	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation, `kye.evidence.pack.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.pccp.impact-assessment`	PCCP — impact assessment for each declared change	enforced	audit_events: `kye.risk_assessment.v1`, `kye.evidence.decision_map.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.pccp.outside-scope-trigger`	PCCP — change outside declared envelope triggers re-approval	enforced	audit_events: `kye.agency_drift.event.v1`, `kye.compliance.attestation.v1` engines: `internal`, `internal` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`mhra-samd-change-programme.pccp.version-traceability`	PCCP — version traceability across change instances	enforced	audit_events: `kye.compliance.attestation.v1`, `kye.evidence.pack.v1` engines: `internal` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`mhra-samd-change-programme.pccp.transparency-disclosure`	PCCP — disclosed to users + Approved Body before deployment	enforced	audit_events: `kye.transparency.statement.v1`, `kye.comms.dispatched.v1` engines: `internal` constitution_refs: `constitution/38-COMMS-RAIL.md`
`mhra-samd-change-programme.pccp.ongoing-monitoring`	PCCP — ongoing performance monitoring after each declared change	enforced	audit_events: `kye.signal.drift.detected.v1`, `kye.evidence.observed_action.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.tr.user-facing-disclosure`	User-facing transparency — clinician sees that AI is in the loop	enforced	audit_events: `kye.transparency.statement.v1`, `kye.transparency.receipt.v1` engines: `internal` constitution_refs: `constitution/36-GOVERNEDUI.md`
`mhra-samd-change-programme.tr.confidence-disclosure`	Confidence + uncertainty disclosed alongside output	enforced	audit_events: `kye.evidence.decision_map.v1`, `kye.transparency.statement.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`mhra-samd-change-programme.tr.training-data-summary`	Training data summary published in model passport	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.transparency.statement.v1` engines: `internal` constitution_refs: `constitution/17-DIRECTORY-SEARCH.md`
`mhra-samd-change-programme.tr.limitations-published`	Known limitations + contraindications published	enforced	audit_events: `kye.transparency.statement.v1` engines: `internal` constitution_refs: `constitution/17-DIRECTORY-SEARCH.md`
`mhra-samd-change-programme.tr.change-log-public`	Public change log of declared modifications	enforced	audit_events: `kye.compliance.attestation.v1`, `kye.transparency.statement.v1` engines: `internal`, `internal` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`mhra-samd-change-programme.tr.user-recourse`	User recourse — clinician can override + flag concerns	enforced	audit_events: `kye.governedui.critical_point_review.v1`, `kye.evidence.observed_action.v1` engines: `internal`, `internal` constitution_refs: `constitution/36-GOVERNEDUI.md`

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.

Related

NIST 800-53 Rev 5 hub (universal control taxonomy)NIST 800-53 Rev 5 is the universal control taxonomy KYE Protocol™ uses as the hub for every regulatory crosswalk. 20 control families, 25…
CDSCO Medical Devices Rules 2017CDSCO Medical Devices Rules 2017 coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.
CLIACLIA — US Clinical Laboratory Improvement Amendments (42 CFR Part 493) coverage by KYE Protocol™ — every requirement bijection-mapped to…
COSHHCOSHH — Control of Substances Hazardous to Health Regulations 2002 (UK) coverage by KYE Protocol™ — every requirement bijection-mapped to…
FDA + EMAFDA + EMA — AI / Provenance Expectations for AI-Derived Candidates in Regulated Pipelines coverage by KYE Protocol™ — every requirement…