Patents pending

Regulatory compliance at the pace of AI development.

Vertocol maps your product to the regulations that apply, puts expert review behind every mapping, and gives your AI coding tools traceable instructions from the start. Built for all regulated software teams, starting with medtech and health IT and expanding from there.

Join early access Apply to be a design partner →
CardioTrack/Regulatory obligations Search ⌘K

Risk register

11 hazards · ISO 14971 · linked to requirements
Group: Hazard
All 11Controlled 7In review 2Needs review 2
IDHazardS × PRiskStatus
RSK-01Missed arrhythmia flag delays review4 × 3High→LowControlled
RSK-02False alerts cause alarm fatigue3 × 4High→MedIn review
RSK-03Threshold override suppresses alerts4 × 2Med→?Needs review
RSK-04Sensor sync drops readings3 × 3Med→LowControlled
RSK-05Unauthorized access to heart-rate data4 × 2Med→LowControlled
RSK-06Alert never acknowledged by care team4 × 2Med→LowIn review
RSK-07Model drift lowers detection accuracy4 × 3High→?Needs review
RSK-08Cloud outage delays alert delivery3 × 2Low→LowControlled
VERTOCOLCARDIOTRACKStoryMatchesFoundationFeaturesOn track to save ~6 hrs

Chapter 1 · Your product story

What are you building?

CardioTrack is a mobile app that syncs heart-rate readings from a wearable sensor, uses a machine learning model to flag possible arrhythmia, and alerts the care team when a reading crosses a threshold. Clinicians sign in with their hospital accounts and make the final call on every alert.
48 wordsStrong brief.
That's enough to start. Three things that would save you questions later:→ What it does for the person using it→ Who's invited in, and by whom→ Anything it connects to
That's my product →
VERTOCOLCARDIOTRACKStoryMatchesFoundationFeatures2 matches lined up · you decide after the story

Chapter 1 · Your product story

That's the last of it.

Does CardioTrack diagnose, treat, or prevent a heart condition, or does it give clinicians information to support their own decisions?

it flags possible arrhythmia so the care team can review it

When a clinician gets an alert, how quickly are they expected to act on it?

they review it during the shift, it's not an emergency alarm

Got it. Alerts support routine review during a shift, and a clinician makes the final call.

Show me the 2 matches →
Vertocol › CardioTrack › Product definitionComplete and approve all areas to finalize and move onto the next step. Next
Product Identity✓ ConfirmedStatusEdit
Product NameCardioTrack
ApprovedEdit
Product CodeCT-01
ApprovedEdit
Product Scope
Product Type:Software as a Medical DeviceClinical Decision Support
Data Sensitivity:PHI InvolvedPII InvolvedFinancial Data
Compliance ProfileApprove AllWhy this profile? ⓘ
Foundational baseMandatory Floor
PrivacyHIPAA Privacy Rule45 CFR Part 164, Subpart E
ApprovedEdit
SecurityHIPAA Security Rule45 CFR Part 164, Subpart C
ApprovedEdit
Product-type specificBased on your Product Type
StandardsIEC 62304Medical device software lifecycle processes
Approval NeededApprove or Remove?
RiskISO 14971Application of risk management to medical devices
Approval NeededApprove or Remove?
PrevField 14 of 18 · IEC 623044 fields remainingNext ›

Release Dashboard

Review project readiness before handoff to development.

Readiness summary

Documentation ReadinessPartial
T1 Foundation approvedCanvas approvedAll features deepened & approvedPackage marked ready
Validation ReadinessPartial
Validation session existsSession signed offNo failing tests
Integration ReadinessPartial
Integrations declaredAll integrations approved
⚠ 4 blocking issues Documentation Readiness: Canvas approvedGo to Canvas → Documentation Readiness: All features deepened & approvedGo to Product Definition → Validation Readiness: Session signed offGo to Validation → Integration Readiness: All integrations approvedGo to Integration Details →

Release artifacts

DCEF Documentation PackageZIP / MD+JSONGo to Downloads →Validation Session ReportIn-page summaryView →CanvasMermaid⤓ Export Mermaid

Export Package

Download your DCEF documentation package for AI build tools, developer teams, and regulatory auditors.

Tier 1☑ Select all1 / 1 approved
☑
CardioTrack · Product ConstitutionT1-CONST Modified Oct 14, 2026 · v1.0
Approved
Tier 2☑ Select all11 / 14 approved
☑
Reading sync service · Feature FileT2-FEAT Modified Oct 13, 2026 · v1.0
Approved
☑
Arrhythmia alert engine · Feature FileT2-FEAT Modified Oct 13, 2026 · v1.0
Approved
☑
Escalation rules · Feature FileT2-FEAT Modified Oct 15, 2026 · v1.0
In progress
Tier 3☑ Select all1 / 3 approved
☑
Hospital SSO · Integration FileT3-INT Modified Oct 12, 2026 · v1.0
Approved
V CanvasCardioTrack Canvas▾ DefinitionDesignVerificationSubmission + Add BR
✓
Product foundationCardioTrack

Signed v3 · Regulatory SME

Coverage82%
Regulations
FDA SaMDHIPAAIEC 62304ISO 14971
Open foundation
BR-0192%
Detect arrhythmia for clinician review◈ 5 features
BR-0288%
Secure access for hospital staff◈ 4 features
BR-03In review54%
Alert acknowledgement and escalation◈ 3 features
BR-04Draft20%
Patient reading history◈ 2 features
Integrations · Tier 3
◎Wearable sensor SDKVendor not named · DeviceDeclared
⛨Hospital SSOOkta · IdentityConfirmed
⇄EHR exportEpic · FHIR APISuggested

Regulatory obligations

42 total · mapped from brief v3
Group: Regulation
All 42Approved 36In review 4Needs review 2
IDRequirementSourceStatus
REQ-014Encrypt heart-rate readings at restHIPAA 45 CFR 164.312(a)(2)(iv)ApprovedRS
REQ-015Log every PHI access eventHIPAA 45 CFR 164.312(b)ApprovedRS
REQ-021Classify arrhythmia alert logic by safety classIEC 62304 §4.3In reviewMT
REQ-022Assess ML arrhythmia flag against CDS criteriaFDA CDS guidance · SaMDNeeds review?
REQ-027Risk controls for threshold alertsISO 14971 §7.1ApprovedRS
REQ-031Hospital SSO with role-based accessSOC 2 CC6.1ApprovedAK
REQ-033Audit trail for alert acknowledgementFDA QMSR · 21 CFR 820In reviewMT
REQ-036Clinician override of alert thresholdISO 14971 §7.1Needs review?
REQ-038Document software units for alert moduleIEC 62304 §5.4ApprovedAK
REQ-040Supplier controls for cloud hostingISO 13485 §7.4ApprovedRS

Approvals

2 waiting on expert review
Assigned: Regulatory SME
Queue 6Signed 36Library 118
REQ-022Assess ML arrhythmia flag against CDS criteriaAlerts may be time-critical. Needs a judgment call.FDA CDS guidanceNeeds review?
REQ-036Clinician override of alert thresholdOverride changes the risk control. Confirm residual risk.ISO 14971 §7.1Needs review?
REQ-021Classify arrhythmia alert logic by safety classDraft classification: Class B. Awaiting sign-off.IEC 62304 §4.3In reviewRS
REQ-033Audit trail for alert acknowledgementRecord retention period to confirm.21 CFR 820In reviewRS
REQ-031Hospital SSO with role-based accessReused from library. Approved on a previous project.SOC 2 CC6.1ApprovedRS
REQ-014Encrypt heart-rate readings at restSigned v3. Linked to 3 features.45 CFR 164.312ApprovedRS

Traceability matrix

Requirement → feature → test → evidence
42 of 42 traced
42Requirements
17Features linked
64Verification tests
36Signed judgments
ReqFeatureTestEvidenceCoverage
REQ-014Reading sync serviceT-014-a, T-014-bSigned v3
REQ-015PHI access loggerT-015-aSigned v3
REQ-021Arrhythmia alert engineT-021-aIn review
REQ-027Threshold alert rulesT-027-a, T-027-cSigned v3
REQ-031Hospital SSOT-031-aSigned v2
REQ-033Alert acknowledgementT-033-aIn review

Works with the tools you already use

  • Claude Code
  • Cursor
  • GitHub Copilot
  • OpenAI Codex
  • GitHub
  • Lovable

…and any coding tool that reads Markdown or JSON.

AI changed the pace of building. Compliance still moves at human speed. Vertocol builds compliance into how software gets made, traced to regulation, with expert sign-off on every judgment call.

1.0 to 5.0 How it works

From story to traced, compliant code.

1.0 Describe

Start with plain language.

Tell the story of your product in your own words. Vertocol asks follow-up questions the way a regulatory expert would, and builds your product foundation. Your IP stays private.

Vertocol/CardioTrackSystem active
CardioTrack 2 matches lined up · you decide after the story On track
to save~6 hrs
VertocolDoes CardioTrack diagnose, treat, or prevent a heart condition, or does it give clinicians information to support their own decisions?
it flags possible arrhythmia so the care team can review it
VertocolCardioTrack flags possible arrhythmia for the care team to review, and a clinician makes the final call.

To be precise, when a clinician gets an alert, how quickly are they expected to act on it?
they review it during the shift, it's not an emergency alarm
VertocolAlerts support routine review during a shift.

Besides clinicians, does anyone else see the readings? A patient, a family member, or a care coordinator?
Answer in your own words. Enter to send, Shift+Enter for a new line
Send
I don't know this yetI think you have enough, move onYour IP is never used for training or added to the Vertocol Library

2.0 Map

Every rule, linked to its source.

Vertocol reads your brief like a spell-checker and matches each feature to the regulation behind it. Every match shows its Trust Score, the threshold it cleared, and why it matched.

CardioTrack/Regulatory/AnalysisLibrary matches

CardioTrack is a mobile app5 that stores patient heart-rate readings1, uses a machine learning model to flag possible arrhythmia3, and alerts the care team4 when a reading crosses a threshold. Clinicians sign in with their hospital accounts2.

HighMedium · sent to expertLow · rejected
Library matches · 2 of 2 to reviewDismiss
Non-device CDS criterion 1: analysis of a physiological signal

FDA · Clinical Decision Support Software guidance (2022)

8e2f41c7-3b9d-4a06-a5e1-7c0d92f4b318

cleared threshold 0.6

71%

Phrase 3"machine learning model to flag possible arrhythmia"

[Vertocol summary] Software that analyzes a physiological signal from a signal acquisition system does not meet the first non-device CDS criterion. It is regulated as device software.

Why it matched

The brief says a model reviews heart-rate readings from a wearable sensor. That is analysis of a physiological signal, so the arrhythmia flag likely does not qualify for the non-device CDS exemption.

Phrase rule · 71%
ApproveReject
Software safety classification of the alerting function

IEC 62304:2006+A1:2015 · §4.3 Software safety classification

Phrase 4 · "alerts the care team"

cleared threshold 0.6

68%
5 phrases matched · 2 library matches to reviewReview all matches →

3.0 Review

An expert signs off on every regulation mapping.

Regulatory experts stay at the center. Your in-house regulatory SME signs off, or you can delegate a Vertocol regulatory SME. Vertocol takes the manual work off their plate so their judgment moves at the pace of AI, and each confirmed mapping strengthens the Vertocol Library.

CardioTrack/ApprovalsBoard
Needs review 2
REQ-022

Assess ML arrhythmia flag against CDS criteria

FDA CDS guidanceRS
REQ-036

Clinician override of alert threshold

ISO 14971 §7.1RS
In review 4
REQ-021

Classify arrhythmia alert logic by safety class

IEC 62304 §4.3RS
REQ-033

Audit trail for alert acknowledgement

21 CFR 820RS
REQ-041

Cybersecurity documentation for premarket review

FDA SaMDMT
Approved 36
REQ-014

Encrypt heart-rate readings at rest

45 CFR 164.312RS
REQ-031

Hospital SSO with role-based access

SOC 2 CC6.1RS
Reused from library
REQ-015

Log every PHI access event

45 CFR 164.312(b)RS

4.0 Build

Quality in. Quality out.

Vertocol gives you build-ready files for your AI coding agent, with the full context of your product, its rules, and the approvals behind them. Each time the instructions change, the files are versioned and linked to the code your AI tool generated from them.

Vertocol/CardioTrack/DownloadsSystem active

Export Package

Download your DCEF documentation package for AI build tools, developer teams, and regulatory auditors.

TIER 1Select all3 / 3 approved
CardioTrack · Product Constitution
T1-CONSTModified Sep 30, 2026v1.0

▸ History

APPROVED
CardioTrack · HIPAA & SOC 2 Compliance Report
T1-COMPModified Sep 30, 2026v1.0

▸ History

APPROVED
CardioTrack · Design & Development File
T1-DDFModified Sep 30, 2026v1.0

▸ History

APPROVED
TIER 2Select all31 / 32 approved
BRBR-01 · Remote heart monitoringSelect all1 IN REVIEW
Remote heart monitoring · Business Requirement
T2-BRModified Sep 24, 2026v1

▸ History

APPROVED
Reading sync service · Feature File
T2-FEATModified Sep 22, 2026v1.0

▸ History

APPROVED
On-device reading cache · Feature File
T2-FEATModified Sep 22, 2026v1.0

▸ History

APPROVED
Arrhythmia alert engine · Feature File
T2-FEATModified Sep 29, 2026v0.9

▸ History

IN REVIEW
TIER 3Select all4 / 4 approved · verification protocols
Build file iterations

Each version of the build files is linked to the code an AI tool generated from it.

4 versions · CardioTrack
VersionDateWhat changed in the inputsAI toolCode outputTrace
v1.3CurrentSep 30REQ-022 reworded after regulatory SME review · 1 verification step addedClaude CodePR #214 · 12 filesTraced
v1.2Sep 28Arrhythmia alert engine feature file addedCursorPR #211 · 7 filesTraced
v1.1Sep 26REQ-036 and REQ-038 added · threshold constraint updatedClaude CodePR #209 · 9 filesTraced
v1.0Sep 22Initial package · 39 documentsClaude CodePR #201 · 31 filesTraced

5.0 Trace

Evidence that follows the code.

Each requirement stays linked from your solution down to the regulation in a living traceability matrix. When a regulation changes, Vertocol traces the update back through every intent, requirement, and document it touches, so your design and development file stays current in real time.

CardioTrack/TraceabilityGraph view
SOLUTIONBUSINESS REQUIREMENTSINTENTSREGULATIONS CardioTrackSolution · v3 Remote heart monitoringBR-01 Care team alertsBR-02 Hospital sign-inBR-03 Store readings securelyINT-04 · REQ-014 Flag possible arrhythmiaINT-07 · REQ-022 Notify care teamINT-09 · REQ-027 Single sign-onINT-11 · REQ-031 HIPAA 164.312 UPDATED FDA CDS guidance IEC 62304 ISO 14971 SOC 2 CC6.1
1 / 5
Swipe or use the arrows to see all 5 steps

Vertocol Library Compounding intelligence

The Vertocol Library gets stronger each time a regulatory expert confirms a match. That judgment compounds, so teams get expert-level compliance without an enterprise budget.
01
Experts approve mappingsRegulatory SMEs sign off on requirements, risks, and controls on every project.
02
Agreement ranks higherWhen independent experts approve the same interpretation, the Trust Score rises.
03
Approved by our regulatory teamOur regulatory team approves all matches and patterns before they are added to the Vertocol Library.
04
Intelligence that benefits everyoneAs the Vertocol Library is confirmed, that intelligence benefits every team that builds with Vertocol.

6.0 Roadmap

What's coming next.

Coming soon

Proactive change alerts

Get notified when a new regulation is added or updated so you can assess impacts to your software quickly.

Coming soon

Drift checks

Catch code changes that move away from a signed requirement.

Coming soon

MCP integration

Your AI coding tools pull approved requirements, constraints, risk controls, and verification steps straight from Vertocol through the Model Context Protocol.

Coming soon

New regulation packs

EU AI Act, EU MDR, the Cyber Resilience Act, GDPR, Part 11, and more for teams selling into new markets.

Roadmap items are in development and may change.

Standards Alignment

Software has been designed in alignment with ISO/IEC 42001 and ISO/IEC 27001.

ISO/IEC 42001AI management systems
ISO/IEC 27001Information security management

We never train on your IP

Your product stays private to your workspace. Matching runs on the common language used to describe requirements.

Patents pending

Patents are pending on the Vertocol platform.

Trust Center Coming soon

Policies, controls, and documentation in one place.

Build at AI speed. Ship with compliance built in.

Join early access. Building in medtech or health IT? Ask to be one of our founding design partners.

  • Receive a free compliance profile, a gap report, and a prioritized action plan as a design partner. Valued at $10,000
  • Early access to features in development
  • Preferred pricing for design partners when Vertocol launches
  • Entry into the program is limited to qualifying partners

We'll email you about early access and the design partner program. Check the box above if you'd also like Vertocol updates. Your details and anything you tell us about your product stay private. Privacy Policy

You're on the list.

We'll email you when your spot opens.