Compliance automation for medtech innovators

Alongside Design Control, Design Review, and the rest of the platform, we kept building out Ultralight as the product grew, filling in the operational layer that sits around compliance: the dashboard teams open every morning, the product structure everything else hangs off of, and the risk, locking, and training systems that round out a full FDA-ready platform.

The home screen had to answer one question fast: what needs attention today. Compliance work is distributed across dozens of people and modules, so we designed a dashboard that pulls pending reviews, approvals, and open quality events into one view, broken down by team. A manager can open Ultralight in the morning and know exactly where things are stuck, instead of clicking into every module to check.

Every medical device is really a tree of components, and each one carries its own documentation, requirements, and approval history. We designed the Products index as the entry point into that structure: a searchable list where teams can drill into any component to see its deliverables, what's complete, and what's still outstanding. It's the map that makes the rest of the compliance work navigable, especially as a product's component tree grows over its lifecycle.

Risk management runs on its own logic in medtech, and it touches almost everything else in the product. We built a dedicated Risk module with a configurable risk matrix (RAM) so teams can score and categorize risks consistently, plus a traceability view that links each risk back to the design decisions and requirements it came from. The goal was to get risk out of spreadsheets and into the same system as the rest of the compliance record, so nothing falls out of sync when a design changes.

Once a product ships, its compliance record has to freeze no more edits, only a record of what happened. We designed a locked state that makes this unmistakable in the UI: the module becomes read-only, clearly marked, with every change from that point forward captured in the audit trail instead of the working document. It protects teams from the kind of accidental edit that could compromise an approval.

Compliance isn't just documentation; staff have to be trained on it, and that training has to be provable. We built a training module where procedures come with assessments and quizzes attached, so completing the training and passing it become part of the same record. When the FDA asks who was trained on what and when, the answer is already sitting in Ultralight rather than scattered across LMS exports and email threads.