Regulatory awareness
What a real diagnostic viewer like Tomos would have to satisfy, and which of those ideas the demo already applies in its design.
This page shows awareness, not compliance. Tomos is a portfolio demo. It has no CE marking, no quality management system, no clinical evaluation and no notified body review. It must not be used for diagnosis.
A diagnostic viewer is a medical device
Software that provides information used to take diagnostic decisions falls under Annex VIII Rule 11: at least class IIa, higher if a wrong decision could cause serious deterioration or death. A viewer with measurements and AI suggestions for radiology reading would sit at IIa or above.
In the demo: Permanent banner, intended use stated as “portfolio demonstration only”.
Safety class drives the process
Software items are classed A, B or C by the harm they could contribute to. Higher classes require detailed design, unit verification, SOUP (third-party software) management, and traceability from requirement to test.
In the demo: SPEC → tickets → tests traceability, an ADR per dependency (SOUP list), unit tests on HU, W/L, measurement and MPR maths.
Hazards → controls → residual risk
Identify hazardous situations, estimate risk, apply controls (inherent safety by design first, then protective measures, then information), verify the controls, and accept residual risk.
In the demo: Every safety pattern in the UI maps to a hazard in the table below.
Use errors are design defects
Usability engineering targets use errors that could cause harm: wrong patient, wrong side, misread units. It ends with summative evaluation by representative users.
In the demo: Identity on every viewport, laterality markers, units on every number, no colour-only meaning.
Conformance & de-identification
A real product publishes a DICOM Conformance Statement listing supported SOP classes and transfer syntaxes. Shared datasets follow the PS3.15 Basic Application Level Confidentiality Profile.
In the demo: The in-house parser reads CT Image Storage, uncompressed little-endian (explicit and implicit VR) and refuses the rest by name. Synthetic studies carry PatientIdentityRemoved = YES.
Health data needs certified hosting
In France, hosting personal health data on behalf of others requires an HDS-certified host (Code de la santé publique, L.1111-8). Health data is also a special category under GDPR article 9.
In the demo: No real personal data at all, so HDS does not apply. Zero external API calls at runtime.
AI inside a medical device
AI that is part of a regulated medical device is classed high-risk under the AI Act, adding human-oversight, logging and transparency duties on top of the MDR. The manufacturer also runs an ISO 13485 quality management system.
In the demo: The AI only suggests, its model version is shown, every AI decision is logged with a human actor, and the AI cannot sign.
Hazard examples (ISO 14971 style)
| ID | HAZARDOUS SITUATION | CONTROL IN TOMOS | VERIFIED BY |
|---|---|---|---|
| H-01 | Images of another patient read as this patient's prior | Match on Patient ID + issuer before any prior pixel is fetched; non-overridable block; identity on every viewport | API test + E2E: mismatched prior is blocked |
| H-02 | Incomplete series read as complete | Completeness on every viewport; unloaded slices drawn as hatched no-data; MPR and measurements disabled on partial data | Unit tests on volume assembly + E2E with a partial series |
| H-03 | Wrong size reported (spacing missing or misapplied) | Measurements in px with UNCALIBRATED when PixelSpacing is absent; never a guessed mm | Unit tests on measurement maths |
| H-04 | AI output enters the report without review (automation bias) | Suggestions pending by default; explicit accept; sign blocked while any is pending; AI has no signing identity | API test: sign refused with pending AI |
| H-05 | Signed report silently changed | Immutable signed version with SHA-256 content hash, enforced by a database trigger; corrections only through signed addenda | DB test: UPDATE on a signed report fails |
| H-06 | Left/right confusion | Orientation markers from the DICOM orientation on every viewport, reformats included | Unit tests on orientation labels and MPR geometry |
| H-07 | Stale image shown after connection loss | API heartbeat; connection-lost state on every viewport; decisions refused, never queued silently | E2E with the API stopped |
Data provenance
All patients are invented. Images are generated by Tomos's own synthetic CT generator (realistic anatomy, HU values, spacing and orientation), or public de-identified studies whose licence allows redistribution, downloaded once and self-hosted with their demographics overwritten. Every asset and its licence is listed in docs/DATA_SOURCES.md.