Last month, Cognition sponsored and attended the International MedTech Safety Conference 2026 (IMSC26) at Northeastern University in Boston. Organized by Bijan Elahi, the conference brought together regulators, researchers, and practitioners focused on medical technology safety.
This year’s program covered risk management principles, AI-enabled devices, cybersecurity, human factors, and post-market safety governance, with our own David Cronin and Patrick Maxwell joining the speaker roster. Across the sessions we attended, one theme emerged: a critical gap separates the evidence manufacturers generate from the reasoning they document. Closing that gap is increasingly the test of regulatory maturity.
One sentence from Michael Walsh‘s presentation at IMSC26 stood out: “When decisions rely on judgment, quality of reasoning matters more than quantity of data”.1
It lands differently when you consider how much of the industry’s risk management effort goes in the opposite direction.
Walk through a typical risk management file, and you will find data, including severity ratings, probability estimates, risk levels, control measures, and residual risk conclusions. What you will often not find is the reasoning that connects them. Manufacturers state the claim that benefits outweigh risks, but leave the supporting argument implied, buried, or missing entirely.
Regulators have noticed.
The Problem Is Structural, Not Attitudinal
The gap between the evidence manufacturers generate and the reasoning they document is structural. Most teams working on risk files are rigorous, experienced, and committed to patient safety. When risk data resides in one document, design requirements in another, verification records in a third, and the post-market surveillance team operates from a separate system, the connections between these artifacts become manual, implicit, and, over time, brittle.
Walsh drew on safety case methodology to identify the gap: the explicit argument linking evidence to claims. Borrowing from Tim Kelly and Rob Weaver’s Goal Structuring Notation, he framed it as: “Argument without evidence is unfounded. Evidence without argument is unexplained.”2 The industry, on the whole, has plenty of both. What it lacks is a systematic mechanism to make the argument visible, traceable, and auditable.
This structural problem extends beyond standalone devices into the highly complex world of combination products. As Susan Neadle highlighted, critical blind spots often arise at the interfaces between the drug, device, and user because development teams frequently work in silos. Without direct links between the data created in these silos, the risk of missing critical interactions increases significantly, often leading to costly regulatory rework.3
Traceability Across the Full Lifecycle
The structural problem is most visible during submissions, but it does not begin or end there. Yu Zhao built his presentation around a detailed lifecycle case study of a hypothetical implantable cardiac device, positioning risk management as the “connective tissue” running from Investigational Device Exemption (IDE) application through Premarket Approval (PMA), post-approval study commitments, post-market surveillance, field actions, labelling updates, and eventually commercial discontinuation. Every regulatory juncture raises a risk question. In Zhao’s framing:
“Regulators don’t approve devices. They approve risk decisions — decisions that are only as strong as the analysis behind them. Your risk file is your argument. Make it one.” 4
The post-market dimension is where the traceability gap becomes most costly. Acting on a field signal only produces a defensible regulatory decision when you can document, connect, and audit every step from complaint to trend analysis to root cause to updated risk evaluation to action. Kerry Flecknoe’s presentation on Health Hazard Evaluations (HHE) reinforced this from the post-market side. An HHE that follows ISO 14971 principles, including explicit hazard identification, probability and severity estimation, risk evaluation against defined thresholds, and documented action rationale, becomes what Flecknoe called “the documented bridge between post-market data and regulatory action decisions.” A well-supported no-action decision can be as defensible as a recall recommendation, but only when the decision rests on documented, traceable reasoning. Under the FDA’s Quality Management System Regulation, Flecknoe noted, it is the quality of decisions rather than the existence of procedures that will define compliance.5
Integrated traceability, as Neadle put it, improves signal interpretation, investigation efficiency, and regulatory response readiness simultaneously. All three are expressions of the same underlying benefit.6
What Traceability Actually Requires
The practical requirement is a bidirectional connection between risk data and the broader development data. That connection must stay current as both evolve. A risk item does not exist in isolation. It points to the sequence that led to it, the requirement that controls it, the test that verified the control, and the residual risk conclusion it supports. When any one of those elements change, whether a design iteration, a new post-market signal, or a revised probability estimate, every downstream item needs to reflect that change accurately and immediately.
This is where most teams encounter the real cost of managing risk across disconnected tools. Manually maintaining bidirectional traceability among a Word-based risk file, a separate requirements document, a test management spreadsheet, and a complaint-handling system is slow and creates the gaps regulators flag. The copy-and-paste error that orphaned a risk control from its verification evidence. The design change that updated the requirement but not the FMEA row. The post-market trend that triggered a probability update no one propagated to the benefit-risk summary. These are predictable outputs of a fragmented data architecture.
The Operational Case for Unified Design Control
Cognition built Compass MED to address this structural problem. Unifying requirements, risk, and test management in a single platform makes traceability automatic. The platform establishes links between risk items and requirements as teams enter data, rather than reconstructing them at submission. When a design change occurs, the “change once, update everywhere” data model propagates that change across all connected project elements, eliminating silent inconsistencies that otherwise become audit findings. Real-time filters surface gaps, including unlinked risk items, requirements without verification records, and controls without evidence, before they reach a reviewer.
Walsh’s closing observation from IMSC26 was that the decision in a benefit-risk determination is the same whether the underlying data is ideal or incomplete. What differs is the quality of the justification.7 Regulators understand this. The question for manufacturers is whether their systems make high-quality justification easy to produce, or whether they make it structurally difficult. A risk file that relies on fragmented tools forces teams to spend submission time reconstructing reasoning that should have accumulated throughout development.
Traceability is the infrastructure of regulatory trust. Build it into your process from the start, or spend your time (re)building it ready for submission.
Cognition’s Compass MED is a purpose-built design control platform that integrates risk, requirements, and test management for medical device manufacturers. To see how it supports traceable, audit-ready risk management, request a demo.
References
1. Walsh, M. Integrating Critical Thinking and Safety Case Principles in Medical Device Risk Management. IMSC26, Northeastern University, Boston, 2–5 June 2026.
2. Walsh, M. (ibid.), citing Kelly, T. and Weaver, R. The Goal Structuring Notation: A Safety Argument Notation.
3. Neadle, S. Streamlined Risk Management for Drug Device Combination Products. IMSC26, Northeastern University, Boston, 2–5 June 2026.
4. Zhao, Y. Risk Management as the North Star for Regulatory Decisions. IMSC26, Northeastern University, Boston, 2–5 June 2026.
5. Flecknoe, K. From Signal to Decision: Using Risk-Based Health Hazard Evaluations to Strengthen Post-Market Medical Device Safety. IMSC26, Northeastern University, Boston, 2–5 June 2026.
6. Neadle, S. (ibid.)
7. Walsh, M. (ibid.)
