Compliance is a graph. Documents were the wrong place to keep it.

The problem with documents

Medical device compliance is semantic. It is far less programmatic than, say, information security: it runs on semantic regulation, human judgement and conditional expectations. So it has always lived in documents.

But documents are opaque containers. They cannot tell you whether a company is compliant. They let in contradictions, inconsistencies and duplicates. And the system that holds them has no idea which paragraphs relate across documents: where an obligation is addressed, where a fact is reused, what a decision rests on, where guidance was applied.

That information, and the relationships within it, is what compliance is. Documents leave the hard part, keeping it consistent, compliant and coherent, to human effort and memory. AI on top of documents makes a good assistant with the same weakness: the documents underneath still drift (see Model the domain first).

What a graph changes

In a graph, every piece of information we care about is a first-class object: obligations, paragraphs, decisions, product facts, evidence. Every relationship between them is explicit too.

That turns big, vague questions into small, defined ones. "Is the technical file consistent?" becomes a question about types of information: are all paragraphs that address the same obligation consistent with each other?

Small questions are where AI is most reliable. Each one runs on a tightly bounded context: the paragraphs, the obligation and its guidance, and nothing else. When something changes, only the questions that depend on it are asked again.

Let the agents wire the graph

But wiring a graph is hard work. Nothing gets written without its links. A paragraph in a controlled document links to the obligation it implements, through the approved plan for meeting it. Its cross-references, roles, abbreviations, external documents and product data are explicit links, not words in the text. Plans record the decisions and interpretations they rest on. Decisions record their rationale and the alternatives considered, each with its risk. Even a traceability matrix needs its shape defined first: which information belongs at each stage, how stages and items relate, which rules apply.

By hand, this was unmanageable. Now agents wire the graph as the work is done, and people answer simple questions instead: do you agree this paragraph addresses provision Y of framework X? Each answer encodes expert knowledge in the system.

The main value of AI in compliance is not executing human workflows. It is wiring the graph that turns compliance into a state.

Fix the type, not the document

Every small, defined question is a rule on a type of information, not on a document. Paragraphs are assessed against the guidance for their obligation, with binding text weighed above advisory best practice. Design inputs are checked against the rules for their type and against the design outputs they link to. Some checks stop a change from being saved. Others raise a finding for a person to resolve.

That changes what a fix is. In a document, an error is fixed where it is found, and the same error waits in the next one. When we find a new error mode, we fix it for the type: every instance, across the whole workspace.

How we declare those types and keep their state is the subject of Model the domain first.