An ISO 14971 risk model, from an email and two diagrams in about two minutes.
No template library, no consulting sprint, no schema written by hand. An agent connected to the Koddex MCP read the brief, drew the conclusions from the diagrams, and created the models, the relationships and the computed severity roll-up directly in the workspace.
Full ISO 14971 traceability, built while you watch: one prompt, 13 models, 17 declared links. Placeholder workspace name.
The brief arrived as an email, not a specification
A regulatory consultant in medical devices wanted to know whether Koddex could hold the risk structure he rebuilds, spreadsheet by spreadsheet, on every programme. He sent an email and two diagrams drawn by hand. That was the entire input — handed to Claude with one instruction: set this up in the workspace.
- Sector
- Medical devices
- Role
- External regulatory consultant
- Standards
- ISO 14971 · MDR · IEC 62304
- Input
- One email, two diagrams
Consultant, manufacturer and device unnamed at their request. The workspace in the film uses a placeholder name.
ISO 14971 is a graph. It is almost always stored as a grid
Hazard, harm, severity, control, requirement — all connected, and kept connected while the design changes. A spreadsheet holds the rows. It cannot hold the links.
Severity is copied, not derived
Change one harm and every severity that depended on it is silently wrong.
Controls lose their requirement
Residual risk can only be scored if you can see how a control was implemented. In a grid, that link lives in someone's head.
It only reads one way
An auditor asks how much testing a software item needs. A reviewer asks which items one control touches. A flat file answers neither.
Thirteen models, seventeen links, one computable graph
Severity and probability are entered by a person. The risk index is not — it is computed, and there is no cell to overwrite.
Created in one pass
Hazard → Risk → Control → V&V
The workspace's own Where-used view. Walkable from either end.
Five risks, one computed column
Access tags decide who sees which row.
| Name | Hazard | Severity | Probability | Risk index | Access tag |
|---|---|---|---|---|---|
| Incorrect dose displayed | Software fault | 5 | 3 | 15 | clinical |
| Unintended actuation at setup | Stored energy | 4 | 3 | 12 | quality-core |
| Air embolism from line purge | Air in line | 5 | 2 | 10 | clinical |
| Overheating of drive unit | Excess heat | 3 | 3 | 9 | quality-core |
| Sharp edge on housing | Mechanical | 2 | 2 | 4 | quality-core |
ƒ Risk index = severity × probability — computed by Koddex, not typed by anyone.
One risk, opened. Every field typed, linked or computed.
Incorrect dose displayed
RSK-014- Hazard
- Software fault
- Hazardous situation
- Dose calculation error shown to clinician
- Harm
- Overdose
- Severity
- 5
- Probability
- 3
- Risk index
- 15severity × probability
- Risk control measure
- Independent dose check
- Access tag
- clinical
What it computes, and what it refuses to
Change either input and it moves on its own.
Drop a harm from 3 to 1 and the requirement and the software item both read 1. That number justifies test effort to an auditor.
It depends on the control type declared above it, and computed attributes only aggregate upwards. A feature, not a gap.
The same structure, the usual way: five tools and a standing sync tax
Nobody builds an ISO 14971 file in one place. Each tool is fine alone — the cost is the seams between them, paid again on every design change.
Every double arrow is a synchronisation somebody maintains by hand.
| Five tools, stitched | Koddex, on film | |
|---|---|---|
| Building the 13 object types | Days of workshops, then schema work in each tool | One prompt, two minutes |
| Declaring the 17 links | IDs copied from one tool into another | Declared with the models |
| Keeping the risk index right | A formula column — until someone pastes over it | Computed. No cell to overwrite |
| Staying aligned after a change | Re-export, re-import, reconcile. Every tool, every time | One graph. Nothing to synchronise |
| Standing it up | Days to weeks, then a sync cost forever | Two minutes, then minutes per iteration |
The Koddex column is measured, on film. The left column is an order-of-magnitude estimate for a conventional tool chain — not measured here.
Why the second day matters more than the first
Two minutes is the headline. The durable value is what it costs to be wrong — and the model always has to change.
Being wrong stops being expensive
Split a model, add the field you forgot: ask, review the diff, keep it. Restructuring is not a project.
The sync tax goes to zero
No export to reconcile, because there is no second copy.
Expert time moves up
The consultant stops rebuilding scaffolding and spends the hours deciding whether a residual risk is acceptable.
The agent writes fast. It never writes unwatched
The agent proposes structure at machine speed. A person keeps the risk judgement, and every write is attributed, scoped and revisable.
Agent ↔ human
The agent proposes. The expert disposes.
- Every item it creates is stamped “Created by Claude through the Koddex MCP”, timestamped. Never anonymous.
- When a calculation was impossible it said so, and its workaround was rejected out loud. Saying no to the agent is part of the method.
- Severity, probability, acceptability and residual score stay human decisions, by design.
Human ↔ human
The controls that make an agent safe make a team auditable.
- Access tags scope every row: clinical and quality-core are not visible to the same people.
- A frozen baseline stays frozen. A change becomes a revision you can compare, not an overwrite nobody notices.
- Where-used answers “what breaks if I change this” before anyone changes it.
Provenance on the item itself.
Who can read this risk.
Attributed, timestamped changes.
Frozen baselines, compared.
Every reference, before you touch it.
What changed
| Spreadsheet risk file | Koddex model | |
|---|---|---|
| Standing up the structure | Rebuilt by hand on each programme | Two minutes from the brief, then refined |
| Severity of a software item | Traced by hand through the hazard analysis | Computed, always current |
| Changing one harm | Silent inconsistency across tabs | Propagates to every dependent score |
| Impact of one risk control | Manual search across files | Reverse link lists the items it touches |
| Severity scale | Free text, per author | Controlled list, set at model level |
| Producing the risk file | Copy-paste into a Word template | Export an item with its children, attachments included |
“I'm thinking I might just do diagrams and let the agent do the modelling. That is much easier to do.”
What this does not do
A case study that only lists wins is no use to a quality manager.
Computed attributes only aggregate upwards. A field reads its children, never its parents — so residual probability stays a human decision. You can see the parent value; you cannot compute from it.
You get a first draft, not a release. The model still needed adjustment by someone who knows the device, and these diagrams were unusually clear. Quality of the brief decides quality of the output.
Export is structural, not editorial. An item and its children export as PDF with attachments. Pouring that into a client's Word template, section by section, is not a feature today.
Frequently asked questions
Does letting an agent build the model compromise ISO 14971 compliance?
No — the agent builds the structure, not the risk judgements. Severities, probabilities and acceptability are still entered and approved by qualified people, with the usual review trail.
How is a software item's severity determined?
It is computed, never typed: severity is entered once on the harm, and each level above takes the maximum of everything below it.
Can residual risk be calculated automatically?
Not by design: it depends on the control type declared above it, and computed attributes only aggregate upwards — so a reviewer sets it deliberately.
Which agent do I need to reproduce this?
Any MCP-capable client — this session used Claude. Your team connects its own client and tokens, so the agent works with your access rights.