Device software with a change record your auditors can follow.

For firmware and software teams under IEC 62304. Agents never read patient data, and controlled items wait for a named approver.

Standards: IEC 62304 · ISO 14971
Firmware tools: Arm GCC, Arm Compiler 6, IAR, J-Link, ST-LINK
Agent policy: Medical sector template
Models: Approved by your organisation, or self-hosted
Deployment: Self-hosted, your cloud or air-gapped

What your team gets

Your quality system, with AI inside its rules.

Govern features are in use today. Domain modules are pre-release; their state is listed under Tools and formats.

Patient data kept from agentsThe medical template denies agent reads of DICOM files, patient exports and protected health information, and lists network destinations explicitly.

Controlled itemsAgent changes to requirements and risk management files, and pushes to main and release branches, wait for a named approver.

SOUP reviewA new third-party package needs an approver before an agent installs it.

Electronic signature recordsApprovals are signed records with the signer's name, time, meaning and reason, made after re-authentication and verified in CI.

Design history evidenceSigned evidence packs and audit exports, verifiable offline, for your design history file.

Firmware in the EditorBuild, unit-test, flash and debug device firmware with your compilers and probes.

Who uses it

For the engineers who change the device and the people who release it.

Firmware engineersBuild, flash and debug device software, with agents working under the medical template.

Verification engineersRun host unit tests, and firmware in an emulator in CI, with results per test.

Quality and regulatoryApprove controlled items and export evidence for the design history file.

Risk managementReview every agent change to risk management files as a named approver.

Tools and formats

What the Embedded module handles, and how far it is verified.

The module drives the compilers and probes your team already uses. It turns on by itself in a trusted workspace with a firmware project.

Firmware projectsKeil, IAR and STM32CubeIDE projects imported into CMake; builds of a CMake preset with a Flash and RAM report; host unit tests. Built and tested on recorded tool output; not yet run against IAR or Keil.Arm GCC · Arm Compiler 6 · IAR · CMake · Ninja · CTest · Unity · .uvprojx · .ewp · .cproject

Flash and debugFlashing after a confirmation; debugging with peripheral registers from the SVD, RTOS awareness, fault decoding and a serial monitor. Running an image in QEMU is verified against QEMU 9.1.1; nothing has been run on a board.OpenOCD · SEGGER J-Link · ST-LINK (STM32CubeProgrammer) · GDB · QEMU · SVD · FreeRTOS · Zephyr · ThreadX

Static analysisCppcheck findings, including MISRA C:2012, in the Problems view. Built and tested on recorded tool output.Cppcheck · MISRA C:2012

Embedded LinuxIn early development behind a setting, not ready for use: Yocto Project and Wind River Linux builds on your Linux build server over SSH. Modelled on Linux only; not yet run on Windows, a real build server, Wind River Linux or a board.Yocto Project · Wind River Linux · BitBake · kas

Domain modules are pre-release. Nothing is verified by a customer yet, and nothing is verified on Windows. Do not rely on a capability for production work until it is verified for your tools, versions and operating system. Product names belong to their owners.

How a change moves

A person decides before anything leaves the desk.

Propose
An engineer or agent drafts a change to device software.
Verify
Your qualified tools build, check and test it.
Approve
A push to main or a release branch waits for a named approver.
Record
Change, results and approval kept together in the audit record.

Standards

Evidence for your quality system. The clearance is yours.

IEC 62304Evidence toward IEC 62304: changes to requirements and released software with their approver, and SOUP additions reviewed before install.

ISO 14971Evidence toward ISO 14971: every agent change to risk management files reviewed by a named approver.

Electronic recordsSignature records support your own controls for electronic records and signatures. Identity verification at enrolment stays your process.

Neural Inverse provides evidence toward these standards. Certification stays with your organisation and assessor.

Rules you work under

What they ask, and what Neural Inverse gives you toward them.

We produce records your assessors and regulators can use. We never say a product makes you compliant; that stays with your organisation.

Standards

[Draft: to be approved by legal counsel before publication]

FDA section 524B: cyber devicesWhat it asksA premarket submission for a device with software that can connect to the internet includes a plan to monitor and address vulnerabilities, processes that give reasonable assurance the device is cyber secure, and a software bill of materials. In force since 29 March 2023.What Neural Inverse gives youA new third-party package needs an approver before an agent installs it, agent reads of patient data are denied, and every change is kept in a tamper-evident audit log.

FDA Quality Management System RegulationWhat it asks21 CFR Part 820 now incorporates ISO 13485:2016, including design controls and the records that show them. Effective, and used in FDA inspections, since 2 February 2026.What Neural Inverse gives youApprovals are signed records with the signer's name, time, meaning and reason, made after re-authentication. Signed evidence packs and audit exports, verifiable offline, for your design history file.

EU MDR and MDCG 2019-16What it asksDevice software is developed to the state of the art, with lifecycle, risk management including information security, and verification and validation (Annex I, section 17). MDCG 2019-16 is the guidance on cyber security.What Neural Inverse gives youAgent changes to requirements and risk management files, and pushes to main and release branches, wait for a named approver; every change is recorded for your technical documentation.

EU AI ActWhat it asksAI in medical devices that need a notified body is high-risk: risk management, record-keeping and human oversight. These rules apply from 2 August 2028, after Regulation (EU) 2026/1744.What Neural Inverse gives youGovern's EU AI Act rule pack, with records of decisions and approvals for the AI systems you govern.

Questions

What medical devices teams ask us first.

All questions

Does it work with our firmware tools?

Yes. The Embedded module drives the compilers and probes your team already uses. It is pre-release: built and tested on recorded tool output, not yet run against IAR or Keil, and running an image in QEMU is verified; nothing has been run on a board.

Can it run on-premises or air-gapped?

Yes. Govern runs on your own servers, in your own cloud account or on a network with no internet access, with models served inside your network.

Can AI agents read patient data?

The medical template denies agent reads of DICOM files, patient exports and protected health information, and lists network destinations explicitly.

Is Neural Inverse certified or validated to IEC 62304?

No. Govern gives evidence toward IEC 62304 and ISO 14971 for your quality system. Tool validation, certification and clearance stay with you, your notified body and your regulator.

Do approvals work as electronic signatures?

Signature records support your own controls for electronic records and signatures. Each has the signer's name, time, meaning and reason, made after re-authentication; identity verification at enrolment stays your process.

Products used

Neural Inverse Build →

Editor, Agents and CLI with the domain tools your engineers need.

Neural Inverse Govern →

Policy, approvals and audit for every AI tool your teams use.

Product names belong to their owners.

Talk to our team.

Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.

Request access Contact us