About
I'm Frank Clay. I make medical device software defensible.
I help medical device teams build software that holds up when an FDA reviewer, a notified body or an auditor starts pulling on it. I'd rather help you prevent a finding than write the response to one.
The problems I get called in for
A submission is coming and the software file doesn't hang together
Requirements, risk, verification and traceability were written by different people at different times. I find the gaps a reviewer will find, and close them in the order that matters.
An audit or inspection turned up software findings
Nonconformities against IEC 62304, design controls or the QMSR. I help you fix the root cause in the process, not just answer the finding.
Cybersecurity has to meet FDA's premarket expectations
SBOM governance, threat modeling (TARA, STRIDE), an assessed security risk package, and security controls traced into requirements, verification and the risk file, so security and safety tell the same story.
Legacy software or SOUP nobody wants to touch
Right-sizing the evidence for software you didn't write, or that predates your current procedures, without rebuilding everything from scratch.
CAPAs that keep coming back
Structured investigations and root cause analysis that hold up to an auditor, with effectiveness checks that prove the fix worked.
Your quality system software needs validating
Risk-based GAMP 5 validation for eQMS, PLM and other non-product software, sized to what the system actually controls.
Why the standards work matters
I served on the development teams for IEC 62304:2006/AMD1:2015 and ANSI/AAMI SW91:2018, and I've been a subject-matter reviewer for IEC 82304-1:2016 and AAMI TIR80002-3:2016. Being in the room where the wording gets argued over changes how you read a clause. I know what a requirement is trying to prevent, which makes it easier to right-size the work instead of over-documenting out of fear.
I've done this work inside global medical technology, pharmaceutical and nutraceutical companies, contract manufacturers and neuromodulation companies, and as an independent consultant. For an AI-enabled medical device startup, that included building the SBOM and threat model and drafting the cybersecurity response to an FDA request for additional information on a new device submission. Along the way I've led CAPA programs, served as a site lead for human factors engineering under IEC 62366-1 and HE-75, validated quality system software under GAMP 5, written Health Hazard Evaluations, and audited quality systems against ISO 13485, ISO 9001 and AS9100D as a lead auditor.
How I think about software quality
01
Right-size it
The standards ask for evidence proportional to risk. A Class A utility and a Class C therapy controller shouldn't carry the same paperwork.
02
Write for the reviewer
If someone outside the team can't follow the trace from hazard to test, it doesn't count yet.
03
Fix the process, not the document
A finding that comes back next year was never closed. I look for the step that let it happen.
How I work
- Remote-first. I work with US teams from Chester, Virginia and come on-site when it helps, mostly for audits, inspections and kickoffs. On-site time and travel expenses are billed separately, as set out in the engagement agreement.
- Inside your systems. I work in your eQMS, document control and issue tracker rather than handing over a binder.
- Plain answers. If something's a real gap I'll say so, and if it isn't I'll say that too.
Credentials
Standards
IEC 62304:2006/AMD1:2015 · Development teamANSI/AAMI SW91:2018 · Development teamIEC 82304-1:2016 · SME reviewerAAMI TIR80002-3:2016 · SME reviewer
Certifications
ASQ Certified Software Quality Engineer (CSQE)Lead Auditor: ISO 13485, ISO 9001, AS9100DLean Six Sigma Black BeltCertified ScrumMaster
Service
Past Vice Chair, Technology, ASQ Software DivisionPast Chair, IEEE Computer Society Chicago ChapterANSI Associate · IEC subject-matter expertMember: ASQ, IEEE, INCOSE
Have a problem like these?
Tell me what's in front of you. A 30-minute call is usually enough to know whether I can help.