What shipped and when.

Summary: A documentation-only release — no platform behavior changed, only what the site claims about it. A review of the published pages found several claims that overstated the platform’s validation and compliance position, and this release corrects them.

What changed: The Vendor Validation Package’s OQ section, previously described in nine places as 16 executed test cases with pass/fail evidence, is now described as a sixteen-case protocol the customer’s own quality function executes and signs (matching the package itself, corrected September 21); 21 CFR §11.100(c) is now described as a customer certification the platform supports rather than one AILS supplies; GAMP 5 Category 4 is now described as a classification, not a validation status; SOC 2 Type II was removed from the compliance framework grid (eighteen frameworks to seventeen, as no SOC 2 audit has been performed); EU AI Act Article 27 references were corrected to the assessment it actually governs; FDA QSR is now named as QMSR, which superseded it in February 2026; and the founder story page was retired.

Impact: The Vendor Validation Package itself was already correct; only the site’s description of it changed.

How verified: Corrected against the current codebase and published; SYSRUN-20260923-EWCS confirmed 1221/1221 tests passing.

Platform stats: 1,221 tests / 102 suites / 111 AI agents / 42 PDF generators / 17 compliance frameworks / 32 modules / 240,000+ lines of production code. SYSRUN-20260923-EWCS: 1221/1221 · 100/100.

Summary: ISO 9001:2026 was published in September 2026, replacing the 2015 edition after eleven years; certificates against :2015 remain valid through a three-year transition and the ten-clause structure is unchanged. Each tenant now records its own edition — 2015, transitioning or 2026 — and gained structured records for the standard’s foundational clauses, including the 2024 climate-change amendment tracked as three distinct states.

What changed: Added quality-culture and ethical-behaviour tracking (a versioned statement with per-person acknowledgments), a 25-check clause-by-clause readiness assessment returning two separate scores (overall readiness and readiness on just the clauses that changed in :2026), and a thirty-row exportable evidence matrix spanning clauses 4 to 10 with ten rows flagged as :2026 changes.

Impact: Certification bodies and their clients can now document ISO 9001:2026 transition readiness inside the platform rather than in an external spreadsheet; no existing record was altered.

How verified: Full regression suite confirmed all tests passing.

Summary: A review pass across training, equipment, inventory, suppliers, procedures and issuance verified every finding against the code; one reported finding was checked and refuted. A new static check compares every record the backend creates against its schema.

What changed: The Vendor Validation Package’s OQ section, which rendered sixteen results as PASS with no execution, is executable, matching the PQ section. Report issuance now requires role, re-authentication and training-currency checks and derives its chain from calibration records; editing an approved procedure versions it, returns it to review, and clears signoffs. Supplier-approval status is now checked at all six linked points (equipment, inventory, procedures, CAPAs, deviations); inventory gained expiry handling. The audit-trail hash chain’s sequence is now assigned atomically, not by insertion order, closing a false-tamper risk under concurrent writes. The new schema check found and corrected silent field-drop bugs across ELN author attribution, agent-notice writers, workflow-engine CAPA creation, and CSV address import/export.

Impact: No stored ELN or CSV-import record was altered beyond the corrections named; a backfill recovers ELN authorship from the audit trail.

How verified: Full regression suite confirmed all tests passing.

Summary: A five-phase release carrying one job from enquiry to issued certificate, with every step recorded rather than assumed. These are new capabilities, not corrections; no existing record was altered.

What changed: Chain-of-custody transfers are signed by both parties with signature meaning recorded, release and receipt conditions stored separately, and a broken seal recorded, not refused. Quotes and contracts follow ISO/IEC 17025 cl. 7.1 as one record under three names — quote, tender, contract — reviewed as refusals: no decision rule means no conformity statement, one person cannot both review and accept, and amending an accepted contract creates a new unsigned version, leaving the original valid. Sample receipt implements cl. 7.4.3: a failing acceptance check raises a recorded deviation, an open deviation refuses acceptance, and the disclaimer is captured at consultation and carried onto the certificate under its integrity hash. A job workspace computes the single blocking step from the request, contract, custody and certificate, without storing state. Client-side, a contract deviation notifies the customer in one action, and portal complaints carry their investigation record and independence screen.

Impact: Role-based response filtering and tenant-specific standard vocabulary are enforced server-side across every route.

How verified: Full regression suite confirmed all tests passing.

Summary: Two accreditation schemes now run end to end. ISO/IEC 17021-1 management-system certification covers the full lifecycle — Stage 1, Stage 2, surveillance, recertification, nonconformity closure, certification decision and a hash-locked certificate — with an IAF MD 5 audit-duration calculator each certification body populates from its own controlled copy. ISO/IEC 17020:2026 inspection bodies gained inspector-authorization, a twelve-month field-monitoring cycle, and instrument-calibration competence controls.

What changed: Laboratory, product-certification and accreditation complaints — formerly three separate processes — now share one record, one investigation workflow and one audit trail. Decision independence is now enforced at the point of decision across accreditation certificates, management-system certification decisions, appeals and CAPA closure, citing the governing clause (ISO/IEC 17025 §7.9, ISO/IEC 17065 §7.13, ISO/IEC 17011 cl. 9.7, or ISO/IEC 17021-1 cl. 9.8). Also added: a cryptographic-exposure dimension on supplier scorecards, cross-division rollups for inspection groups, a watermarked-derivative document translation workflow, a discovery-questionnaire lead pipeline, wholesale and referral pricing, and an EU data-region provisioning guard.

Impact: A complaint under any of the three schemes is investigated and decided the same way, with the person who investigates barred from deciding it.

How verified: Full regression suite confirmed all tests passing.

Four new horizontal platform capabilities, each with a full admin UI. Channel/Routing Layer lets a certification body or CRO route work to accredited fulfillment labs under scoped, auditable grants that can never exceed the receiving lab’s own enabled modules — with an AI agent that independently re-checks every order and another that watches for turnaround drift or flag concentration across a partner’s order history. Decision Engine is a configurable rules and lookup-table builder for calculations that used to need a code change — versioned, sandboxed (no arbitrary code execution, ever), with chained conditional rules and an AI agent that probes new versions for overlapping thresholds before they publish. Connections Hub is a self-serve integrations manager: pick a connector, enter credentials, test, save — encrypted at rest, with an AI agent watching for credential expiry and sync lag. Report Template Engine gives every tenant a drag-free section-based report builder with field mappings from records, custom fields, or Decision Engine outputs, checked against linked-standard requirements by an AI compliance agent before anything ships. Also this cycle: the sales-demo environment (Demo Seeds and the nine-tenant Calderwood reference group) was split out of the Compliance Audit into its own on-demand run, so fictional demo data can never again affect a real compliance score.

Cross-tenant isolation testing more than doubled, from 10 assertions to 22. Every record type a lab actually stores is now proven invisible across a tenant boundary in both directions — certificates of analysis, equipment, SOPs, test reports and CAPAs — by list, by direct ID lookup, by update and by delete. An additional assertion fails the build if a by-ID read path is ever introduced into the audit trail. New separation-of-duties suite: each of six coded conflict pairs — entering results and issuing the certificate, creating a CAPA and closing it, authoring an SOP and approving it, performing a calibration and approving it, raising an invoice and approving it, and second-review bypass — must be refused, and must not partially apply. A positive control proves the rules do not over-block legitimate permission grants, and a catalogue check fails if a conflict pair is ever added without test coverage or quietly removed. Deployment-model benchmarking: the multi-tenant load harness now measures shared-pool and dedicated-database (BYOD) architectures separately, so a published performance figure always states which architecture produced it.

ISO 37001 Anti-Bribery Management System module: gift and hospitality register with configurable EUR threshold (default €50), approval workflow, due diligence screening with PEP/sanctions/adverse media checks, training compliance tracker, Italian Decree 231 ODV meeting log with finalisation lock, risk mapping, Modello Organizzativo PDF, and an Anti-Bribery Advisor SSE agent. Fundamental Rights Impact Assessment (FRIA) under EU AI Act Art. 27: full FRIA lifecycle (draft → approve with re-auth → publish with immutability gate), affected groups and rights-at-stake inventory, residual risk justification, regulator-ready PDF, Draft-AI SSE agent (EU Charter / Art. 27 narrative), and module-gated to ai-act tenants only. Compliance audit hardening: CSRF header added to internal demo reseed cron HTTP calls (all 6 demo tenants were silently failing nightly reseeds), CB certificate number space expanded from 900 → 90,000 values per year to eliminate duplicate-key exhaustion.

Tenth vertical: full ISO 17020:2026 inspection body operations. Inspection orders with sequential numbering, findings recorder, AI narrative generator, report issuance with PDF, and impartiality risk register with 6-month review scheduling. Type A independence enforced at the API layer — if the reviewer is the same person as the assigned inspector, issuance is rejected before re-authentication is prompted. Three AI agents: Inspection Narrative Generator, Impartiality Advisor, and Compliance Advisor. BYOD relational database connections: connection testing for PostgreSQL, SQL Server and Oracle via encrypted connection string (storing lab data on a SQL database is still in development — see Sep 2026). Connection testing with latency measurement and plain-language error messages. DB Configuration Agent for guided setup. All connection strings encrypted at rest; never returned in API responses.

New Ex Certification module for ATEX/IECEx explosion-protected equipment .Six IEC 60079 protection types (Ex d/e/i/p/n/m) with clause-by-clause assessment checklists, Ex marking builder per IEC 60079-0:2017, QAR PDF generation, and an AI advisory review agent. All assessments are marked DRAFT/PROVISIONAL pending expert verification — NEEDS-EXPERT-VERIFICATION flags throughout. NGEC1 demo tenant seeded with three equipment records (Ex d junction box, Ex e terminal block, Ex ia intrinsic safety sensor). EU AI Act: risk classification fully decoupled from gap scores — now purely questionnaire-driven (Art. 6/Annex III logic); Digital Omnibus phasing surfaced with three effective dates (Aug 2026/Jan 2027/Aug 2027). AIMS Management Review: platform-level AI governance dashboard (ISO/IEC 42001 §9.3), posture snapshot at review creation, improvement actions with close workflow, AI executive summary. Marketing vertical pages now show Live/Integration/Future status badges with standing accreditation disclaimer.

The ninth vertical closes the conformity assessment loop: Manufacturer (FounderOS) → Testing Lab → Certification Body (ISO 17065) → Accreditation Body (ISO 17011). One governed platform covers every node. Full accreditation body operations: application intake, assessments, accreditation certificates, surveillance calendar, assessor register, complaints and appeals. AI conflict-of-interest screener per ISO 17011 cl. 5.2. Decision independence enforced at the API layer — if the certificate decision-maker was on the assessment team, issuance is rejected with the clause cited. MIND™ Demo Layer added (MindPanel drawer on demo dashboards).

University core facilities and government research labs now have a purpose-built tier. Grant tracking with F&A overhead auto-computed (NIH 15% MTDC cap enforced). FAIR Data Publishing — persistent identifiers, public share links, DataCite JSON export for Zenodo/Dryad/Figshare deposit. Lab Mode toggle switches the entire UI from commercial to academic terminology (Sample Submission, Lab Report, Principal Investigator, Internal Chargeback). Multi-department structure with cost centres. Funder mandate fields for NIH, Horizon Europe, and NSERC DORA. $299/mo institutional tier, annual billing.

New teal vector logo and tagline "One Platform. Every Workflow. Total Control.™" 53 test suites covering every major workflow path, vertical module, compliance assertion, security probe, and EU AI Act control. Includes Standards Currency Monitor agent (ASTM/ISO/IEC/AOAC superseded-method detection), always-on health monitoring with live score endpoint, and SAP QM / Salesforce CRM / IEC Electrical vertical launches.

Native bidirectional connection to Epic, Cerner, Meditech, and Allscripts. Inbound ServiceRequest orders auto-populate AILS. Outbound DiagnosticReport results push to the EMR. No middleware.

Seed-to-harvest documentation for cannabis, hemp, and botanicals. Batch tracking, IPM records, dual-witness waste destruction, and a forward-looking FDA Schedule III readiness audit.

Full CLIA compliance: patient results, Westgard QC rules, CAP/COLA proficiency testing, personnel qualifications (Subpart M), and HIPAA BAA available at signup.

OOS investigations, ICH Q1A/Q1E stability studies, method validation, AI batch release risk scoring, and mandatory second-person COA review.

21 CFR Part 11 controls on two-factor authentication. Re-authentication required before every critical signature. Architecture enforced — not a setting.