Vigil

Every medical device complaint has a reporting clock. Vigil shows which regulator needs a report, by when, and why.

Comment

Inspiration

When a medical device may have hurt a patient, the manufacturer has a legal deadline to report it. In the US, 21 CFR Part 803 allows 30 calendar days, or 5 work days when remedial action is needed to prevent an unreasonable risk of substantial harm. In the EU, the MDR (Article 87) allows 15 days, 10 days for a death or an unanticipated serious deterioration of health, and 2 days for a serious public health threat. Even when the manufacturer is unsure whether an event is reportable, it must still report within the limit.

The clock starts on day 0: the day any employee or representative first received the information, not the day the quality team opened the ticket. In practice those facts arrive late and scattered. A sales rep hears about an injury on a Saturday, a nurse's email mentions surgery, an engineer finds the root cause a week later. Complaint teams that work in Jira have to find day 0 in the comments, decide which rules apply, count days by hand, and keep the US and EU clocks apart. Vigil does that bookkeeping and shows its work.

What it does

  • Reporting clocks on every complaint. A Jira issue panel shows a clock for each regulator where the product is sold: the report type, the due date, the days left and the rule it comes from, for example "EU serious incident report due 15 Nov 2026 (MDR Art. 87(3))". Before anyone assesses a complaint, the clocks count from the day it was created, with a warning that day 0 may be earlier.
  • Reads the record with Rovo. Ask the Vigil agent to assess a complaint. It reads the description and every comment through the Teamwork Graph API and proposes day 0 with a quote, such as the sales rep's comment "the nurse manager on Ward 4B called me about this on Saturday 31 October". It answers each reporting criterion (death, serious injury, malfunction that could cause serious injury if it recurred, public health threat, remedial action, causality) with evidence, or "unknown" when the record does not say.
  • Checks the risk management file. Whether a serious deterioration was "unanticipated" decides between the EU 10-day and 15-day limits. MDCG 2023-3 says it is anticipated when the condition was considered in the risk assessment. Vigil follows the links from the product's risk management file to its hazard analysis through Teamwork Graph, and the agent names the hazard that covers the harm, such as "H-02". Until someone confirms that the harm was anticipated, Vigil uses the shorter limit.
  • People decide, code counts. Nothing is saved until the user confirms the facts in Rovo's review card. Then deterministic code computes every clock:
    • FDA 30-day report, 21 CFR 803.50(a);
    • FDA 5-day report, 21 CFR 803.53, counting work days and skipping weekends and US federal holidays;
    • FDA supplemental report, 30 days, 21 CFR 803.56;
    • EU reports, 15, 10 or 2 days, MDR Art. 87(3)-(5).

When the last EU day falls on a weekend, Vigil explains that the legal limit moves to the next working day (Regulation 1182/71, as MDCG 2023-3 describes), but counts down to the earlier date.

  • Warns before the date passes. A Jira event trigger re-checks the clocks when a complaint gets a comment or is updated, and a daily scheduled trigger catches time passing. When a report is due within 3 days or is overdue, Vigil comments on the complaint, once per clock and stage.
  • Vigilance page. A Jira global page shows:
    • every open clock;
    • the reports due in the next 14 days;
    • complaints that still need an assessment;
    • trend signals for EU MDR Article 88. For each problem code, Vigil compares the non-serious incidents in the surveillance plan's window with the expected count, using a one-sided Poisson test. In the demo, 4 false occlusion alarms in 30 days against 0.8 expected gives p = 0.009. A signal is a prompt to review, not a decision.
  • Decision record in Confluence. After a decision, Vigil writes a page in the quality space with the facts, the evidence, every clock with its basis, and the rationale.
  • Without Rovo. The panel has a manual assessment form, and teams can record a sent report (date and reference) or the date new information arrived, which starts the supplemental-report clock.

How we built it

  • Forge, end to end. One app: Jira is required and Confluence is optional. Modules:
    • rovo:agent with seven actions: get-complaint, get-risk-file, record-assessment (CREATE), record-submission (UPDATE), list-due, trend-check and write-decision-record (CREATE);
    • jira:issuePanel ("Reporting clocks") and jira:globalPage ("Vigilance");
    • trigger on avi:jira:commented:issue and avi:jira:updated:issue (with ignoreSelf), and a daily scheduledTrigger;
    • Forge Custom Entities: assessment, indexed by product and by status plus next due date. Product settings are kept in Forge storage;
    • Confluence pages are written as the user for decision records.
    • The UI is UI Kit, with UI Kit charts.
  • Teamwork Graph API. Vigil calls curated queries with api.asUser().requestTeamworkGraph():
    • jiraWorkItemComments gets the facts and their dates;
    • confluencePageLinkedConfluencePages walks from the risk management file to the hazard analysis and the surveillance plan;
    • confluencePageOwners names the owner of the risk file.

Scopes: read:graph:issue:jira, read:graph:issue-comment:jira, read:graph:page:confluence and read:graph:user:atlassian. A missing scope returns empty rows instead of an error, so Vigil falls back to the Jira and Confluence REST APIs and labels the source.

  • AI where it helps, code where it must be right. The agent reads people's writing and quotes it. Dates, rules and statistics are plain code covered by 20 offline tests, including:
    • the OPM federal holiday schedules for 2026 and 2027, observed dates included;
    • five-work-day counts across Veterans Day and Thanksgiving;
    • the EU weekend rule;
    • the reportability-date example in MDCG 2023-3;
    • Poisson tail values.
  • Primary sources. The rules come from the eCFR text of 21 CFR Part 803 (point in time 1 November 2026), Regulation (EU) 2017/745 on EUR-Lex, MDCG 2023-3 Rev. 2 (January 2025) and OPM's holiday schedules. Every clock shows the citation it uses.
  • Permission-aware. Reads for people run as the current user, and Teamwork Graph rows are filtered to what that user can see. Only people who administer a Jira project can change its Vigil settings. The triggers act as the app and only comment on complaints in configured projects.
  • Measured on a live site. We ran the whole flow on the production app on a demo site with fictional data. It covered:
    • three serious complaints, each assessed through Rovo: an EU 15-day clock with a weekend, an EU 10-day clock for a death with causality unknown, and an FDA 5-day report;
    • five non-serious ones;
    • the automatic reminder comment, the decision record page, a recorded submission, and the trend signal.
  • Demo video. Screen captures of the production app on a live demo site. The demo data is fictional. The narration is synthetic (Kokoro-82M text to speech, Apache-2.0).

Challenges we ran into

  • Rovo actions accept at most ten inputs, and an assessment has more criteria than that. The agent passes the criteria as one key=value string, which Vigil parses and validates; anything it cannot read stays "unknown".
  • Agents format evidence differently from run to run: one criterion per line, or all of them on one line. The evidence parser splits on the criterion names, so both shapes work.
  • MDCG 2023-3 says an EU limit moves to the next working day when it ends on a weekend or public holiday, but its own worked example ignores this. Vigil never shows a later date than the plain day count; it explains the possible extension instead.
  • A Teamwork Graph query with a missing scope succeeds and returns nothing. We check every result and fall back to REST, so a declined scope degrades the panel instead of breaking it.

Accomplishments that we're proud of

  • Day 0 is found in the record and quoted, not assumed from the ticket's creation date. In the demo it moves the EU deadline from 28 November to 15 November.
  • The risk file decides between 10 and 15 days, and the screen names the hazard that made the difference.
  • Every date on screen can be traced to a rule, a citation and a confirmed fact.

What we learned

  • In regulated work, a deadline is only useful if you can show where it comes from. Citations and quotes did more for trust than any summary.
  • Teamwork Graph makes cross-product context cheap: comments, page links and page owners take three curated queries.
  • Splitting the job worked well. The agent reads and quotes, people confirm, and code counts.

What's next

  • More jurisdictions, each as a tested rule module: UK MHRA, Health Canada, Australia's TGA.
  • Complaint intake through a Jira Service Management portal.
  • IMDRF problem codes, and the trend method chosen per surveillance plan.

How it meets the technology requirement

Vigil is built entirely on Atlassian Forge. It integrates:

  • Jira: issue panel, global page, work item reads and comments, event triggers;
  • Confluence: page reads and decision record pages;
  • Rovo: an agent with seven actions;
  • the Teamwork Graph API: three curated queries as the current user.

It makes no external calls. After the production deployment, the Forge CLI reported that the version is eligible for the Runs on Atlassian program.

Bonus prize: Teamwork Graph integration

Vigil consumes data from the Teamwork Graph API in three places, each one part of the core workflow:

  1. Facts and day 0. jiraWorkItemComments (last 365 days) returns every comment on the complaint with its timestamp. The agent uses it to find the earliest date any employee knew, and the evidence for each criterion.
  2. Risk file. confluencePageLinkedConfluencePages walks from the product's risk management file to the pages it links to, such as the hazard analysis and the post-market surveillance plan. Whether the hazard analysis lists the harm decides between the EU 10-day and 15-day limits.
  3. Ownership. confluencePageOwners names the owner of the risk file in the panel, so a new harm or a rising rate goes to the right person for a risk review.

All calls run as the current user, so results respect page and project permissions. The panel labels the risk file section "from Teamwork Graph".

Privacy and support

  • Vigil runs entirely on Atlassian Forge and makes no external calls.
  • It stores the following in Forge storage on the customer's site:
    • complaint keys, dates and the confirmed answers to the reporting criteria;
    • short evidence quotes copied from the complaint record, and the rationale;
    • the dates and references of reports that were sent;
    • product settings.

It does not store account IDs, people's names or email addresses. Page owner names from Teamwork Graph are shown at view time and not stored. Evidence quotes come from the complaint text, so the complaint's own data handling rules apply.

  • Vigil is decision support. It is not validated software, it does not replace the complaint handling procedure, and it does not submit reports to any authority.
  • Questions or problems: leave a comment on this Devpost page.

Built With

Share this project:

Updates

Submission history