safety-compliance-scopinglisted

# Safety Compliance Scoping The expensive mistake here isn't picking the wrong standard — it's making architecture decisions before anyone checked which standards apply, then discovering the required risk classification or traceability regime demands changes that are painful to retrofit. This skill exists to surface that early, cheaply, before the fact. ## Step 1 — Classify the actual use case and consequence of failure first Everything downstream depends on getting this right: is the system providing decision support to a human who remains in control, or acting autonomously with a direct real-world effect? Is the context consumer, industrial, or medical? What's the realistic worst-case consequence if it fails or gives a wrong answer? This classification — not the technology used to build the system — determines which regulatory framework applies at all. ## Step 2 — Identify candidate frameworks by domain, not exhaustively Name the frameworks plausibly relevant to the Step 1 classification, for example: - **Functional safety**: IEC 61508 as the base standard, with domain-specific derivatives (ISO 26262 for automotive, IEC 62304 for medical device software, IEC 61511 for process industry) where applicable. - **Medical device regulatory**: a jurisdiction's device classification pathway (e.g., FDA risk-based device class in the US, EU MDR risk class in Europe) — classification usually depends on intended use and risk, not just the underlying technology. - **Industrial safet