Convert conformance testing into regulator-ready evidence
Every EHR system on the EU market must be CE-marked and self-certified — with no notified body to hand it to. Annexbase scopes your exact obligations, pins every test to its toolchain, and generates your Annex III technical file.
No signup. No patient data — ever.
Self-certification means the burden of proof is yours
Recitals 36 and 39 call it a “mandatory conformity self-assessment scheme.” There is no auditor to pay and no certificate to buy — only obligations that arrive with deadlines attached.
To produce your technical documentation
Art 37(4): miss the deadline and market surveillance may order an independent test at your expense.
To report a serious incident
Art 44(7): to every Member State where you sell. “Serious prejudice to a natural person's rights” includes a data-rights bug.
To keep it all reproducible
Art 30(3): retain the technical file and declaration — and produce source code or programming logic on reasoned request.
Eleven steps to conformity. The free tooling covers two.
The Commission-backed workflow, step by step — and who covers each one today.
| # | Conformity assessment step | Covered by |
|---|---|---|
| 1 | Determine applicable requirements from data categories + functional role | Annexbase |
| 2 | Prepare test plan | Annexbase |
| 3 | Execute automated tests in a Digital Testing Environment | Free state-run DTE |
| 4 | Evidence for manual test cases and checklists | Annexbase |
| 5 | Compile Annex III technical documentation | Annexbase |
| 6 | Produce Article 38 information sheet | Annexbase |
| 7 | Draw up Annex IV EU declaration of conformity | Annexbase |
| 8 | Register in the EU database | EC portal |
| 9 | Affix CE marking | Annexbase guidance |
| 10 | Keep documentation current | Annexbase |
| 11 | Reassess conformity on significant change | Annexbase |
steps have no tooling in existence. Not from the Commission, not from your FHIR server vendor, not from your QMS.
Annexbase is the product for the nine.
The evidence layer above free validation
The HL7 FHIR Validator is excellent and free. The EU testing environment is state-run and free. Annexbase wraps them and builds what doesn't exist: the audit trail from requirement to declaration.
Scope
Steps 1–2Declare data categories and functional roles. Get the exact Annex II requirements that bind you, your deadline, and the FHIR guides you'll be tested against.
Evidence
Steps 3–4Every validator run pinned to exact validator, IG package and terminology versions. Manual checklists captured beside them — one trail.
Documents
Steps 5–9Annex III technical file, Article 38 information sheet and Annex IV declaration generated from the same requirement graph. Always current.
Renewal
Steps 10–11Significant change triggers reassessment. Your file stays ready for the 30-day request — for ten years.
From “what applies to us?” to a draft technical file
Describe your system
Tick the priority data categories you handle and the functional roles your system plays. Two minutes, no integration.
Get your scoped obligations
The engine resolves your Annex II requirements — split into automatable, hybrid and manual — plus your governing deadline and IG packages.
Build the evidence trail
Run pinned validations, complete manual checklists, and export the Annex III skeleton your declaration will stand on.
Three things Annexbase will never do
Never store patient data
We process your documentation, profiles and test artefacts only. That keeps the platform outside GDPR Article 9 entirely — by architecture, not by policy.
Never sell you validation
Validation is a solved, free commodity. We assemble the free tools and sell the layer above: traceability, evidence, documents.
Never make an unreproducible claim
Every evidence record pins validator, IG package and terminology versions. A conformance claim you can't reproduce is worthless — so ours always are.
Priced per system — because the obligation is
- Full scoping engine against the versioned requirements corpus
- Pinned validation runs and manual evidence capture
- Annex III, Article 38 and Annex IV document generation
- SNOMED IPS Free Set included — bring your own full licences
- EU-hosted. No patient data, ever.
What the market charges instead
A vendor with three products has three technical files — and still pays less than one month of the regulatory hire that 91% of SMEs can't make anyway.
- Greenlight Guru (QMS)$25–35k / yr
- Aidbox · Kodjin (FHIR servers)$19k / yr per DB
- Simplifier Professional$3,350 / yr
- Annexbase€1,200–3,600 / yr
The questions every vendor asks first
Do we have to rebuild our EHR around the European exchange format?
No. The Commission's own FAQ (Q23) is explicit: “There is no requirement for EHR systems to use the format internally.” The EEHRxF is a boundary format — you keep your internal data model and transform at the edge. Only two harmonised software components are regulated: interoperability and logging.
Does Annexbase see our patient data?
Never. We process your technical documentation, FHIR profiles, capability statements and test artefacts — synthetic fixtures included. No feature of the product requires patient data, which keeps both of us outside GDPR Article 9.
Shouldn't we wait for the common specifications in 2027?
The implementing acts land by March 2027 — after which the 2029 deadline leaves a 24-month runway for what industry itself calls a 4–5 year build-and-deploy cycle. Scoping and evidence architecture don't change with the specs; start now, absorb the specs when they land.
We're not an EU company. Does this apply to us?
If your system is offered as a service to anyone established in the Union, Article 26(2) deems it put into service — regardless of where you sit. Non-EU manufacturers also need an EU authorised representative under Article 31.
Is Annexbase a notified body or a certification service?
Neither exists for EHR systems — that's the point. EHDS conformity is self-assessed. Annexbase is software that makes your self-assessment scoped, evidenced and reproducible. It's tooling, not legal advice.
2029 is closer than it looks.
Industry's own cycle is ~2 years to build and 2–3 to deploy. A vendor targeting 2029 starts now. Scope one system free — it takes 15 minutes.
Run your free scope check →