How an Austrian Medtech Firm Cut Compliance Reporting from 16 Hours to 4

Background: A 30-Person Austrian Medtech Firm

This case study is a composite built from patterns Forfis has observed across multiple engagements in the field. No named customer appears. The company, metrics, and timeline are representative of a recurring profile: a mid-size medtech firm in a Tier-1 European market running isolated AI pilots and looking to consolidate them into a managed workflow.

The company is a 30-person Austrian medtech firm, roughly 18 months post-Series A, selling a Class IIa diagnostic device across DACH and Benelux. Its stack is a mix of a legacy CRM, a document management system for contracts, and a spreadsheet-driven compliance calendar. The compliance function is two people: a head of legal and compliance and a junior analyst. Monthly reporting under the EU Medical Device Regulation (MDR) and ISO 27001 requires them to extract obligations from 40+ active contracts, score each against operational status, flag deviations, and file a narrative summary with the quality management system. The cycle takes 14-18 hours per month, and the junior analyst is the single point of failure.

Challenge: A 16-Hour Monthly Cycle and a Departing Analyst

The pressure was operational, not strategic. The junior analyst was leaving in 90 days. The head of compliance had no bandwidth to absorb the full reporting cycle. The company was also preparing for an ISO 27001 surveillance audit in 5 months, which required documented, repeatable processes for every compliance activity. A manual, spreadsheet-driven cycle did not meet the audit’s evidence requirements.

The specific need was to automate the monthly reporting cycle: extract clause-level obligations from contracts, score each against current operational status, flag deviations, and draft the narrative summary. The company had run two isolated AI pilots in the prior year — a ticket triage bot on their helpdesk and a document extraction tool for purchase orders — but neither touched the compliance function. The pilots were running, but they were not integrated, and the compliance team had no visibility into them. The challenge was not to build another isolated pilot but to create a managed, auditable workflow that the compliance team could own.

Approach: Audit, Fixed-Scope Pilot, and a Dedicated Team

Forfis ran a process audit in weeks 1-3. The audit mapped every step of the monthly reporting cycle, identified 5 automatable steps, and scored each by volume, error rate, and regulatory sensitivity. The pilot scope was fixed: clause extraction and obligation scoring for one product line, using the OpenAI API for text processing. The architecture was model-agnostic — the same pipeline could swap to an open-weight model on the client’s own hardware if a future contract contained data that could not leave the building. The integration was a custom REST API with webhooks, plugging into the existing CRM and document management system without replacing them.

The delivery model was a dedicated AI team: three engineers and one product designer embedded with the compliance function for the full 6-month engagement. The team owned the model pipeline, the API, and the tuning loop. The compliance officer owned the approval step and the final report. Every pilot shipped with a measured before/after baseline on cycle time and error rate. The human-in-the-loop design meant the model drafted, the compliance officer approved, and every output was logged for the ISO 27001 audit trail.

Outcome: 60% Cycle-Time Reduction and a Clean Audit

The pilot ran for 6 weeks. The before baseline: 14-18 hours of manual work per month, with an error rate of 4-6% of obligations misclassified or missed. The after baseline at the end of the pilot: 4-6 hours of manual review per month, with an error rate of 1-2%. The cycle time dropped by roughly 60%. The compliance officer reported that the draft summaries were accurate enough to use as a starting point, cutting the drafting phase from 3 hours to 45 minutes.

The go/no-go gate at the end of the pilot passed. Rollout extended the pipeline to all product lines and added the internal knowledge search layer, which indexed the contract corpus, regulatory guidance, CRM records, and past compliance reports. The knowledge search layer turned the monthly cycle into a continuous, queryable knowledge base. The team could answer ad-hoc questions like ‘What are our current MDR obligations for device X?’ in minutes instead of hours. The ISO 27001 surveillance audit, conducted in month 5, passed without findings on the reporting process. The dedicated team transitioned to a managed-operation model in month 7, handling model updates, prompt refinement, and edge-case triage on a monthly cadence.

Lessons for Similar Teams

• The audit is the product, not the pilot. The 3-week process audit produced a one-page decision matrix that the compliance team still uses 18 months later. The pilot was the validation, but the audit was the durable deliverable. Teams that skip the audit and jump straight to a pilot end up automating the wrong workflow.

• Human-in-the-loop is not a compromise; it is the architecture. The model drafts, the human approves. This separation kept the ISO 27001 audit trail clean and ensured the model was never the final authority on a compliance determination. Teams that try to remove the human step for speed end up with an audit finding and a rework cycle.

• Model-agnostic is a design constraint, not a marketing claim. The pipeline was built so the OpenAI API could be swapped for an open-weight model on the client’s own hardware without rewriting the integration. This mattered when a future contract contained data that could not leave the building. Teams that hard-code a single model API end up with a 3-month rework project when the data classification changes.

• The knowledge search layer is where the ROI compounds. The monthly reporting cycle was the entry point, but the internal knowledge search layer is what the compliance team uses daily. The reporting cycle runs once a month; the knowledge search runs 20-30 times a week. Teams that stop at the reporting cycle miss the compounding value.