| Intended Use Classification | Confirm whether the device is intended for cosmetic assessment, wellness, research, or medical diagnosis. | Product claims, user manual, technical file, labeling, and marketing materials. | The stated use, software functions, labeling, and regulatory pathway should be consistent and free from unsupported medical claims. | Critical |
| Quality Management System | Assess design control, supplier control, production records, complaint handling, and corrective actions. | Valid ISO 9001 certificate; ISO 13485 certificate when the product is a medical device. | Certificate scope should cover the relevant product category and manufacturing site; certificate status should be independently verifiable. | Critical |
| Regulatory Compliance | Check compliance with the destination market and the product's actual intended purpose. | For applicable medical devices: Regulation (EU) 2017/745, technical documentation, declaration of conformity, and post-market procedures. | Required conformity assessment must be completed before commercial distribution; documents must match the exact model and software version. | Critical |
| Electrical Safety | Review protection against electric shock, abnormal operation, overheating, and accessible surface hazards. | IEC 60601-1 for applicable medical electrical equipment; applicable national deviations for the target market. | A laboratory test report should identify the exact model, electrical ratings, test configuration, and pass results. | Critical |
| Electromagnetic Compatibility | Verify emissions and immunity performance during normal operation and charging. | IEC 60601-1-2 for applicable medical devices; CISPR or destination-market EMC requirements. | Test reports must cover radiated and conducted emissions plus immunity tests relevant to the final configuration. | Critical |
| Optical and LED Safety | Assess exposure from visible, ultraviolet, or infrared illumination used for facial imaging. | IEC 62471 photobiological safety assessment, where applicable. | The optical risk group and exposure conditions should be documented for the complete imaging system, not only individual LEDs. | High |
| Measurement Repeatability | Repeat scans under controlled lighting, distance, camera angle, and subject position. | Supplier validation protocol, raw test data, calibration procedure, and software version record. | Buyer-defined acceptance limits should be established for each reported parameter; repeated scans should remain within those limits. | Critical |
| Image and Analysis Accuracy | Compare algorithm outputs with a defined reference method and representative skin types. | Validation report, sample size, statistical method, reference instrument, and limitations. | Performance claims should include an objective reference method, confidence intervals where relevant, and clearly stated exclusions. | Critical |
| Calibration and Maintenance | Review factory calibration, calibration intervals, service tools, and replacement procedures. | Calibration certificate, service manual, maintenance schedule, and traceability records. | Each delivered unit should have an identifiable calibration status and documented maintenance instructions. | High |
| Software Lifecycle and Cybersecurity | Assess access control, update management, vulnerability handling, backups, and software change records. | IEC 62304 where applicable, software risk records, version history, penetration-test summary, and update policy. | Every production release should be traceable; default passwords, unsupported operating systems, and uncontrolled updates should not be accepted. | Critical |
| Personal Data Protection | Determine whether facial images, biometric information, or health-related data are collected, stored, transferred, or analyzed. | Privacy policy, data-flow diagram, retention schedule, consent process, processing agreement, and applicable GDPR or local privacy requirements. | Data minimization, encryption in transit and at rest, role-based access, deletion controls, and documented user consent should be implemented where required. | Critical |
| Materials and Environmental Compliance | Verify restricted substances, plastics, cables, batteries, packaging, and electronic components. | RoHS declaration or test report, REACH information, battery documentation, and applicable waste or recycling obligations. | Declarations and test reports should correspond to the final bill of materials and the exact shipped configuration. | High |
| Factory Production Controls | Review incoming inspection, assembly controls, final inspection, traceability, and nonconforming-product handling. | Process flow chart, inspection plan, work instructions, batch records, and audit findings. | Critical components and finished units should be traceable by lot or serial number, with documented release criteria. | Critical |
| Pre-Shipment Inspection | Test appearance, accessories, imaging performance, software version, packaging, and electrical safety before shipment. | Approved inspection checklist, inspection report, photographs, and random-sampling plan. | Inspection results should be linked to the purchase order, serial numbers, acceptance criteria, and corrective-action records. | High |
| Warranty and After-Sales Support | Confirm response times, spare-parts availability, remote support, repair process, and software support period. | Written warranty terms, service-level agreement, spare-parts list, escalation procedure, and training materials. | Responsibilities, exclusions, turnaround times, and support duration should be defined contractually before purchase. | High |
| Supplier Audit and Final Scoring | Combine document review, sample testing, factory audit, and commercial-risk assessment. | Completed audit checklist, corrective-action plan, test results, and signed quality agreement. | Use a weighted score: Critical compliance items must pass; unresolved critical findings should prevent approval regardless of total score. | Critical |