QMS Policy Manual
ID No. POL 0415
Version No. 01
Page: 1 of 3
Date: 17th June 2026
Sustainability and Net Zero
As a Software as a Medical Device (SaMD) organisation, we recognise our responsibility to minimise environmental impact while maintaining the highest standards of patient safety, product quality, information security, regulatory compliance, and business performance.
This Sustainability and Net Zero Policy establishes our commitment to reducing greenhouse gas emissions and progressing towards Net Zero operations through responsible management of energy, technology, procurement, travel, facilities, and product development activities.
This policy supports compliance with our Quality Management System (QMS), Information Security Management System (ISMS), and applicable regulatory obligations, including:
ISO 13485:2016 - Medical devices — Quality management systems — Requirements for regulatory purposes
ISO 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements
Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in vitro diagnostic medical devices
This policy shall not compromise patient safety, product performance, cybersecurity, data integrity, regulatory compliance, or business continuity requirements.
0415.1 Energy and Compute Management
Recognising that AI development and deployment can contribute significantly to energy consumption, we will consider providers such as Google Cloud, Microsoft Azure, and Amazon Web Services where suitable for business, security, and regulatory requirements. Supplier evaluations will also include consideration of sustainability performance for cloud services.
For device development, we will optimise model training processes to reduce GPU utilisation and electricity consumption. Appropriately sized and efficient models will be used where clinically and commercially suitable rather than routinely developing larger models.
Internal computer intensive workloads will be scheduled during periods of lower electricity demand where operationally feasible, and unused cloud resources will be retired promptly when no longer required.
All optimisation activities shall maintain required levels of clinical performance, validation, cybersecurity, and regulatory compliance.
0415.2 Data Centre and Hardware Management
Spotlight will extend laptop, workstation, server, and peripheral lifecycles where security and performance requirements permit. Suppliers will be preferred that provide transparent emissions reporting and sustainability disclosures where feasible, and lifecycle environmental impact will be considered.
When retiring equipment, Spotlight will ensure secure data destruction and environmentally responsible disposal of electronic waste through the use of certified recycling and disposal providers.
0415.3 Travel and Events
Spotlight will endeavour to replace non-essential business travel with virtual collaboration tools wherever practicable, and favour rail travel over air travel for UK and European journeys where feasible.
CONTROLLED DOCUMENT – DO NOT COPY
QMS
POLICY MANUAL
ID No. POL 0415
Version No. 01
Page: 2 of 3
Date: 17th June 2026
SUSTAINABILITY AND NET ZERO
We operate a hybrid/remote working model to reduce the amount of travel during normal working hours. 0415.4 Office Operations
Spotlight operate a digital-only QMS, with no printed documents unless absolutely necessary, to reduce the burden of paper and ink use.
We will improve the environmental performance of our workplace(s) by reducing waste generation and single-use materials when possible, and promoting recycling and responsible waste management.
We encourage cycling, walking, public transport, and other sustainable methods when commuting to the office. 0415.5 Sustainable Procurement
As we recognise that a significant proportion of emissions may arise from our supply chain, we may consider sustainability criteria within supplier selection, qualification, monitoring, and re-evaluation processes. Local suppliers may be preferred where practicable and financially reasonable. Environmental impacts of a supplier may be considered alongside quality, regulatory, security, and commercial requirements. Where feasible, services providing a low-carbon or certified renewable energy option may be preferred.
0415.6 Product Development
As Spotlight are a software-only company, developing AI-driven medical devices, environmental considerations will be integrated into product lifecycle activities. These include:
Designing efficient deployment architectures to minimise operational energy demand.
Monitor algorithm processing times following deployment.
Avoid unnecessary data storage, duplication, and resource consumption.
Promote software engineering practices that improve computational efficiency.
Patient safety, clinical performance, cybersecurity, usability, and regulatory compliance shall always take precedence over environmental optimisation.
DOCUMENT REFERENCES
ISO 13485:2016 - Medical devices — Quality management systems — Requirements for regulatory purposes
ISO 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements
Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). ● Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in vitro diagnostic medical devices
-END