Spinning a university research project into a CE-marked medical device in 24 months is possible but unusual. The composite case study below — anonymised from several real spinouts Tibor has worked with — shows a Class IIa device that went from lab bench to CE mark in two years. It happened because four foundational decisions were taken on day one: a sharp intended purpose, an honest classification under Article 51 and Annex VIII, a clean IP transfer from the university, and a team with at least one person who had shipped an MDR certificate before. Every month of the 24 was accounted for. There was no slack. And it nearly broke twice.

By Felix Lenhard and Tibor Zechmeister. Last updated 10 April 2026.

TL;DR

  • Twenty-four months from a university research prototype to a CE-marked Class IIa device is possible but sits at the fast end of what the regulation realistically allows. It is not a typical timeline.
  • The four foundational decisions that made it possible: a sharp intended purpose, an honest classification rationale under Article 51 and Annex VIII, a clean IP transfer from the university, and a co-founder who had already shipped an MDR certificate.
  • Clinical evidence under Article 61 was assembled largely from existing academic literature and a small targeted investigation, not a from-scratch large trial. The literature route was only available because the intended purpose was written to match the published evidence.
  • The team built the technical documentation under Annex II straight from first principles, not from a template pack. Every document corresponded to a process the team actually followed.
  • The project nearly broke twice: once on an IP transfer term the university tried to renegotiate at month nine, and once on a Notified Body capacity slip that cost three months and forced a rebuild of the Phase 2 plan.
  • The lesson for other research-led founders: the twenty-four-month outcome is not a copy-paste template. It is the product of decisions made before the company even existed.
  • Regulation (EU) 2017/745 is the single source of truth throughout. No transitional provision helped this project. It was a straight MDR build from day one.

The spinout starting point

The composite case study in this post is built from several real university spinouts Tibor has worked with over the years. Every identifying detail has been changed. The numbers, the timeline, the decision points, and the failure modes are accurate to how this kind of project actually unfolds. Treat it as a faithful reconstruction, not a single real company.

The starting point was a university research group that had spent roughly four years on a measurement technology with a clear clinical application. The published papers were good. The prototype worked on the bench. A principal investigator and two senior researchers had decided the work was worth a spinout. They had read about MDR, knew it was heavy, and had been told by well-meaning academic colleagues that CE marking would take five years minimum and probably eight. Their expected timeline when they first sat down with Tibor was four years. They shipped in two.

What is worth saying upfront: this was not because MDR is secretly easier than people think. It is not. It was because the team made four foundational decisions in the first month that compounded across every later stage. None of those decisions required genius. All of them required discipline and the willingness to hear uncomfortable answers early.

The iceberg moment

The first serious conversation happened in a cramped meeting room after a pitch event. The principal investigator opened with what every first-time MedTech founder opens with — a description of the technology, the clinical application, the published evidence, and a rough sense that "we probably need some kind of certification." The first hour was spent walking through what Regulation (EU) 2017/745 actually asks of a manufacturer: the general obligations under Article 10, classification under Article 51 and Annex VIII, clinical evaluation under Article 61, the technical documentation under Annex II, the conformity assessment procedures under Article 52, and the quality management system obligation that runs underneath all of it.

Tibor has described this moment elsewhere as the iceberg moment. The founder looks at MDR expecting a document and instead sees a reach — into quality management, into clinical evidence, into risk management, into usability, into post-market surveillance, into vigilance reporting, into every surface of the company. It is the moment the project starts to look either unshippable or navigable, and the difference is whether the person on the other side of the table has a map.

This spinout team got the map. They left that meeting with a one-page sketch of the ten stages from idea to CE mark, a realistic cost bracket for their likely class, a realistic calendar, and the four decisions they had to take before anything else got started. Those four decisions are what made the twenty-four-month timeline possible.

The four foundational decisions

The decisions were not clever. They were obvious in hindsight and are almost always skipped by first-time founders who are in a hurry to start "the real work."

First — a sharp intended purpose, written late and defended hard. The team did not try to write their intended purpose in week one. They wrote it in week eight, after they had had real conversations with three clinical departments who would use the device. The sentence that came out of those conversations was specific about the patient population, the clinical setting, the measured parameter, and the clinical decision the device supports. It was sharp enough to drive a clean classification under Annex VIII and narrow enough that the clinical evaluation could lean on existing published evidence. A fuzzy intended purpose written in week one would have cost them a year downstream.

Second — an honest classification under Article 51 and Annex VIII. The device fell into Class IIa under the relevant rule in Annex VIII, and the team wrote the classification rationale as a short standalone document with the rule cited, the interpretation named, and the reasoning laid out. They had it reviewed by someone with Notified Body audit experience before they locked it in. No wishful thinking about Class I. No over-classification "to be safe." Just the rule applied honestly. (Regulation (EU) 2017/745, Article 51 and Annex VIII; MDCG 2021-24.)

Third — a clean IP transfer from the university. This is the decision academic spinouts get most often wrong. The team did not start the regulatory project until the IP transfer terms with the university were signed. Not an MoU. Not a letter of intent. A signed agreement that transferred the rights needed to place the device on the market, including the rights to the published data needed for the clinical evaluation. They spent six weeks on this. It looked like delay. It was not. The two projects that nearly broke later both traced back to IP issues that had not been fully resolved, and every week spent on IP before the regulatory project started saved at least a month later.

Fourth — a co-founder who had shipped an MDR certificate before. The academic team knew the technology. They did not know the regulation as a practitioner. The first hire — and it was a co-founder equity hire, not an advisor — was a person who had been through a full MDR conformity assessment on the operator side at least once. That one person changed the calendar. They knew what a Notified Body review looked like from the inside, what a technical file that passes looks like, what a QMS that works on a five-person team looks like, and which corners are legitimate to cut. The twenty-four-month timeline does not happen without that person in the room every week.

The IP transfer challenge

The IP transfer is the part of this case study that most generalises to other research-led founders, so it deserves its own section.

The university's technology transfer office was not hostile. They were cautious in the way technology transfer offices are trained to be cautious, and their job description pushed them toward terms that protected the university's long-term revenue share rather than terms that made the spinout shippable. The first draft of the transfer agreement had a clause that would have required the company to grant the university a perpetual licence to all "improvements" to the technology. In the regulatory context, "improvements" would have meant every design change, every PMS-driven update, every clinical evaluation refinement — effectively every document in the technical file. That would have been unworkable.

The team negotiated. They pushed back. They explained the regulatory consequences — that under an MDR manufacturer's general obligations in Article 10, the manufacturer controls the design and the technical documentation, and a clause that forced shared ownership of regulatory deliverables with an external institution would have created an unresolvable compliance problem. The university amended the clause. The negotiation took six weeks. It could have taken six months if the team had not had someone in the room who understood the regulatory implications well enough to explain them to a non-regulatory lawyer.

At month nine, the university tried to renegotiate one of the royalty terms. This is the first of the two near-breaks. The team refused. They refused politely and firmly, cited the signed agreement, and moved on. But it took two weeks of emotional bandwidth and legal cost at a moment when the Phase 2 build was at its heaviest. The lesson is not that universities are untrustworthy. The lesson is that IP negotiations do not end when the agreement is signed, and a research-led spinout needs to build the legal budget to hold the line.

The team build

By month three the team had the principal investigator as scientific lead (part-time, still with an academic appointment), one of the senior researchers as full-time CTO, the regulatory co-founder as head of quality and regulatory, and a first engineer hired to bring the prototype from lab-grade to production-grade hardware. Four people. No one was redundant.

The PRRC role was filled by the regulatory co-founder under the in-house arrangement permitted by the MDR. The QMS lead was the same person, which is defensible in a four-person company and would become a separation-of-duties problem if the team grew beyond fifteen without splitting the role.

Clinical leadership came from an outside clinical partner — a senior clinician at one of the three departments that had shaped the intended purpose in week eight. The partnership was formalised as a clinical advisory agreement, not an employment relationship. That partner became the principal investigator of the targeted clinical investigation that filled the last gap in the clinical evaluation, and has since become the first commercial user of the device after CE mark. The relationship that started in month two was still paying back at month thirty.

The 24-month timeline

The calendar ran roughly like this. It is worth seeing the shape of it to understand why it was tight but not impossible.

  • Months 1 to 3 — Foundation. Intended purpose drafted, classification rationale written, IP transfer negotiated and signed, co-founder hired, initial clinical partner relationships established, QMS scope defined.
  • Months 4 to 9 — Phase 1 feasibility and design transfer. Prototype brought to production-grade hardware, design history file started from the first sketch (not retroactively), risk management file opened under EN ISO 14971:2019+A11:2021 and maintained continuously, clinical evaluation plan drafted under Article 61 and Annex XIV, literature search executed.
  • Months 10 to 15 — Phase 2 build. Full technical documentation under Annex II assembled, QMS under EN ISO 13485:2016+A11:2021 made operational with actual procedures the team actually used, usability engineering file built in parallel with design, targeted clinical investigation run with the clinical partner to fill the evidence gaps literature could not cover.
  • Months 16 to 21 — Notified Body engagement. NB contract signed, technical file submitted, audit cycle completed, non-conformities addressed, and the NB capacity slip that is the second near-break.
  • Months 22 to 24 — Issuance, launch prep, and commercial handover. Certificates issued, EU Declaration of Conformity signed, CE mark applied, UDI assignment, first commercial placement scheduled.

The shape of the calendar is only possible because Phase 1 and Phase 2 were clearly separated, Phase 1 was kept lean, and every month of Phase 2 was scheduled in advance against a file structure that was defined before the first document was written.

What nearly broke it

Two moments almost ended the twenty-four-month outcome.

The month-nine IP renegotiation. Described above. Cost two weeks and roughly EUR 15,000 in legal fees. Would have cost three months and possibly the entire project if the team had not held the line.

The month-eighteen Notified Body capacity slip. The NB the team had signed with informed them, six months into the review cycle, that a capacity constraint meant the next review round would slip by three months. The team had a choice: accept the slip, or restructure the file to resolve the open non-conformities in a way that required less NB review time. They chose the second. They rewrote two sections of the technical documentation over ten days to give the NB a tighter, cleaner re-submission that could be reviewed in fewer auditor-days. The slip went from three months to six weeks. It still cost time. It did not kill the project. That choice was only available because the team had a person in the room who understood what the NB review process was measuring and could structure the response to that measurement rather than to a general idea of "more evidence."

Lessons for other research-led founders

The obvious temptation with a case study like this is to copy it. Do not. The twenty-four-month timeline is not a template. It is a specific outcome from a specific combination of device, team, and regulatory context. What does generalise is the decisions that made it possible.

One — take the four foundational decisions before you start the regulatory project. Intended purpose, classification, IP transfer, and at least one person on the founding team who has shipped an MDR certificate. If any of the four is missing when you start, fix it before you move.

Two — negotiate IP transfer with a regulatory eye, not just a business eye. The clauses that look harmless to a technology transfer lawyer can be unshippable in an MDR context. Get someone who understands both sides in the room for the negotiation.

Three — build the technical documentation from your actual processes outward, never from a template pack inward. Templates look like time-savers. They are time-wasters if they bury the team under documents nobody uses. Write the documents you need, for the processes you actually run.

Four — treat Phase 1 and Phase 2 as genuinely separate projects. Phase 1 answers "is this feasible?" Phase 2 builds the MDR file. Mixing them means you build a heavy MDR file around a feature set that still changes, and you pay for every change twice.

Five — plan for the near-breaks. There will be two or three. Budget time, money, and legal capacity for them before they happen. The twenty-four-month calendar had no slack, but it had reserves. It is the difference between a plan that survives contact with reality and a plan that does not.

The Subtract to Ship angle

The twenty-four-month outcome is not the product of doing more. It is the product of doing less of the wrong things and all of the right things. Every document in the technical file traced back to a specific MDR article, annex, or harmonised standard — or to a business model decision the team had already made. Nothing else was written. Nothing else was built. The QMS was as small as the team could defend in front of an auditor and no smaller.

That is the Subtract to Ship discipline applied to a research spinout. The technology was already there — four years of academic work had produced it. The business model was emerging — the clinical partner relationships shaped it. The regulation was the fixed cost of entering the market. The team's job was to pay that fixed cost without adding drag. They did.

Read the Subtract to Ship framework for MDR for the methodology across the whole certification project, and the minimum viable regulatory strategy for the phase-one discipline this team applied in months one to nine.

Reality Check — Where do you stand?

If you are a research-led founder reading this and wondering whether a twenty-four-month outcome is realistic for you, answer these honestly.

  1. Do you have a one-paragraph intended purpose you can defend in front of a clinician and a Notified Body, or is the intended purpose still a moving target?
  2. Do you have a written classification rationale citing the specific Annex VIII rule, or are you still waving at "probably Class IIa"?
  3. Is the IP transfer from the university signed — not drafted, not in negotiation, signed — with terms that leave the manufacturer in sole control of the regulatory deliverables?
  4. Is there at least one person on the founding team who has personally been through an MDR conformity assessment on the manufacturer side, start to finish, at least once?
  5. Do you have at least one clinical partner who has committed to participating in a clinical investigation and who has shaped your intended purpose from real workflow knowledge?
  6. Have you separated Phase 1 feasibility from Phase 2 MDR-compliant build in your plan, with different deliverables and different cost brackets for each?
  7. Have you budgeted legal capacity for the two or three near-breaks the project will have, including an IP renegotiation attempt and a Notified Body capacity slip?
  8. Is your technical documentation plan built from the processes the team will actually run, or from a template pack bought from a vendor?

If more than two of those answers are weak, the twenty-four-month timeline is not realistic for you yet. Fix the weak answers first. The calendar compounds from there.

Frequently Asked Questions

Is twenty-four months from university research to CE mark realistic for most spinouts? No. It is possible and it happens, but it sits at the fast end of the realistic range. A more typical window for a research-led Class IIa device is thirty to forty-two months from a serious start to a CE mark. The twenty-four-month outcome in this case study is the product of four foundational decisions taken in month one that most teams do not take until month nine.

Can a research-led founder really negotiate IP transfer without slowing the regulatory project? The IP transfer must happen before the regulatory project starts. Trying to run them in parallel is one of the most common expensive mistakes in academic spinouts. Six weeks on IP before month four saves six months of rework between month twelve and month eighteen. The regulatory project does not start until the IP is signed.

What role does existing academic literature play in the clinical evaluation under Article 61? For devices whose intended purpose can be matched to published evidence, the clinical evaluation under Article 61 and Annex XIV can lean heavily on literature, supplemented by a targeted investigation to fill specific gaps. The key is that the intended purpose must be written to match the evidence — a shift in intended purpose that disconnects the device from the published literature can force a full clinical investigation and add a year or more to the timeline.

Does Regulation (EU) 2023/607 help a university spinout certifying for the first time? No. Regulation (EU) 2023/607 extended certain transitional provisions for devices that already held valid certificates under the former Directives. It does not create an easier path for a new device being certified for the first time today. A spinout in 2027 builds straight to MDR with no transitional benefit.

Is the co-founder with prior MDR experience really non-negotiable? For a twenty-four-month outcome, yes. A team can ship without that person, but not in twenty-four months. The calendar depends on avoiding the rookie mistakes that every first-time MedTech team makes, and the only reliable way to avoid them is to have someone in the room who has already made them at a previous company.

What happens if the Notified Body capacity slips mid-review? It happens regularly. The team that survives a capacity slip without losing months is the team that can restructure its file to minimise the auditor-days the NB needs for the next review. That is a skill. It is also a reason to pick a Notified Body with realistic capacity for your file before you sign, and to keep the relationship close enough that a slip is communicated early enough to respond to.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, consolidated text. Articles cited: Article 51 classification; Article 52 conformity assessment procedures; Article 61 clinical evaluation; Annex II technical documentation; Annex VIII classification rules. Official Journal L 117, 5.5.2017.
  2. Regulation (EU) 2023/607 of the European Parliament and of the Council of 15 March 2023 amending Regulations (EU) 2017/745 and (EU) 2017/746 as regards the transitional provisions for certain medical devices and in vitro diagnostic medical devices. Official Journal L 80, 20.3.2023.
  3. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes. Harmonised standard for MDR QMS obligations.
  4. EN ISO 14971:2019 + A11:2021 — Medical devices — Application of risk management to medical devices. Harmonised standard for the risk management process referenced across MDR Annex I.
  5. MDCG 2021-24 — Guidance on classification of medical devices, October 2021.

This post is a case study entry in the MedTech Startup Strategy cluster of the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The case is a composite — every identifying detail has been anonymised, and the numbers, decisions, and near-breaks are drawn from real spinouts Tibor has worked with. Read it as a worked example, not a template.