The complete MedTech startup playbook for 2027 is a ten-stage path from idea to CE marking under Regulation (EU) 2017/745, sequenced so that each stage produces the decision, deliverable, and evidence the next stage depends on. The stages are: Idea, Product-Market Fit, Intended Purpose, Classification, Team and Funding, Phase 1 Feasibility, Phase 2 MDR-Compliant Build, Conformity Assessment, CE Mark and Launch, and Post-Market Operations. A realistic window from a serious start to a CE mark is eighteen to thirty-six months, at a cost bracket of roughly EUR 150,000 to over EUR 500,000 for anything above non-measuring, non-sterile Class I. The playbook works because it separates what you can do cheaply and early from what you can only do once and must get right.

By Felix Lenhard and Tibor Zechmeister. Last updated 10 April 2026.

TL;DR

  • The path from idea to CE mark under Regulation (EU) 2017/745 has ten distinct stages. Each stage has its own decisions, deliverables, time window, and cost bracket, and each stage depends on the output of the one before it.
  • Intended purpose under Article 2(12) is the single highest-leverage decision in the playbook. A sharp intended purpose written early saves months of rework and can move a device into or out of scope of the regulation entirely.
  • Classification under Article 51 and Annex VIII drives everything downstream: the conformity assessment route under Article 52, the Notified Body involvement, the clinical evidence standard under Article 61, and the cost bracket.
  • Phase 1 is about feasibility — market, clinical, technical, financial — and should be run with the lightest possible regulatory footprint. Phase 2 is the MDR-compliant build, where the full QMS under Article 10(9) and the technical documentation under Annex II are assembled.
  • A realistic time window from a serious Phase 2 start to a CE mark is twelve to twenty-four months on top of a six to twelve month Phase 1. The cost bracket for anything above non-measuring, non-sterile Class I runs from roughly EUR 150,000 to well over EUR 500,000.
  • Regulation (EU) 2023/607 extended certain transitional provisions for legacy Directive devices, but it does not change the obligations for a new device being certified today. A startup in 2027 builds straight to MDR, not to a transitional path.
  • Post-market surveillance under Article 83 is not a post-launch afterthought. It is designed in during Phase 2 and runs from the day the device is placed on the market, for as long as the device is on the market.
  • The companies that ship on budget are the ones that subtract ruthlessly. The companies that stall are the ones that treat every possible document as mandatory and every possible feature as essential.

The reason a stage-by-stage playbook exists at all

A founder Tibor met in Munich years ago described his first look at MDR as seeing the iceberg for the first time. He had thought he was working on a project with a defined scope and a defined timeline. Then he saw how far the regulation reached, how many sub-disciplines it pulled in, how many documents it required, and how many decisions he had already made wrong without knowing it. The scale was not the problem. The lack of a map was.

A stage-by-stage playbook is the map. It is not a promise that the path is easy. It is a promise that the path is navigable if you take the decisions in the right order, with the right evidence, at the right cost. The mistake most first-time MedTech founders make is not that they work too little. They work enormously. The mistake is that they work on stage seven while stage two is still unresolved, and all the work downstream has to be redone when the earlier decision finally gets made properly.

This post walks the ten stages in order, with the decisions, deliverables, duration, and cost bracket for each. It is a synthesis, not a deep dive into any one stage — each stage has its own dedicated posts linked at the end.

Stage 0 — Idea

Decision: Is this a medical device at all, and is it one you want to spend ten thousand hours on?

Deliverable: A one-page description of the clinical problem, the proposed solution, the patient population, and the clinical setting. Plus an honest answer to whether the founding team is prepared for a multi-year regulated project.

Duration: Days to weeks. This is not a stage where spending a year is a virtue.

Cost bracket: Near zero. Your own time.

Stage 0 is where founders should ask the questions that do not get cheaper later. Is the problem real? Is it worth a decade of your working life? Do you understand what MedTech is as a business, not just as an engineering exercise? Felix has a line he uses with founders at this stage — "choose projects worth spending 10,000 hours on" — because the real cost of getting this wrong is not money, it is years.

The common failure at Stage 0 is to confuse enthusiasm with commitment. Enthusiasm passes. A MedTech project is long, capital-intensive, and slow in ways that burn out founders who arrived expecting a software-style iteration cycle. Before you spend a euro on the regulatory project, be honest about whether this is the problem you want to live with until 2035.

Stage 1 — Product-Market Fit

Decision: Is there a buyer, a user, and a beneficiary, and does the economics work?

Deliverable: A PMF case with named hospital buyers, named clinicians, a quantified 10-20x improvement on a metric the buyer counts, and a financial model built on real conversations rather than slide-deck TAM.

Duration: Three to six months, run in parallel with Stage 2 and Stage 3.

Cost bracket: EUR 10,000 to EUR 50,000 — mostly travel, conferences, and founder time.

PMF in MedTech is not the same problem as PMF in SaaS. You cannot hand an uncertified device to a patient and iterate. What you can do is verify the market — the clinical problem, the hospital buying unit, the clinician workflow, the patient benefit, and the willingness to pay — before the regulatory money starts flowing. The detail on this sits in product-market fit for MedTech startups, which is the hub for this cluster.

The rule that makes Stage 1 possible is the one Felix repeats most often to founders: you cannot test the technology with end users before certification, but you can absolutely verify the market before you spend a euro on certification. Market verification runs on conversations, shadowing, clinical partners, and honest financial models. That is the work of Stage 1.

The common failure at this stage is to declare PMF on doctor enthusiasm alone, without ever asking a hospital procurement team whether the budget exists or a clinician to actually walk you through the workflow the device will enter. Doctor enthusiasm is a signal. It is not PMF.

Stage 2 — Intended Purpose

Decision: What, exactly, does the device do, for whom, in what setting, with what clinical benefit?

Deliverable: A one-paragraph intended purpose under Article 2(12) that is specific enough to classify, defensible in front of a clinician, and stable enough that the rest of the project can be built on it. (Regulation (EU) 2017/745, Article 2, paragraph 12.)

Duration: Weeks, but it sits under review through Stage 1 until the market verification is firm.

Cost bracket: Near zero in direct cost. Enormous in consequences if it is wrong.

Intended purpose is the single highest-leverage decision in the entire playbook. It is defined in Article 2(12) as "the use for which a device is intended according to the data supplied by the manufacturer on the label, in the instructions for use, or in promotional or sales materials or statements, and as specified by the manufacturer in the clinical evaluation." (Regulation (EU) 2017/745, Article 2, paragraph 12.) That one sentence drives classification, clinical evaluation scope, labelling, the Notified Body scope, and every claim you will ever be legally allowed to make.

Tibor once worked with a Graz startup that spent months building toward a wellness product, only to realise that the claims they genuinely wanted to make were medical claims in the eyes of the regulation. They had to pivot either the claims or the regulatory pathway. They pivoted the claims, rewrote the positioning to stay out of scope of the MDR under Article 2(1), and shipped the wellness product. The underlying lesson is the one Tibor uses as the flagship example for intended purpose work: a few words on the label can mean the difference between a year of wellness launch and five years of MDR certification.

The failure mode is writing a fuzzy intended purpose early and adjusting it as you learn. Every adjustment ripples through classification, clinical evaluation, and the technical file. Write it late, write it sharp, and defend it.

Stage 3 — Classification

Decision: What class does the device fall into under Article 51 and Annex VIII?

Deliverable: A classification rationale — a short document that names the rule from Annex VIII you are applying, the interpretation you are using, and the class you are claiming. For software, this means applying Rule 11. (Regulation (EU) 2017/745, Article 51 and Annex VIII; MDCG 2021-24; MDCG 2019-11 Rev.1.)

Duration: Days once intended purpose is stable.

Cost bracket: Near zero if done internally with competent review. EUR 2,000 to EUR 10,000 for an external classification opinion if the case is ambiguous.

Classification sits right after intended purpose because it depends entirely on it, and everything downstream depends on it in turn. A Class I non-measuring, non-sterile device can be self-certified by the manufacturer under Article 52. Anything above that — Class I sterile, Class I with measuring function, Class Is, Class Im, Class Ir, Class IIa, Class IIb, Class III — requires a Notified Body under Article 52 for the applicable conformity assessment route. (Regulation (EU) 2017/745, Article 52.) For software, Rule 11 governs the classification of software intended to provide information used to make decisions for diagnostic or therapeutic purposes, and most SaMD lands in Class IIa or higher. (Annex VIII, Rule 11; MDCG 2019-11 Rev.1.)

The decision here has cost consequences measured in hundreds of thousands of euros and years of calendar time. Misclassify low and you will be caught — by a competitor, by an auditor, or by an authority. Misclassify high and you pay for work that was not required. The right approach is to apply the classification rules honestly, document the reasoning, and have it reviewed by someone who has seen how Notified Bodies treat the borderline.

Stage 4 — Team and Funding

Decision: Who is on the team by name, what roles are filled, and how is the project funded through at least the next two stages?

Deliverable: A team with a named Person Responsible for Regulatory Compliance (PRRC) arrangement under Article 15, a quality lead, clinical and engineering leads, and a funding runway that covers Phase 1 plus a credible path to Phase 2 funding. (Regulation (EU) 2017/745, Article 15.)

Duration: Three to six months, overlapping Stages 1 and 2.

Cost bracket: The funding itself runs from EUR 200,000 to several million depending on the device. Direct costs at this stage are recruiting and legal.

Article 15 requires manufacturers to have permanently and continuously at their disposal at least one Person Responsible for Regulatory Compliance, with the qualifications and duties set out in the article. Small startups can use the options Article 15 permits — including the ability to have a PRRC at their disposal rather than in-house under defined conditions — but the obligation itself is real from the moment you place a device on the market, and the person has to exist before that day. Founders often leave PRRC to the last minute and then discover the options available to them are narrower than they hoped. The PRRC options for startups covers the detail.

Funding decisions at this stage are where more MedTech startups die than at any other point. A Vienna founder Tibor met went bankrupt because the regulatory work would have been tractable if started early and catastrophic once postponed. Felix has a rule of thumb he hands founders when they ask for a time and cost estimate: "estimate real investment and time, then double it." That rule is not cynicism. It is the outcome of watching dozens of founders underestimate both by a factor of two, consistently.

Budget tiers by class, as a rough guide: - Class I non-measuring, non-sterile: EUR 30,000 to EUR 80,000 end-to-end. - Class I sterile, measuring, or reusable surgical: EUR 100,000 to EUR 250,000. - Class IIa: EUR 150,000 to EUR 350,000. - Class IIb: EUR 250,000 to EUR 500,000. - Class III: EUR 500,000 upward, often well upward.

These are the direct regulatory and certification costs — QMS build, technical documentation, clinical evaluation, Notified Body fees, usability engineering, risk management, cybersecurity where applicable. They do not include product development or commercial launch.

Stage 5 — Phase 1: Feasibility

Decision: Is this feasible technically, clinically, and commercially, and what does the device actually need to do?

Deliverable: A working prototype, clinical partner commitments, a feasibility-grade clinical rationale, a provisional risk assessment, and a financial model that survives Stage 6.

Duration: Six to twelve months.

Cost bracket: EUR 50,000 to EUR 300,000 depending on the device.

Phase 1 is the feasibility phase. The goal is to answer the hard questions before the regulatory budget is fully committed. A Salzburg SaaS company Tibor worked with is the cleanest example of this done right — they proved feasibility first, built clinical partner relationships, and only then committed to the full MDR-compliant build. They shipped. A contrasting Graz company started building MDR-compliant from day one, over-documented everything before the device was even stable, and was still not on the market years after the Salzburg team had shipped. Same regulation. Different sequencing. Radically different outcomes.

Phase 1 is where the Subtract to Ship discipline earns its name. Every activity in Phase 1 should either reduce a feasibility risk or produce evidence for Phase 2. Activities that do neither are drag. The two-phase development approach and the minimum viable regulatory strategy cover the mechanics of keeping Phase 1 lean without compromising the Phase 2 build.

Stage 6 — Phase 2: The MDR-Compliant Build

Decision: You are committing to the full certification project. What does the file look like?

Deliverable: The Quality Management System under Article 10(9) and EN ISO 13485:2016+A11:2021; the technical documentation under Annex II; the risk management file under EN ISO 14971:2019+A11:2021 mapping to the general safety and performance requirements of Annex I; the clinical evaluation under Article 61 and Annex XIV; usability and software lifecycle files as applicable. (Regulation (EU) 2017/745, Article 10 and Annex II; Annex I; Article 61 and Annex XIV; EN ISO 13485:2016+A11:2021; EN ISO 14971:2019+A11:2021.)

Duration: Twelve to twenty-four months.

Cost bracket: The bulk of the budget tiers from Stage 4.

Phase 2 is where the heavy deliverables are assembled. The general obligations of the manufacturer under Article 10 include operating a QMS (Article 10(9)) and compiling technical documentation in accordance with Annexes II and III. The GSPR in Annex I are met through a combination of design, risk management to EN ISO 14971, and the application of harmonised standards where they exist. The clinical evaluation runs as a continuous process under Article 61, documented according to Annex XIV. All of it lives inside the QMS and is assessed by the Notified Body (for devices above Class I non-measuring, non-sterile) during Stage 7.

The failure mode here is over-building. A Berlin company Tibor audited had bought a "complete MDR template pack" and was sitting on several hundred documents that looked impressive but corresponded to none of their actual processes. The QMS was effectively unusable because almost nothing in it had been customised to how the team actually worked. Templates are starting points, not solutions. A three-person team in Lower Austria passed a full NB audit with zero non-conformities on a radically leaner QMS because every document corresponded to something the team actually did. Less paper, more discipline, better outcome.

Stage 7 — Conformity Assessment

Decision: Which Notified Body, which conformity assessment route, and on what timeline?

Deliverable: A signed contract with a designated Notified Body (for applicable classes), a submitted technical file, and a completed audit cycle leading to the issuance of certificates. (Regulation (EU) 2017/745, Article 52.)

Duration: Six to eighteen months from contract to certificate, heavily dependent on NB capacity and file quality.

Cost bracket: Notified Body fees typically EUR 30,000 to EUR 150,000+ depending on class, device complexity, and audit days. Included in the Stage 4 budget tiers.

Notified Body selection is not administrative. It is a strategic decision that can change the timeline by six months or more. A Graz startup working on a breath-sample device cut its feedback cycle from seven-to-ten months at one NB to roughly two and a half months at another, by choosing an NB with matching scope, realistic capacity, and a working relationship with early-stage companies. Same file. Same regulation. Different Notified Body, different outcome. How to choose the right Notified Body covers the selection criteria in detail.

Stage 7 is where the quality of the Phase 2 build shows. A technical file that is well-structured, cross-referenced, and honest survives review with minor non-conformities. A file that is a "treasure hunt" — where the evidence is in there somewhere but the auditor has to dig for it — gets non-conformities that add months. Structure beats volume. Every time.

Stage 8 — CE Mark and Launch

Decision: You are placing the device on the market. What must be true on that day?

Deliverable: The EU Declaration of Conformity, the CE mark applied to the device in accordance with Article 20, UDI assignment, Eudamed registration as available, and a commercial launch plan aligned with reimbursement and distribution.

Duration: Weeks between certificate issuance and first commercial placement.

Cost bracket: Commercial launch costs are beyond the regulatory budget — distribution, clinical education, conferences, reimbursement groundwork.

CE marking under Article 5 means no device can be placed on the market or put into service unless it complies with the Regulation. (Regulation (EU) 2017/745, Article 5.) A CE mark is not a quality seal the market recognises as a sales argument. It is a permission to sell. The difference matters because founders sometimes treat CE as the finish line. It is the starting line of the commercial project. A Graz SaaS company Tibor worked with passed MDR cleanly and then discovered their reimbursement story did not exist — the device worked, the certificate was valid, and the economics did not. Plan for reimbursement and commercial launch during Stage 1, not after Stage 8. Reimbursement for MedTech startups is the starting point for that work.

Stage 9 — Post-Market Operations

Decision: How is the device monitored, maintained, and updated across its life on the market?

Deliverable: A functioning post-market surveillance system under Article 83, a PMS plan and periodic PMS documentation under Articles 84-86, a vigilance reporting process under Articles 87-92, and change control that preserves certification. (Regulation (EU) 2017/745, Articles 83 to 92; MDCG 2025-10.)

Duration: For as long as the device is on the market.

Cost bracket: Ongoing operational cost — typically 10-20% of annual revenue at early stage, scaling down at maturity.

PMS is not an afterthought. Article 83 requires each manufacturer to plan, establish, document, implement, maintain, and update a post-market surveillance system proportionate to the risk class and appropriate for the type of device. That system is designed during Phase 2, initialised at launch, and never stops. A sleep-monitoring device Tibor worked with had passed every laboratory biocompatibility test, went to market, and then started producing real skin reactions in real users — the lab conditions had not captured what long wear on different skin types would do. PMS caught it. PMS exists because lab testing is not the real world, and the real world is the only place some safety signals ever appear.

The Subtract to Ship angle on the playbook

The playbook is a map of the stages. Subtract to Ship is the discipline inside each stage. At every stage, for every activity, ask two questions: does this trace back to a specific MDR article, annex, or harmonised standard? Or does this trace back to the business model? If the answer to both is no, it is drag and it comes out. If the answer to either is yes, it stays and it earns its budget.

The companies that ship on time and on budget are the ones that apply that test ruthlessly. The companies that stall are the ones that treat every possible document as mandatory, every possible feature as essential, and every possible audit finding as a sign that more paperwork is needed. More paperwork is almost never the answer. Sharper paperwork is.

Read the Subtract to Ship framework for MDR for the full methodology across the whole project, and the MDR regulatory roadmap for startups for the sequenced view of the regulatory work alone.

Reality Check — Where do you stand?

Answer honestly. Count the weak answers. If you have more than three, you are not ready to start Phase 2.

  1. Can you state in one paragraph what the device does, for whom, in what clinical setting, with what benefit, in a form a clinician would sign and a Notified Body would accept?
  2. Can you name the Annex VIII rule your device falls under and defend the class you are claiming with written reasoning?
  3. Do you have at least three named hospital buyers who have told you the budget exists for a device like this at a price you can deliver it?
  4. Do you have at least one clinical partner who has verbally committed to participating in a clinical investigation when you have a device ready?
  5. Is your financial model built on real numbers from real buyer conversations, not aspirational pricing from a slide deck?
  6. Do you have a funded runway that covers Phase 1 plus a credible path to Phase 2 funding, with the Stage 4 budget tier for your class applied honestly?
  7. Have you identified who will act as PRRC under Article 15, either in-house or under the options the article permits?
  8. Have you chosen a Notified Body (if applicable) based on scope match, capacity, and working relationships with early-stage companies, rather than the first one that replied?
  9. Is your QMS being built from the team's actual processes out, or from a template pack downward? Can every procedure name the person who follows it?
  10. Have you designed the PMS plan during Phase 2, or are you planning to figure it out after the CE mark lands?
  11. Have you budgeted for reimbursement groundwork and commercial launch separately from the regulatory budget, or are you assuming the certificate will sell the device?
  12. If you were told tomorrow that the project will cost double and take a year longer, would the business model still work?

Frequently Asked Questions

How long does it take to go from idea to CE mark for a MedTech startup in 2027? A realistic total window is eighteen to thirty-six months for anything above non-measuring, non-sterile Class I — roughly six to twelve months of Phase 1 feasibility followed by twelve to twenty-four months of Phase 2 build and conformity assessment. Class III devices and devices requiring large clinical investigations routinely take longer. Any founder who hears "two months" from a vendor or an online source is being misled — that timeline does not exist for any non-trivial device class.

How much does MDR certification cost for a startup? For anything above non-measuring, non-sterile Class I, the direct regulatory and certification cost bracket runs from roughly EUR 150,000 to well over EUR 500,000. The split is roughly QMS build, technical documentation, clinical evaluation, Notified Body fees, usability, risk management, and cybersecurity where applicable. Product development and commercial launch sit on top of that. Felix's working rule: estimate honestly and then double it.

Does Regulation (EU) 2023/607 affect a new startup in 2027? Regulation (EU) 2023/607 extended certain transitional provisions for devices that had valid certificates under the former Directives, subject to conditions. It does not create a new or easier path for devices being certified for the first time today. A startup in 2027 builds straight to MDR with no transitional benefit. (Regulation (EU) 2023/607.)

What is the single most important decision in the playbook? Intended purpose, defined under Article 2(12). Every downstream decision — classification, clinical evaluation scope, Notified Body scope, the technical file, the claims the device can make — depends on it. A sharp intended purpose written after real market verification saves months of rework. A fuzzy one written early creates cascading costs at every later stage.

Can a first-time founder navigate MDR without external help? For Class I non-measuring, non-sterile devices, yes, with discipline and the right reading. For anything above that, the question is not whether you can do the work yourself but whether doing it alone is the fastest and cheapest path to a certificate. Founders who try to do Class IIa and above alone usually end up paying more in wasted time and rework than they would have paid for competent regulatory partnership from Stage 2.

When in the playbook should I start talking to Notified Bodies? Talk to them during Stage 5 (Phase 1 feasibility). Signing with them happens in Stage 6 or Stage 7. Starting conversations late is one of the most common unforced errors — NBs have capacity constraints, and six months of slippage at the booking stage adds six months to your launch regardless of how ready your file is.

What does "subtract to ship" mean in the context of this playbook? It means every activity, every document, every feature, and every process must earn its place by tracing back to a specific MDR article, annex, or harmonised standard — or to the business model. Anything that cannot trace back to one of those is drag and comes out. The playbook gives you the stages. Subtract to Ship gives you the discipline inside each stage.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, consolidated text. Articles cited: Article 2(1) definition of medical device; Article 2(12) intended purpose; Article 5 placing on the market and putting into service; Article 10 general obligations of manufacturers; Article 15 Person Responsible for Regulatory Compliance; Article 51 classification; Article 52 conformity assessment procedures; Article 61 clinical evaluation; Article 83 post-market surveillance system of the manufacturer; Annex I general safety and performance requirements; Annex II technical documentation; Annex VIII classification rules; Annex XIV clinical evaluation and post-market clinical follow-up. Official Journal L 117, 5.5.2017.
  2. Regulation (EU) 2023/607 of the European Parliament and of the Council of 15 March 2023 amending Regulations (EU) 2017/745 and (EU) 2017/746 as regards the transitional provisions for certain medical devices and in vitro diagnostic medical devices. Official Journal L 80, 20.3.2023.
  3. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes. Harmonised standard providing presumption of conformity with MDR QMS obligations.
  4. EN ISO 14971:2019 + A11:2021 — Medical devices — Application of risk management to medical devices. Harmonised standard for the risk management process required across MDR Annex I.
  5. MDCG 2021-24 — Guidance on classification of medical devices, October 2021.
  6. MDCG 2019-11 Rev.1 — Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 — MDR and Regulation (EU) 2017/746 — IVDR, October 2019, revised June 2025.
  7. MDCG 2025-10 — Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices, December 2025.

This post is a synthesis entry in the MedTech Startup Strategy cluster of the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. Read it as a map, then work through the linked posts for the depth on each stage. The playbook is the path. Subtract to Ship is how you walk it without burning runway on drag.