--- title: Fractional CTO, CMO, Regulatory Head: When It Works description: When fractional CTO, CMO, and regulatory head roles make sense for MedTech startups under MDR, and when full-time leadership is non-negotiable. authors: Tibor Zechmeister, Felix Lenhard category: Team Building, Operations & Scaling primary_keyword: fractional CTO CMO regulatory head MedTech canonical_url: https://zechmeister-solutions.com/en/blog/fractional-cto-cmo-regulatory-head source: zechmeister-solutions.com license: All rights reserved. Content may be cited with attribution and a link to the canonical URL. --- # Fractional CTO, CMO, Regulatory Head: When It Works *By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.* > **Fractional leadership works for MedTech startups when the role requires scarce expertise the company cannot yet afford full-time and the workload is genuinely part-time. Under MDR Article 15, the Person Responsible for Regulatory Compliance can be external for micro and small enterprises. But manufacturer obligations under Article 10 never leave the company. Fractional stops working the moment your Notified Body audit date is set.** **By Tibor Zechmeister and Felix Lenhard.** ## TL;DR - MDR Article 15(6) allows micro and small enterprises to have the Person Responsible for Regulatory Compliance (PRRC) available on a permanent and continuous basis via contract rather than employment. - Manufacturer obligations under MDR Article 10 stay with the legal manufacturer regardless of whether leadership is fractional or full-time. - Fractional CTO, CMO, and regulatory head roles make sense pre-revenue, during early technical scoping, and when the workload is honestly under two days per week. - Fractional breaks down during Notified Body Stage 1 and Stage 2 audits, scale-up, and CAPA-heavy periods. These demand daily presence. - Contracts for fractional MedTech leaders must specify availability, document-signing authority, QMS role assignments, and handover triggers. - A fractional PRRC is not a loophole around competence. The qualification requirements in Article 15(1) apply identically to employees and contractors. ## Why this matters A 5-person MedTech startup with eight months of runway cannot afford a EUR 140,000 full-time regulatory head, a EUR 160,000 CTO with embedded software experience, and a EUR 130,000 CMO who understands hospital procurement. But they still need all three competencies to build a safe device, pass a Notified Body audit, and sell it. Fractional leadership. Senior operators who serve multiple companies part-time. Is one of the honest answers to this math. The question is not whether fractional is acceptable. Under MDR Article 15(6), it is explicitly permitted for the PRRC in micro and small enterprises. The question is when it is the right structural choice for your specific moment in the company's life, and when it becomes a liability you cannot see until it is too late. We have watched fractional arrangements work beautifully for 18 months and then fall apart the week before a Stage 2 audit. We have also watched founders burn EUR 300,000 on a full-time regulatory head who was idle for the first year because the product was not mature enough to generate real regulatory work. Both mistakes are expensive. Neither is obvious in advance. ## What MDR actually says Two MDR articles frame this conversation. Confuse them at your peril. **MDR Article 10. General obligations of manufacturers.** Article 10 lists every obligation that rests on the legal manufacturer: establishing a risk management system, performing clinical evaluation, preparing and updating technical documentation, establishing a QMS in accordance with Article 10(9), drawing up the EU declaration of conformity, affixing the CE marking, complying with registration obligations, implementing post-market surveillance, and reporting serious incidents. None of these obligations can be outsourced away from the manufacturer. A fractional CTO does not make the company any less responsible for IEC 62304 conformance. A fractional regulatory head does not shift Article 10(9) QMS responsibility onto the contractor. **MDR Article 15. Person responsible for regulatory compliance.** Article 15(1) requires manufacturers to have at their disposal, within their organisation, at least one PRRC with the requisite expertise: either a diploma in law, medicine, pharmacy, engineering, or another relevant scientific discipline plus one year of professional experience in regulatory affairs or in QMS relating to medical devices, or four years of professional experience in regulatory affairs or QMS relating to medical devices. Article 15(6) then carves out the exception for micro and small enterprises under Commission Recommendation 2003/361/EC: such manufacturers are not required to have the PRRC within their organisation but shall have such a person permanently and continuously at their disposal. This is the legal basis for a fractional PRRC. But only for micro enterprises (fewer than 10 employees, annual turnover or balance sheet under EUR 2 million) and small enterprises (fewer than 50 employees, under EUR 10 million). **What MDR does not say.** MDR says nothing about fractional CTOs or CMOs. Those are commercial arrangements governed only by your own QMS. But your QMS. Built to EN ISO 13485:2016+A11:2021 clauses 5 (management responsibility) and 6.2 (human resources). Must define who holds design authority, who signs off on release, and who represents top management during Notified Body interactions. A fractional CTO who is not in the management review meeting cannot be top management. ## A worked example A founder runs a Class IIa SaMD startup: five people, EUR 1.1 million raised, 14 months of runway, pre-revenue. The product is in late prototype. They are 11 months from a targeted Stage 1 audit with their chosen Notified Body. They hire three fractional leaders: - **Fractional CTO:** two days per week, EUR 3,800/week. Ex-Philips embedded software architect. Sets up the EN 62304 software lifecycle, reviews architecture, signs off on the software development plan and the software safety classification. Trains the two in-house engineers. - **Fractional regulatory head acting as PRRC under MDR Article 15(6):** 1.5 days per week, EUR 2,900/week. 12 years of MedTech RA experience, satisfies Article 15(1) qualification criteria. Contract specifies permanent and continuous availability by phone within four business hours, on-site presence for Notified Body audits and management reviews. - **Fractional CMO:** one day per week, EUR 1,800/week. Builds the hospital go-to-market narrative while the product is still pre-CE. Not touching any regulated material. Total fractional burn: roughly EUR 36,000/month across three senior hats. A comparable full-time trio would cost roughly EUR 45,000–55,000/month loaded. More importantly, none of these three people would have been individually fillable at the quality level they bring at this stage. Seven months later, the company is three months from Stage 2. CAPA load rises. Design freeze creates 40 hours of documentation work per week for the regulatory head. Software bugs found in integration testing need the CTO on-site multiple days in a row. The fractional model strains. The founders convert the regulatory head to four days/week at that point. The CTO stays fractional until week 4 before Stage 2, then comes on-site full-time for six weeks. The CMO stays fractional throughout because the sales motion does not ramp until after CE. This is the pattern: fractional for the setup phase, conversion (partial or full) for the audit and ramp phase, fractional again after steady state. Or not at all, if the company is big enough. ## The Subtract to Ship playbook Treat fractional leadership like a regulated decision, because from a QMS perspective it is one. **1. Decide role by role, not as a philosophy.** "We are a fractional-first company" is not a strategy. CTO, CMO, and regulatory head have different regulatory weight. The regulatory head is explicitly addressable under Article 15(6). The CTO is not mentioned in MDR at all. Their role lives inside your QMS under ISO 13485 clauses 5.5 (responsibility, authority, communication) and 7.3 (design and development). The CMO is entirely commercial unless they touch promotional material subject to MDR Article 7. **2. Verify micro/small enterprise status before assuming Article 15(6) applies.** Count employees, check turnover and balance sheet against Commission Recommendation 2003/361/EC. If you cross the small-enterprise threshold, the external PRRC route closes and you need the person within your organisation. **3. Qualify the fractional PRRC against Article 15(1).** The qualification requirements are identical for employees and contractors. Get CVs, diplomas, and documented evidence of the required professional experience into their personnel file in your QMS. "I trusted them" is not an audit answer. **4. Write a contract that a Notified Body auditor would accept.** At minimum: scope of responsibilities mapped to Article 15(3), response time commitments, on-site presence triggers, confidentiality, document-signing authority, conflict-of-interest disclosure for other clients, handover obligations on termination, and explicit language that the contractor is permanently and continuously at the manufacturer's disposal. **5. Put them in the QMS org chart, the management review, and the training records.** A fractional leader who is invisible in the QMS does not exist to your auditor. Job description under 6.2, competence evidence under 6.2.2, training plan, signature authority matrix. **6. Define your conversion triggers in advance.** Examples: "Within eight weeks of our scheduled Stage 1 audit, fractional regulatory head converts to four days per week minimum." "If CAPA count exceeds five open items, regulatory head availability escalates." Write these triggers down. They protect both sides. **7. Know when fractional stops working.** Red flags: your PRRC is unreachable during business hours; design review decisions are waiting for a contractor who is serving another client; your Notified Body asks "who owns this process?" and the answer is ambiguous; CAPA aging exceeds your QMS thresholds; the fractional CTO has not attended a management review in two quarters. Any one of these means the arrangement has outgrown the contract. **8. Do not use fractional to avoid building competence.** The goal of a fractional regulatory head on day one is partly to do the work and partly to train the first full-time RA hire you will eventually need. Fractional leaders who actively resist knowledge transfer are building dependency, not capacity. ## Reality Check 1. Does your company currently meet the micro or small enterprise thresholds under Commission Recommendation 2003/361/EC, and have you documented that determination? 2. Can you name, today, your PRRC and show documented evidence that they meet the Article 15(1) qualification criteria? 3. Is the PRRC contract explicit that they are permanently and continuously at the manufacturer's disposal in the sense of Article 15(6)? 4. Does your QMS org chart, management review attendance list, and signature authority matrix reflect every fractional leader you rely on? 5. Have you written down the conversion triggers that would shift any fractional role toward full-time? 6. If your Notified Body scheduled a Stage 2 audit for 10 weeks from today, which fractional arrangements would you need to renegotiate before that date? 7. For every Article 10 obligation your company carries, can you point to an individual accountable person. Not a contract. Who owns it? 8. Would your current fractional CTO be available on site within 24 hours for an unannounced audit? ## Frequently Asked Questions **Can a fractional PRRC work for multiple MedTech companies at once?** Yes, and most do. MDR Article 15 does not forbid it. What matters is that the contractor can demonstrate permanent and continuous availability to each manufacturer and that conflicts of interest are managed. Your QMS and their contract should document how conflicts are handled. **Is a fractional CTO acceptable to a Notified Body?** Notified Bodies do not certify your org chart. They certify your QMS and your technical documentation. If the fractional CTO is clearly documented in your QMS as holding the design authority role and is present when needed, there is no rule against it. The problem is usually practical, not regulatory: fractional availability during a 40-hour Stage 2 audit week is very hard. **What happens if my startup grows past the small enterprise threshold?** Article 15(6) stops applying. You must have the PRRC within your organisation. Plan the transition before you hit 50 employees or the turnover ceiling, not after. **Can the same person be fractional CTO and fractional PRRC?** Legally possible but usually a bad idea. PRRC duties under Article 15(3) include ensuring conformity of devices before release and reviewing vigilance obligations. These benefit from independence from design decision-making. Separate the roles unless the company is very early and very small. **Do Article 10 manufacturer obligations transfer to a fractional leader by contract?** No. Article 10 obligations rest on the legal manufacturer as a matter of EU law. You can assign internal responsibility, but you cannot contract the obligation away. The manufacturer remains liable. **When should we stop using fractional regulatory help?** When the honest weekly workload exceeds three days, when CAPA volume becomes unpredictable, or when your Notified Body audit is within 12 weeks. Any of these three is enough. ## Related reading - [PRRC under MDR Article 15](/blog/prrc-mdr-article-15) – the full legal framing of the role - [PRRC options for startups](/blog/prrc-options-startups) – employ, outsource, or train - [PRRC: hiring, outsourcing, or training](/blog/prrc-startup-hiring-outsourcing-training) – decision framework - [MedTech startup team: key roles](/blog/medtech-startup-team-key-roles) – where fractional fits in the full org - [Hiring regulatory affairs at a startup](/blog/hiring-regulatory-affairs-startup) – the transition from fractional to full-time RA ## Sources 1. Regulation (EU) 2017/745 on medical devices, consolidated text. Article 10 (general obligations of manufacturers), Article 15 (person responsible for regulatory compliance), Article 15(1), Article 15(3), Article 15(6). 2. Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises. 3. EN ISO 13485:2016+A11:2021, clauses 5 (management responsibility), 6.2 (human resources), 7.3 (design and development). --- *This post is part of the [Team Building, Operations & Scaling](https://zechmeister-solutions.com/en/blog/category/team-operations) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*