An MDR regulatory roadmap is the ordered sequence of decisions and deliverables that moves a MedTech startup from a drafted intended purpose to a CE certificate and into post-market surveillance. It runs through eight stages: intended purpose stabilization, the four foundational decisions, Phase 1 feasibility, design freeze, Phase 2 MDR-compliant development, Notified Body engagement, CE mark issuance, and ongoing post-market surveillance. Each stage has specific deliverables, an honest duration range, decisions that unblock the next stage, and traps that delay it. This post gives you the template.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • An MDR regulatory roadmap is not a Gantt chart. It is a sequence of gates where each stage is unblocked by a specific decision made in the previous stage.
  • The first gate is a stable intended purpose. Nothing useful happens in the roadmap before this paragraph is written down and has stopped moving.
  • The four foundational decisions — device or not, class, conformity assessment route, Notified Body — come next, in that order, and together they determine almost every downstream cost.
  • Phase 1 (feasibility) and Phase 2 (MDR-compliant development) are separated by a formal design-freeze decision. Skipping Phase 1 produces the Graz over-documentation pattern. Skipping the early stages entirely produces the Vienna bankruptcy pattern.
  • The full roadmap, for a typical startup Class IIa or IIb device, runs 18 to 36 months from stable intended purpose to CE certificate. For Class I self-certified devices, 9 to 18 months is realistic. Anything faster is a fantasy, and anything slower is usually self-inflicted.

Why you need a roadmap, not a wish list

Most startups we meet do not have a regulatory roadmap. They have a wish list. The wish list looks like this: "Get CE mark in twelve months, raise Series A, launch in Germany." That is not a plan. It is a hope with dates attached.

A real roadmap is different. It names each stage, names the deliverables that come out of the stage, names the decision that unlocks the next stage, and names the traps that can stall the stage for months. It is the document you can print, tape to a wall, and hand to an investor who asks "where are you in the process?"

There is a Vienna startup that went bankrupt because they had no roadmap at all. They convinced themselves that MDR did not apply to their product, ignored the regulation, generated revenue, got sued by a competitor, and were ordered to stop selling until they were compliant. When they finally engaged an expert, the device was Class I — the cheapest, fastest path under the MDR. Eighteen months earlier, with a simple roadmap, they could have self-certified and stayed on the market. By the time reality arrived, the runway was gone.

At the other end, there is a Graz-based company that also had no roadmap, but failed in the opposite direction. They decided to document everything to full MDR standards from day one. Six years later, they are still not on the market. The product that could have shipped in 2020 was buried under compliance paperwork that was obsolete almost as fast as it was written, because the underlying design kept changing.

Between these two failure modes — ignore the regulation until it breaks you, or document everything before you know what you are building — sits the roadmap in this post.

Stage 0 — Intended Purpose Stabilization

Duration range: 0 to 60 days from founding, but this is a gate, not a calendar window. The stage ends when the purpose is stable, not when the clock runs out.

Deliverables.

  1. A single paragraph describing the medical condition addressed, the target patient population, the intended user, the clinical benefit, and the setting of use.
  2. A list of every existing claim about the product on the website, in pitch decks, and in any sales material, reconciled against the intended purpose paragraph.
  3. A first-pass yes-or-no judgment on whether the product is likely a medical device under MDR Article 2(1).

Unblock condition. The paragraph has not changed for 60 days. Everyone on the team who matters can defend every word under hostile questioning. The language matches Article 2(12) of Regulation (EU) 2017/745, which defines intended purpose as "the use for which a device is intended according to the data supplied by the manufacturer on the label, in the instructions for use, or in promotional or sales materials or statements, and as specified by the manufacturer in the clinical evaluation."

Traps that delay the stage.

  • Intended-purpose drift that the founder does not notice because it feels like "polishing." Every re-phrasing resets the 60-day clock.
  • Marketing claims on the website that contradict the intended purpose paragraph. If the product page says one thing and the regulatory statement says another, the roadmap cannot start.
  • Trying to finalize intended purpose before you have spoken to any clinicians in the target specialty. This is usually a sign that the purpose is still a guess.

Stage 1 — The Four Foundational Decisions

Duration range: 2 to 8 weeks. With a competent sparring partner and a stable intended purpose, one to two weeks of focused work. Without one, months and frequently wrong.

Deliverables. The four decisions, each documented with the specific MDR article or annex that governs it.

  1. Device or not. A documented determination under MDR Article 2(1) of whether the product is a medical device. If the judgment is close, the MDCG Borderline and Classification Manual (Version 4, September 2025) and expert opinion both go into the file.
  2. Classification. The class of the device under MDR Article 51 and the specific rule from Annex VIII that applies. For software, MDCG 2019-11 Rev.1 is the primary guidance. For anything else, MDCG 2021-24 is the comprehensive reference.
  3. Conformity assessment route. The route under MDR Article 52 and the corresponding annex (Annex IX full QMS and technical documentation assessment, Annex X type examination, Annex XI production quality assurance, or Annex IV self-certification for Class I non-sterile non-measuring non-reusable surgical devices).
  4. Notified Body selection, if one is needed. Not every device needs a Notified Body — Class I self-certified devices do not. Every other class does. NB selection is a strategic decision that affects timeline by months.

Unblock condition. All four decisions are documented, internally consistent, and defensible in front of an auditor. You can state in one sentence: "This device is [class X] under Annex VIII Rule [Y], going through [conformity assessment route Z], with [Notified Body name or 'self-certification']."

Traps that delay the stage.

  • Starting Stage 2 feasibility work in parallel before the class is known. Half the Phase 1 work then has to be redone when the class turns out to be different.
  • Choosing a Notified Body based on price or proximity instead of capacity, communication speed, and scope designation. A well-matched NB has produced first feedback in 2.5 months on real projects. A poorly matched one leaves startups waiting 7 to 10 months.
  • Assuming the classification is "probably Class I" without reading Annex VIII. Hope is not a rule.

Stage 2 — Phase 1 Feasibility

Duration range: Typically 3 to 9 months. Variable by device complexity — simple hardware-software devices can compress this; novel platforms cannot.

Deliverables. Feasibility is about knowledge, not regulatory records. The outputs are:

  • A working prototype or algorithm that demonstrates the core technical claim.
  • Retrospective data analysis, bench testing, or user-workflow observation that proves the concept is worth certifying.
  • Clinician interviews and early conversations with potential clinical partners. Felix's rule: the people who run your clinical investigation are frequently your first paying customers — do not treat them as separate phases.
  • Informal risk analysis, lab notebooks, design decision records. Not a full ISO 14971 file yet, but enough to reconstruct the reasoning in Phase 2.
  • A sharpened intended purpose if feasibility reveals that the original was wrong.

Unblock condition. Feasibility is demonstrated. The core technical claim works on real data or realistic test conditions. The intended purpose is still stable or has been deliberately refined and re-stabilized. You can credibly answer "yes" to the question: "If we froze this design today, would it be worth spending 18 months and several hundred thousand euros to certify?"

Traps that delay the stage.

  • The Graz over-documentation pattern. Documenting every prototype, every iteration, and every bench test to full MDR standards. The company that could have shipped in 2020 is still not on the market in 2026 because every design change dragged an obsolete compliance trail behind it.
  • The inverse trap — never leaving Phase 1. Iteration as a permanent hobby. The founder who loves building and hates documentation can stay here forever.
  • Cutting safety corners. Phase 1 is fast and cheap; it is not a license to test on employees, family members, or friendly clinicians without proper research ethics approval. That line is absolute.

Stage 3 — Design Freeze Decision

Duration range: A single decision, ideally made in a single meeting, after Phase 1 feasibility is complete.

Deliverables.

  1. A written design-freeze statement: this architecture, these components, this intended purpose, this user population, this setting of use — as of this date.
  2. A decision log capturing why these choices and not the alternatives considered.
  3. A change control procedure for every modification from this point forward.

Unblock condition. Feasibility is demonstrated with real data. The intended purpose has stopped changing. The classification and conformity assessment route are clear. The major hazards have been identified at a conceptual level and there is at least a sketch of how to control them. The clinical evaluation strategy has been sketched — literature, equivalence, or new clinical investigation.

Traps that delay the stage.

  • Freezing too early, because "we have a prototype and investors want a plan." A prototype that has only worked in the founder's lab is not a frozen design. Phase 2 on the wrong design is roughly ten times more expensive than the equivalent rework in Phase 1.
  • Freezing too late, because the founder keeps finding one more thing to optimize. At some point, "better" becomes the enemy of "certifiable."
  • Having no one on the team qualified to make the call. The design-freeze judgment is one of the highest-leverage decisions in the whole roadmap and one of the hardest to delegate.

The Salzburg-based SaaS company we have worked alongside is the example of this transition done right. Their algorithms were unproven at the start. They ran a disciplined Phase 1 — retrospective hospital data, validation on the actual target patient population, core technology confirmation — and only then moved to Phase 2. They saved years of wasted documentation on a product that might never have worked.

Stage 4 — Phase 2 MDR-Compliant Development

Duration range: Typically 9 to 24 months. Variable by class, complexity, and team experience. Class I self-certified devices can move faster; Class III devices never will.

Deliverables. The full stack of MDR-compliant records for the specific frozen design.

  1. QMS build. Proportionate to risk class and type of device per MDR Article 10(9), aligned with EN ISO 13485:2016+A11:2021. Every required process, at a depth matching the risk. Nothing more. A PRRC is designated per MDR Article 15 — in-house for larger teams, external under Article 15(2) for micro and small enterprises that qualify.
  2. Risk management file. Per EN ISO 14971:2019+A11:2021, built in parallel with design, not as a retrospective exercise.
  3. Technical documentation per Annex II. Device description, design and manufacturing information, the GSPR checklist against Annex I, benefit-risk analysis, the risk management file, verification and validation evidence.
  4. Clinical evaluation per Article 61 and Annex XIV. Literature review, equivalence argument per MDCG 2020-5 where applicable, or new clinical investigation where nothing else suffices. Under MDR Article 61(4) to (6), certain implantable and Class III devices have specific rules on when mandatory pre-market clinical investigations can be exempted — MDCG 2023-7 is the reference.
  5. GSPR compliance per Annex I. A line-by-line justification for every applicable general safety and performance requirement, backed by standards, test reports, or documented rationale.
  6. PMS system per Article 83 and Annex III. The post-market surveillance plan, the PMS system itself, and the PMS technical documentation. MDCG 2025-10 (December 2025) describes what this looks like in practice.

Unblock condition. The technical documentation package is internally consistent, internally audited, and ready for Notified Body submission (or, for self-certified Class I devices, ready for the manufacturer's own declaration of conformity). No loose ends. No "we will fix that later" items.

Traps that delay the stage.

  • Over-scoping the QMS. "Proportionate" in Article 10(9) does not mean "as large as the consultant suggests." It means every required process covered at a depth that matches the device risk.
  • Template-driven documentation. A QMS or technical file built by buying templates and replacing the company name is not compliance. It is theatre, and it falls apart at audit.
  • Parallel clinical evidence paths that duplicate each other. One well-documented literature review plus equivalence argument beats three parallel chains that confuse the auditor.
  • Website marketing claims that exceed the technical file. If the website claims something the evidence does not support, every one of those claims becomes a non-conformity at audit.

Stage 5 — Notified Body Engagement

Duration range: 3 to 12 months for Notified Body review of a well-prepared submission. Longer for incomplete submissions. Not applicable for Class I self-certified devices.

Deliverables.

  1. A complete submission package matching the Notified Body's specific format requirements.
  2. Responses to Notified Body questions, typically in several rounds.
  3. On-site audit of the QMS and, depending on the route, of manufacturing.
  4. Closure of any non-conformities raised during the audit.

Unblock condition. The Notified Body issues the certificate of conformity under MDR Article 56, with the specific conformity assessment route and annex referenced.

Traps that delay the stage.

  • Starting the NB engagement with an incomplete technical file and hoping to finish it during review. NB questions compound; every gap produces additional rounds.
  • Choosing an NB with no capacity in your device category. Scope designation matters. An NB that is not designated for your device cannot certify it, regardless of their willingness.
  • Poor communication discipline on the manufacturer's side. Auditors are not policing — they are evaluating a submission. Delayed responses, incomplete answers, and defensive posturing all extend the stage.

Stage 6 — CE Mark Issued

Duration range: A moment in time, not a stage with duration. But it is worth naming as a discrete stage because several deliverables come due simultaneously.

Deliverables.

  1. The CE certificate under MDR Article 56 (for devices requiring NB involvement) or the manufacturer's declaration of conformity (for Class I self-certified devices).
  2. Affixing of the CE marking to the device per MDR Article 5 and the conformity marking rules.
  3. Registration of the device and the manufacturer in EUDAMED per MDR Article 29 and the Commission Implementing Regulation (EU) 2021/2078, to the extent that the relevant EUDAMED modules are mandatory at the time of placing on the market.
  4. Updating the manufacturer's website, labeling, and instructions for use to reflect the certified status.

Unblock condition. The device may be placed on the market under MDR Article 5. "Placed on the market" is a legal term with a specific meaning — it applies to the first making available of a device on the EU market, and it is a trap for founders who think demo units or early shipments do not count. They do.

Traps at this stage.

  • Assuming CE mark equals market success. It does not. The device is now permitted to be sold. Whether anyone will buy it, whether reimbursement is in place, whether the distribution channel exists — none of that is guaranteed by the certificate.
  • Delays between certificate issuance and registration obligations. The clock starts on several post-market obligations at the moment of placing on the market, not at some later convenient date.

Stage 7 — Post-Market Surveillance, ongoing

Duration range: Forever. PMS is not a stage that ends.

Deliverables.

  1. The PMS system running continuously per MDR Article 83.
  2. PMS data collection, analysis, and assessment feeding back into the risk management file and clinical evaluation.
  3. Periodic safety update reports (PSURs) for Class IIa, IIb, and III devices per MDR Articles 85 and 86, at the frequencies specified.
  4. Post-market clinical follow-up per Annex XIV Part B.
  5. Vigilance reporting for serious incidents and field safety corrective actions per Articles 87 to 92.
  6. Updates to technical documentation and clinical evaluation based on PMS findings.

Unblock condition. None — this stage runs for the life of the device on the market. The question is never "are we done?" but "is the PMS system actually running, or only existing in a binder?"

Traps.

  • A PMS system that exists on paper but is never used. This is the most common non-conformity at surveillance audits.
  • Website or marketing claim drift over time. Every new marketing message is a potential scope change to the intended purpose. Every scope change has implications for the technical file.
  • Missing the signal in user feedback. There is a sleep device whose arm strap caused skin irritation that never showed up in lab testing. PMS caught it only after users got hurt. That is exactly what PMS is for — and it only works if someone is actually reading the data.

The whole timeline at a glance

Stage What it produces Typical duration Unblock condition
0 — Intended Purpose Stabilization Stable one-paragraph intended purpose 0 to 60 days (gate) Paragraph unchanged for 60 days
1 — Four Foundational Decisions Device or not, class, route, NB 2 to 8 weeks All four decisions documented and consistent
2 — Phase 1 Feasibility Working prototype, clinical partner conversations 3 to 9 months Core technical claim proven
3 — Design Freeze Decision Written design-freeze statement A single meeting Feasibility + stable purpose + known class
4 — Phase 2 MDR-Compliant Development QMS, risk file, Annex II tech doc, clinical evaluation, PMS plan 9 to 24 months Submission package complete and internally audited
5 — Notified Body Engagement NB questions answered, audit closed 3 to 12 months Certificate of conformity under Article 56
6 — CE Mark Issued CE certificate, declaration of conformity, EUDAMED registration A moment Device may be placed on the market under Article 5
7 — Post-Market Surveillance PMS reports, vigilance, PMCF Ongoing Never ends

For a typical Class IIa or IIb startup device, the total from stable intended purpose to CE certificate runs roughly 18 to 36 months. For Class I self-certified devices, 9 to 18 months is realistic. Any founder claiming two months has either never done it or is about to find out they cannot.

The Subtract to Ship angle

The roadmap above is already the lean version. Every stage has been stripped to the activities that actually trace back to specific MDR obligations. The test applies at every gate: can every deliverable in this stage be defended by pointing to a specific article, annex, or harmonised standard requirement? If not, cut it.

Subtraction in the roadmap context usually means two things. First, not starting the next stage until the current stage is genuinely unblocked — resisting the temptation to run Stage 4 activities while Stage 1 decisions are still in flux. Second, cutting activities inside each stage that are "audit best practice" according to some consultant but have no traceable MDR requirement behind them.

The roadmap also has a shape that rewards patience at the start and speed later. The first two stages are small in calendar terms but enormous in leverage. Getting them right compresses everything downstream. Getting them wrong expands everything downstream. Founders who rush Stages 0 and 1 to "get building" almost always pay for it ten times over in Stage 4.

Reality Check — Where do you stand?

  1. Can you name which stage of this roadmap you are currently in — without ambiguity, without "a bit of both"?
  2. Can you state your intended purpose in one paragraph from memory?
  3. Have you documented the four foundational decisions, with the specific MDR article for each?
  4. If you are in Phase 1, do you have a written definition of what "feasibility demonstrated" means for your device, so you know when to leave the stage?
  5. If you are in Phase 2, can every document in your technical file be traced to a specific MDR or standards requirement?
  6. Do you have a written design-freeze statement, or are you still changing the design while building the technical file?
  7. If a Notified Body asked to see your PMS plan tomorrow, would it be a real plan or a placeholder?
  8. What is the single most expensive decision you have made in the last six months that could have been avoided with a clearer roadmap?

Frequently Asked Questions

How long is a realistic MDR regulatory roadmap for a startup? For a typical Class IIa or IIb device, 18 to 36 months from stable intended purpose to CE certificate. For Class I self-certified devices, 9 to 18 months. The total depends heavily on the four foundational decisions being made correctly at the start and on whether the company runs a disciplined Phase 1 before Phase 2. Any timeline claim under 9 months for a Notified Body route is not credible.

Can I start Phase 2 before the four foundational decisions are made? You can, and founders do all the time, and it is almost always wasted effort. The QMS scope, the technical file structure, and the clinical evaluation strategy all depend on the class and the conformity assessment route. Starting Phase 2 before Stage 1 is complete produces documentation against a moving target. That is the Graz over-documentation pattern.

Do I need a Notified Body for every MDR device? No. Class I non-sterile, non-measuring, non-reusable surgical devices go through self-certification under MDR Article 52(7) and Annex IV. Every other class requires a Notified Body. The class is determined by MDR Article 51 and Annex VIII. If you do not know your class with confidence, you cannot answer this question.

What is the single biggest roadmap mistake founders make? Treating the roadmap as a calendar instead of a sequence of gates. Founders commit to "CE mark in 12 months" without having made the four foundational decisions, without a stable intended purpose, and without understanding that Phase 1 feasibility is a prerequisite, not an optional step. The result is missed deadlines, investor trust broken, and months of rework.

What does a post-market surveillance system actually look like for a small startup? For a Class I startup, a minimal PMS system that actually runs — trend analysis of complaints and user feedback, periodic review against the risk management file, documented conclusions — beats an elaborate system that exists only in the binder. MDCG 2025-10 (December 2025) describes the expected components. "Proportionate" is the keyword: the PMS should match the risk class and the device type, not the ambition of the consultant who designed it.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 2(1) (definition of medical device), Article 2(12) (intended purpose), Article 5 (placing on the market), Article 10 (general obligations of manufacturers, including 10(9) on QMS), Article 15 (PRRC), Article 51 (classification), Article 52 (conformity assessment procedures), Article 56 (certificates of conformity), Article 61 (clinical evaluation), Article 83 (post-market surveillance system), Annex I (general safety and performance requirements), Annex II (technical documentation), Annex III (technical documentation on post-market surveillance), Annex IV (EU declaration of conformity), Annex VIII (classification rules), Annex IX (full QMS and technical documentation conformity assessment), Annex XIV (clinical evaluation and post-market clinical follow-up). Official Journal L 117, 5.5.2017.
  2. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes.
  3. EN ISO 14971:2019 + A11:2021 — Medical devices — Application of risk management to medical devices.
  4. MDCG 2019-11 Rev.1 (June 2025) — Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 — MDR and Regulation (EU) 2017/746 — IVDR.
  5. MDCG 2021-24 — Guidance on classification of medical devices, October 2021.
  6. MDCG 2025-10 — Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices, December 2025.
  7. Borderline and Classification Manual, Version 4, September 2025 — Manual on borderline and classification for medical devices under Regulation (EU) 2017/745.
  8. Commission Implementing Regulation (EU) 2021/2078 of 26 November 2021 laying down rules for the application of Regulation (EU) 2017/745 as regards the European Database on Medical Devices (Eudamed).

This post is part of the MDR Fundamentals & Regulatory Strategy series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. If you are building your first regulatory roadmap and want a second pair of eyes on the four foundational decisions before you commit to a timeline, Zechmeister Strategic Solutions works with founders on exactly that gate.