A MedTech startup budget has to treat regulatory work as a core cost category from the first version of the financial model, not as a line item bolted on after the product plan is already set. For a typical Class IIa software device the honest planning range is EUR 200,000 to EUR 500,000 in direct regulatory costs over 18 to 24 months, spread across ten fixed line items. The budget that survives first contact with a Notified Body is the one that estimates each line honestly, adds a contingency buffer of at least 20 to 30%, and loads regulatory cost into the cost of being allowed to sell the device rather than hiding it in a vague "compliance" line.

By Felix Lenhard and Tibor Zechmeister. Last updated 10 April 2026.

TL;DR

  • Regulatory belongs in the MedTech startup budget as a named cost category from day one, with its own ten line items and its own contingency buffer.
  • The Felix rule for every regulatory estimate is "estimate and double it". Not because estimators are lazy, but because the unknowns only reveal themselves once the Notified Body starts asking questions.
  • The ten line items are QMS, technical documentation, risk management, clinical evaluation, clinical investigation (when required), testing, Notified Body fees, PRRC, legal and registration, and post-market surveillance.
  • A typical Class IIa software device plans at EUR 200,000 to EUR 500,000 in direct regulatory cost. Class IIb roughly doubles it. Class III with a clinical investigation can exceed EUR 1 million before first revenue.
  • If you cannot afford regulatory, you cannot afford a MedTech project. This is arithmetic, not discouragement.

Why regulatory is a budget category, not an afterthought

Most first-time MedTech founders build their first financial model the same way they would build a financial model for a software company. Team costs. Infrastructure costs. Marketing costs. A small line called "compliance" or "regulatory consulting" with a round number next to it that feels reasonable and is almost always wrong. Then they go fundraising with that model, and the first investor who actually understands MedTech takes the deck apart in ten minutes.

The problem is not that the number is too low, although it usually is. The problem is structural. Treating regulatory as a single line hides the fact that it is actually ten different cost categories, each with its own driver, its own worst case, and its own failure mode. When something in category seven blows up, the founder cannot see it coming because category seven was never in the model in the first place.

Felix has a line he repeats in every coaching session with a first-time MedTech founder. When someone gives you a regulatory estimate, take the number and double it. This is not cynicism about consultants. It is an observation about how these projects actually unfold. The estimate is built on the information available at kickoff. The real cost is built on the information that arrives over the next eighteen months. The Notified Body finding that sends you back for another testing round, the clinical evaluation iteration that was not in the original scope, the intended purpose rewrite after the first technical review, the PMS system that somebody forgot to plan for because it did not feel like a "getting to market" cost. Each of these is individually small. Together they routinely double a well-built estimate.

Tibor's version of the same observation comes from the other side of the audit table. Every time a startup shows up for a first certification with a budget that was built without a proper regulatory category, the first thing he looks at is which of the ten lines are missing. There are usually three missing. Sometimes four. And that gap is the gap the company will try to close by raising a bridge round in month fourteen on worse terms than the first round. The budget error shows up as a cap table error one year later.

The fix is not to inflate the regulatory number. It is to build the regulatory section of the model properly from the beginning, with every line named, every range honest, and a contingency buffer that reflects the fact that nobody has perfect foresight on a regulated product.

The line items

A complete MedTech startup budget for the pre-revenue window has the following ten regulatory line items. They match the full cost structure laid out in the companion post on the true cost of CE marking and trace directly to MDR obligations under Regulation (EU) 2017/745.

1. Quality management system. Initial build of a QMS compliant with EN ISO 13485:2016+A11:2021 and the manufacturer obligations in MDR Article 10. Planning range EUR 15,000 to EUR 80,000 for the build, plus EUR 10,000 to EUR 30,000 per year for ongoing maintenance.

2. Technical documentation. The file specified by Annex II. Device description, GSPR evidence, design and manufacturing information, verification and validation summaries, labelling. Planning range EUR 20,000 for a simple Class I file, EUR 40,000 to EUR 80,000 for a typical Class IIa software device, EUR 60,000 to EUR 120,000 for Class IIb, EUR 100,000 to EUR 150,000 or more for Class III.

3. Risk management. A risk management file compliant with EN ISO 14971:2019+A11:2021, covering the Annex I GSPR requirements on risk. Planning range EUR 10,000 to EUR 60,000. Do not fold this into technical documentation in your model; it is its own discipline with its own cost driver.

4. Clinical evaluation. Literature-based or equivalence-based clinical evaluation under MDR Article 61 and Annex XIV, producing a clinical evaluation report sufficient for the device's intended purpose. Planning range EUR 15,000 to EUR 60,000 when no clinical investigation is required.

5. Clinical investigation when required. A full clinical investigation under Article 62 and following, conducted to EN ISO 14155:2020+A11:2024. Planning range EUR 100,000 on the low end, EUR 500,000 as a more typical figure, over EUR 1 million for pivotal studies. If your device might need one, put the range in the budget. Do not defer this decision to month twelve.

6. Testing. Software verification and validation, usability engineering, electrical safety, EMC, biocompatibility, sterilisation validation, shelf life. Whichever of these apply to your device. Planning range EUR 10,000 for a pure software device with minimal external testing up to EUR 200,000 or more for a hardware device with the full test matrix.

7. Notified Body fees. The fees charged by the Notified Body for conformity assessment under MDR Article 52. Application review, QMS audit, technical documentation assessment, certificate issuance, annual surveillance. Planning range EUR 0 for Class I self-certification, EUR 20,000 to EUR 50,000 for Class IIa, EUR 35,000 to EUR 80,000 for Class IIb, EUR 50,000 to EUR 150,000 or more for Class III, plus EUR 10,000 to EUR 40,000 per year in surveillance fees thereafter.

8. Person Responsible for Regulatory Compliance. MDR Article 15 requires a qualified PRRC. Micro and small enterprises may engage the PRRC externally under Article 15(2). Planning range EUR 0 if covered by a qualified internal team member, EUR 5,000 to EUR 30,000 per year for an external arrangement.

9. Legal, registration, and administrative. EUDAMED registration, UDI implementation and issuing entity fees, authorised representative appointment where applicable, declarations of conformity, legal review of intended purpose and labelling claims. Planning range EUR 5,000 to EUR 25,000. Individually small, collectively easy to underestimate.

10. Post-market surveillance. The PMS system required by MDR Article 83, scaled to the device and risk class per MDCG 2025-10. Planning range EUR 10,000 to EUR 40,000 per year ongoing, plus a larger one-time setup cost. The line most commonly left out of the first-year budget because it does not feel like a "getting to market" cost. It is.

Every one of these ten has to appear in your model by name. An investor who has seen more than a handful of MedTech decks will scroll to the regulatory section and count. If there are six lines, they know three are missing, and they know which ones.

Building a realistic budget by class

The ranges above collapse into total first-certification planning numbers once you know your device class and your conformity assessment route. These are the numbers to put on the slide.

  • Class I self-certified: EUR 50,000 to EUR 150,000 total direct regulatory cost.
  • Class I sterile, measuring, or reusable surgical: EUR 100,000 to EUR 250,000.
  • Class IIa (the typical startup SaMD range): EUR 200,000 to EUR 500,000.
  • Class IIb: EUR 400,000 to EUR 800,000.
  • Class III (high-risk or implantable): EUR 600,000 to EUR 1,500,000 or more, driven heavily by the clinical investigation decision.

These are direct regulatory costs. They do not include team salaries across the pre-revenue window. A lean MedTech team over 18 to 24 months adds another EUR 400,000 to EUR 900,000 depending on headcount and geography. The total runway number. Regulatory plus team plus infrastructure. Is what actually sets the size of the round.

If you are a Class IIa software startup and your total pre-revenue budget is below EUR 1 million, there is almost certainly a hole in the plan. Either a regulatory line is missing, or a team line is missing, or the timeline is unrealistic. Find the hole before the first investor does.

Contingency planning

Every honest regulatory budget has a contingency buffer of at least 20 to 30% on top of the base ten lines. This is not the same as padding. Padding inflates numbers to make the buyer's eventual disappointment smaller. Contingency funds actual unknowns that will actually occur.

The unknowns that eat contingency are predictable in category, even when they are unpredictable in detail. A Notified Body review cycle produces findings that require re-testing. A clinical evaluation iteration reveals a gap in the literature that has to be filled. A usability formative study produces a risk control that feeds back into the design. A standard gets updated mid-project. A consultant quotes a fixed scope and then runs over because the scope was under-defined. Every one of these is a normal event in a MedTech project. The only abnormal thing is a project where none of them happen.

The Felix rule. Estimate and double it. Is one way to bake contingency into the plan. The more disciplined version is to build the base case with honest ten-line ranges, then add a named contingency line of 25% that does not get spent until something actually goes wrong. Both approaches produce similar totals. The disciplined version produces better investor conversations because the contingency is visible and defensible instead of hidden inside the line items.

How budget interacts with runway and stage

The regulatory budget is not a static number. It interacts with runway, with stage, and with the sequencing of work across rounds.

At pre-seed, the priority is the Purpose Pass and the Classification Pass from the Subtract to Ship framework. Neither is expensive. Both are load-bearing for every downstream number. A pre-seed budget that does not fund a clean intended purpose and a defensible classification is setting the seed round up to fail on technical grounds later.

At seed, the priority is building the QMS at the right level, starting the technical documentation, initiating the clinical evaluation, and getting the first test quotes in writing. This is usually the largest cash-out phase for regulatory work before certification. A seed round for a Class IIa software company that does not allocate at least EUR 300,000 to regulatory over 18 months is almost certainly under-funded for the work that needs to happen before Series A.

At Series A for a pre-revenue MedTech company, the priority is closing the gap to certification. Finishing technical documentation, completing testing, running Notified Body assessment, launching PMS. The regulatory number at this stage is smaller in absolute terms than at seed because most of the build work is behind you, but the Notified Body and testing fees concentrate here, so the cash profile is lumpy.

Regulatory cost belongs inside cost of goods sold in the unit economics model, not as a separate "compliance" bucket. The QMS, the technical file, the clinical evidence, and the PMS obligations are the cost of being allowed to sell the device at all. Treating them as something outside COGS produces a misleading gross margin and is the modelling error that lets overoptimistic plans survive to the investor meeting.

Common planning mistakes

Six mistakes show up in almost every first MedTech budget we see.

Treating regulatory as one line. A single "regulatory consulting" line with a round number attached. The most common mistake and the one that hides every other mistake downstream.

Forgetting the PMS line for year one. Founders mentally defer PMS to "after certification." The Regulation does not. The system has to exist at certification and has to run from day one post-launch.

Forgetting the PRRC line. MDR Article 15 is not optional. The person has to be qualified whether they are internal or external, and the arrangement has to be in place before certification.

Underestimating testing lead times and fees. A single biocompatibility programme can cost EUR 40,000 and take four months. A re-test cycle after a finding adds another round. Getting test lab quotes in writing before the round closes is cheaper than discovering the real numbers after.

Budgeting a clinical evaluation without considering whether a clinical investigation is required. This is the swing factor for Class IIb and Class III devices. A budget that assumes a literature-based evaluation and then discovers a clinical investigation is required mid-project is a budget that has to be rebuilt from scratch.

Missing contingency. The 20 to 30% buffer is not a luxury. It is the line that gets spent when a Notified Body finding triggers a re-test or a clinical evaluation needs another iteration. Without it, the first unexpected event becomes a cap table event.

The Subtract to Ship angle

The Subtract to Ship position on budgeting is not "spend less." It is "spend correctly." A disciplined four-pass run through the framework. Purpose Pass, Classification Pass, Evidence Pass, Operations Pass. Can move a bloated plan back toward the lower end of the ranges in this post. What it cannot do is move the ranges below the structural minimum set by the Regulation itself.

The most common wins are on the Classification Pass (lowest defensible class produces the lightest conformity assessment route), the Evidence Pass (literature and equivalence routes where the device's clinical landscape permits them), and the Operations Pass (a QMS sized for the actual risk class rather than a larger imagined one). A startup that runs the framework honestly and then loads the resulting numbers into a proper ten-line budget is building a plan that can survive investor scrutiny and first contact with a Notified Body at the same time.

The rule running through the whole framework applies here too. Every line of spend must trace to a specific MDR obligation. If it does, fund it properly. If it does not, cut it entirely. Subtraction is what makes the remaining budget credible.

Reality Check. Where do you stand?

  1. Does your financial model show all ten regulatory line items by name, or does it show one "regulatory consulting" line?
  2. Have you applied the Felix rule. Estimate and double it. To the number a consultant or a peer gave you, and does the plan still close at the doubled number?
  3. Is there a named contingency line of at least 20 to 30% on top of the regulatory base case?
  4. Is PMS in the year-one budget, or did you defer it mentally to "after certification"?
  5. Is the PRRC arrangement named and budgeted, or still a TBD on the org chart?
  6. Have you decided whether your device requires a clinical investigation, and if yes, is the EUR 100,000 to EUR 500,000 or more range in the plan?
  7. Have you loaded regulatory cost into cost of goods sold, or is it sitting outside the unit economics model?
  8. If an investor walked through the ten lines and asked you to defend each one, could you name the specific MDR article or harmonised standard that drives it?

Frequently Asked Questions

How much should a Class IIa software MedTech startup budget for regulatory in total? Plan EUR 200,000 to EUR 500,000 in direct regulatory costs for first certification of a typical Class IIa software device. This covers QMS build, technical documentation, risk management, literature-based clinical evaluation, software verification and validation, usability engineering, Notified Body fees, PRRC arrangement, administrative work, and PMS build. Add another EUR 400,000 to EUR 900,000 for team salaries across the 18 to 24 month pre-revenue window, and at least a 20 to 30% contingency buffer on the regulatory base case.

What is the Felix "estimate and double it" rule? The rule is a planning heuristic: when a consultant, a peer, or your own internal team gives you a regulatory cost estimate, take the number and double it for planning purposes. The doubled number is not the expected cost. It is the number your runway needs to survive, because the real cost is built from information that only arrives over the course of the project. If the plan closes at the doubled number, the project can absorb normal unknowns without a cap table event.

Where should regulatory cost sit in the financial model. OpEx or COGS? Cost of goods sold. The QMS, the technical file, the clinical evidence, and the post-market obligations are the cost of being allowed to sell the device at all. Putting them outside COGS produces a misleading gross margin and is the single most common modelling error in first MedTech investor decks.

Do I really need to plan for a clinical investigation? If you are building a Class I or most Class IIa devices, usually no. A literature-based or equivalence-based clinical evaluation is often sufficient. If you are building a Class IIb, Class III, or implantable device, you need to answer this question deliberately and early, because the clinical investigation line is the one that can double or triple the total budget. Get an honest answer from a regulatory expert before the first funding round closes, not after.

What if I cannot close the round at the honest regulatory budget number? Tibor's line applies. If you cannot afford regulatory, you cannot afford a MedTech project. This is arithmetic, not discouragement. The regulation sets a structural floor on the cost of bringing a medical device to market. The Subtract to Ship framework can bring a bloated plan back to the low end of the ranges, but it cannot go below the floor. A round that will not close at the honest number is telling you something real about the fit between the product, the market, and the capital available.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices. Article 10 (manufacturer obligations), Article 15 (Person Responsible for Regulatory Compliance), Article 52 (conformity assessment procedures), Article 61 (clinical evaluation), Article 83 (PMS system). Official Journal L 117, 5.5.2017.
  2. EN ISO 13485:2016 + A11:2021. Medical devices. Quality management systems. Requirements for regulatory purposes.
  3. EN ISO 14971:2019 + A11:2021. Medical devices. Application of risk management to medical devices.
  4. EN ISO 14155:2020 + A11:2024. Clinical investigation of medical devices for human subjects. Good clinical practice.
  5. MDCG 2025-10. Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices, December 2025.

This post is part of the Funding, Business Models and Reimbursement series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. Estimate the regulatory budget honestly, double the number when in doubt, and put all ten lines on the slide. The plan that survives the Notified Body is the plan that was built for the real shape of the work from the beginning.