Real MedTech startup timelines are two to five times longer than what first-time founders plan for. From a serious start to first euro of revenue, a Class IIa software device typically takes twenty-four to forty-two months; a Class IIb hardware device takes thirty-six to sixty. Intended purpose and classification take weeks. Phase 1 feasibility takes six to twelve months. Phase 2 MDR-compliant build takes twelve to twenty-four months. QMS and clinical evaluation run in parallel through Phase 2. Notified Body feedback cycles add four to nine months. The Notified Body certificate under MDR Article 56 arrives two to four weeks after the last finding is closed. First revenue often lands six to twelve months after the CE mark, not on the day of it. Plan honestly, then apply the Felix rule: estimate real investment and time, and double it.

By Felix Lenhard and Tibor Zechmeister. Last updated 10 April 2026.

TL;DR

  • From a serious start to CE mark, a Class IIa software device takes eighteen to thirty months on realistic assumptions; a Class IIb hardware device takes twenty-four to forty-two months.
  • Intended purpose and classification are weeks of work, not months. And they are the highest-leverage weeks in the entire timeline.
  • Phase 1 feasibility runs six to twelve months. Phase 2 MDR-compliant build runs twelve to twenty-four months for most startups, with QMS and clinical evaluation running in parallel.
  • Notified Body feedback cycles under the conformity assessment procedures of MDR Article 52 and Annex IX add four to nine months between first submission and the final certificate.
  • The certificate itself, issued under MDR Article 56, lands two to four weeks after the last non-conformity is closed.
  • First revenue almost never arrives on the day of CE marking. Six to twelve months of onboarding, reimbursement, and procurement work usually sit between the certificate and the first invoice.
  • The Felix rule: take your honest estimate of time and money, and double it. The founders who survive are the ones who planned for the doubled version from day one.

Why this post exists

A few years ago a founder told Felix he would have his Class IIa software device CE marked in two months. Two. He had a working prototype, a small team, and a business plan that needed the mark by the end of the quarter. He had read a blog post that described the steps in a way that made them sound like a checklist. He had budgeted two months because two months was what his cap table could afford.

Felix asked him three questions. Who is your Notified Body. What does your QMS look like today. Where is your clinical evaluation. The founder answered none, none, and none. Two months became thirty. The company survived only because the investors had patience the founder did not deserve. Most companies in that situation do not survive.

That story is not unusual. It is the median first conversation. A founder who has never certified a medical device before will, almost without exception, underestimate the work by a factor of five to ten on the first pass. The underestimation is not laziness. It is that the founder literally cannot see what they cannot see. Which is exactly why Tibor's first piece of advice to any MedTech founder, repeated in every early meeting, is simply: do not underestimate the MDR.

This post is the honest version. Phase by phase. With ranges, not single numbers. With the things that speed the timeline up and the things that slow it down. And with the one rule that makes the whole plan survivable: estimate real investment and time. Then double it.

Stage 1. Intended purpose: one to three weeks

Intended purpose under MDR is the sentence that describes what your device does, for whom, in what clinical context, with what claims. It sounds like a marketing blurb. It is actually the hinge on which the entire regulation turns.

A competent intended purpose takes one to three weeks to write well. Not because the writing is hard, but because the thinking behind the writing is hard. You are deciding whether you are inside or outside the scope of Regulation (EU) 2017/745 at all, what your claims will be, and what body of clinical evidence you will eventually have to defend.

Founders who spend one afternoon on intended purpose almost always rewrite it six months later, and the rewrite cascades into classification changes, clinical evaluation changes, and months of rework. Founders who spend three weeks up front rarely rewrite it at all.

Stage 2. Classification: one to four weeks

Once the intended purpose is stable, classification under Annex VIII of the MDR is a structured exercise. You walk through the classification rules against your device's characteristics. Invasiveness, duration of contact, active or non-active, software function. And land on Class I, IIa, IIb, or III.

For most devices this takes one to two weeks. For borderline cases. Software that sits between Rule 11 tiers, hardware that might or might not be measuring, accessories that might travel with a parent device. It can take three to four weeks of research, consultation, and sometimes a pre-submission conversation with a Notified Body.

Classification drives the conformity assessment route under MDR Article 52, which drives the Notified Body involvement, which drives half of your remaining cost and time. Spending an extra two weeks on classification is almost always worth it.

Stage 3. Phase 1 feasibility: six to twelve months

Phase 1 is where you answer "does this thing actually work, for the people we think need it, in a form they can use." It is not a regulated phase. It is ordinary pre-market research and development on a prototype that is not yet being placed on any market.

Realistic Phase 1 for a software device runs six to nine months. For hardware with patient contact or novel mechanisms, nine to twelve months is more common. In that window you are building working prototypes, gathering retrospective data, running usability sessions with real clinicians, having conversations with early clinical partners, and stress-testing the intended purpose against what the market is actually willing to pay for.

Phase 1 ends at a design freeze. The moment you commit to a specific architecture, a specific intended purpose, a specific classification, and a specific conformity assessment route. Founders who never reach the design freeze stay in Phase 1 forever, and their runway ends before any regulated product exists. See the two-phase development approach for the full mechanics.

Stage 4. Phase 2 MDR-compliant build: twelve to twenty-four months

Phase 2 is the MDR-compliant build. This is where the real body of work lives, and it is the stage founders most often collapse in their planning to "a few months of documentation." It is not.

For a Class IIa software device, Phase 2 runs twelve to eighteen months with disciplined execution and experienced help. For Class IIb hardware, eighteen to twenty-four months is the honest range. For anything Class III, the range opens further and becomes dominated by clinical investigation timelines.

Phase 2 is not one workstream. It is several overlapping workstreams that have to be orchestrated. The QMS build, the technical documentation build, the clinical evaluation, the standards-based testing, the risk management file, and the Notified Body engagement all run in parallel. Each has its own tempo and its own bottleneck.

Stage 5. Quality management system: three to nine months in parallel

A lean, fit-for-purpose QMS aligned with EN ISO 13485:2016+A11:2021 takes three to six months to build from scratch if you know what you are doing and six to nine months if you are learning as you go. It is built inside Phase 2, not before it.

The shape of the QMS depends on the classification and the conformity assessment route. For routes under Annex IX of the MDR. The conformity assessment based on a quality management system and on assessment of the technical documentation. The QMS has to be fully functional and evidenced in use before the Notified Body audit. Evidenced in use means: real records, real reviews, real CAPAs, not empty templates. That takes time to accumulate. The QMS cannot be built the week before the audit and pass.

Stage 6. Clinical evaluation: two to twelve months in parallel

Clinical evaluation runs alongside the QMS and technical documentation work. For a device that can rely on existing literature and, where applicable, equivalence, clinical evaluation takes two to six months of structured work. For a device that needs a clinical investigation, you are adding twelve to twenty-four months to Phase 2, and the entire timeline shifts with it.

The single biggest time-saver in clinical evaluation is deciding early what evidence strategy you are pursuing. Founders who decide late end up doing the literature work twice. Once before they realise they need an investigation, and again after.

Stage 7. Notified Body engagement and feedback: four to nine months

Once Phase 2 has produced a reviewable technical file and a functional QMS, the Notified Body process begins in earnest under the conformity assessment procedures of MDR Article 52 and the route specified in Annex IX (or the relevant alternative annex for your class). The contract and scoping are already in place by this point. You applied to the Notified Body early, at the start of Phase 2, because the queue is real.

The Notified Body work breaks into three chunks. The QMS audit takes a few days on site, with a report a few weeks later. The technical documentation review takes two to four months for a first-time manufacturer. Then the finding resolution loops begin. One loop is normal. Two is common. Three means something is structurally wrong with the submission.

Budget four to nine months between "Notified Body has our file" and "Notified Body has no more findings." Founders who plan for one month because "we think it will go smoothly" are the ones whose quarterly investor update turns into a twelve-month apology.

Stage 8. Notified Body certificate: two to four weeks

Once the last non-conformity is closed and the final review is done, the Notified Body issues the certificate. Under MDR Article 56, that certificate is the document that authorises you to affix the CE mark, subject to the manufacturer's Declaration of Conformity.

Practically, this step is short. Two to four weeks of internal Notified Body decision-making and document production. It is not where timelines usually blow up. What blows up is the timeline into this step, not out of it.

Stage 9. First revenue: six to twelve months after the CE mark

Here is the stage founders almost universally forget. CE mark is not revenue. CE mark is the day you are legally allowed to place the device on the market. What happens next is the part that the cap table actually cares about.

For most B2B MedTech devices, six to twelve months sit between the CE mark and the first invoice. In that window you are finishing hospital onboarding processes, passing institutional IT and data-protection reviews, negotiating with group purchasing organisations, pursuing reimbursement codes where applicable, training early users, and surviving the procurement cycles of large healthcare institutions. None of this is regulatory. All of it is real.

The founders who budget cash only to the CE mark run out of cash six months into the revenue ramp. The founders who survive plan for CE mark plus six to twelve months of near-zero revenue, and fund it.

What speeds things up

  • A sharp intended purpose written in week one, stable through Phase 2. Every week you save on rewriting your intended purpose later is a month you save downstream.
  • Experienced regulatory help engaged early, not after the first Notified Body finding. A competent partner pays for themselves in prevented rework.
  • Notified Body application submitted at the start of Phase 2, not the end. The queue moves while you build.
  • Parallelisation across the Phase 2 workstreams. QMS, technical documentation, clinical evaluation, testing, risk management. Instead of sequential execution.
  • First-submission quality. A technical file submitted a month later but a factor better spends less total time in review than one that ships early and cycles through three revision rounds.
  • Clinical partners from day one who double as future first customers, compressing the post-CE revenue ramp.

What slows things down

  • Intended purpose drift. Every rewrite cascades. Six weeks of classification rework. Three months of clinical evaluation rework. Two Notified Body finding rounds you would not otherwise have had.
  • Starting Phase 2 before Phase 1 is really finished. The design is still moving. Every move invalidates documentation already written.
  • Templates instead of a real QMS. The Berlin template QMS that looked complete but was zero point one percent useful when the auditor arrived. Six months to unwind.
  • Waiting to engage a Notified Body until the technical file is "ready." The queue is months long. Waiting burns the months in silence.
  • Founders who insist on doing clinical strategy themselves without ever having done one. The clinical evaluation cycles twice, then three times, then the Notified Body asks for an investigation that could have been avoided with the right literature strategy eighteen months earlier.
  • Optimism written into the investor deck. Timelines the regulation cannot deliver become cash runways that cannot be extended.

The double-it rule

Felix has a rule he gives to every MedTech founder in every first session. Take your most honest estimate of how long this will take and how much it will cost. Then double both. That is your plan.

It sounds cynical. It is actually the opposite. It is the only plan that lets a founder sleep at night when the inevitable first surprise arrives in month seven. The founders who plan for the doubled version absorb surprises and keep moving. The founders who plan for the undoubled version treat every surprise as an existential crisis, spend their emotional energy on the crisis instead of the work, and slow down further.

The double-it rule is not an excuse for sloppiness. You still aim for the undoubled version. You still execute with discipline. You just finance and schedule the doubled version, so that reality has room to be real. Every euro saved in the first phase by squeezing the plan, Tibor says, costs hundreds or thousands later. The double-it rule is how you stop paying that tax.

The Subtract to Ship angle

Timelines extend because work expands. Work expands because founders add activities that feel productive but do not trace back to a specific MDR obligation. A process document nobody will read. A feature the Notified Body never asked for. A risk control for a hazard that is not in the file. A user test with the wrong population. A clinical literature review on a claim that is not in the intended purpose.

The Subtract to Ship discipline is the timeline discipline. For every hour of planned work, the question is: which MDR article, annex, harmonised standard, or genuine business need does this trace back to. If the answer is "none" or "it seems like a good idea," the work comes out of the plan. See the Subtract to Ship framework for MDR for the underlying methodology.

A plan built this way is shorter than the plan a fearful founder would write. It is still twice as long as the plan an optimistic founder would write. That is the calibration the double-it rule is pointing at.

Reality Check. Where do you stand?

  1. Write down your current best estimate for time from today to CE mark and from CE mark to first euro of revenue. Write them in months, not quarters.
  2. Double both numbers. Can your cap table survive the doubled version. If not, what changes. Scope, financing, classification, intended purpose. Would make it survivable.
  3. Is your intended purpose written down in one paragraph that has not changed in the last thirty days. If it is still changing, every downstream estimate is fiction.
  4. Have you identified your classification with confidence, and does your conformity assessment route under Article 52 follow from it, or are you still hoping for something lighter.
  5. Where are you today. Still in Phase 1 feasibility, or already in Phase 2 MDR-compliant build. If you cannot answer clearly, you are probably doing both badly at once.
  6. Have you contacted a Notified Body yet. If not, when. The queue is already running on your timeline whether you engaged it or not.
  7. What does the twelve months after CE mark look like in your plan. If the plan shows revenue on month zero, it is wrong.

Frequently Asked Questions

How long does it really take to CE mark a Class IIa medical device as a startup? On honest assumptions, eighteen to thirty months from a serious start to the certificate. Twelve to fifteen months is possible for an experienced team with a strong first submission and a cooperative Notified Body. Beyond thirty months is common for first-time teams learning as they go. See the detailed breakdown in how long does it really take to get a CE mark.

Why do founders underestimate MedTech timelines so badly? Because the early-stage view of the work looks like a list of documents, and documents look fast. The reality is that the documents encode decisions, the decisions require evidence, the evidence requires work, and the work is done under a Notified Body review that has its own tempo. None of that is visible from the outside. Tibor's advice to every first-time MedTech founder is simply: do not underestimate the MDR.

Is the Notified Body the bottleneck in my timeline? Often, but not always. For a startup with a weak first submission, the bottleneck is the number of finding rounds, which is a consequence of submission quality, not Notified Body capacity. For a startup with a strong first submission, the bottleneck is usually the queue in. The months between application and the first real review. Both are manageable if planned for.

Does the double-it rule mean I am planning for failure? No. It means you are planning for reality. The undoubled plan is what you execute toward. The doubled plan is what you finance against and what you tell investors. A founder who raises only for the undoubled plan is one surprise away from dead.

When does revenue actually start after the CE mark? For most B2B MedTech devices, six to twelve months after the certificate. Hospital onboarding, IT reviews, reimbursement work, procurement cycles, and early-user training all sit between CE and invoice. Consumer-facing devices and pure digital health products can be faster but usually are not, because distribution and reimbursement are their own beasts.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 52 (conformity assessment procedures), Article 56 (certificates of conformity), Annex IX (conformity assessment based on a quality management system and on assessment of technical documentation). Official Journal L 117, 5.5.2017.
  2. EN ISO 13485:2016 + A11:2021. Medical devices. Quality management systems. Requirements for regulatory purposes.
  3. EN ISO 14971:2019 + A11:2021. Medical devices. Application of risk management to medical devices.

This post is part of the MedTech Startup Strategy & PMF series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. If your plan and your cap table do not match the doubled version of reality, Zechmeister Strategic Solutions works with founders on the timeline and financing conversation before the surprises arrive.