Regulatory strategy is not a separate track running alongside your business strategy. It is a dimension of the business strategy itself. Every major regulatory decision — intended purpose, classification, clinical evidence path, post-market surveillance design — is a business decision in disguise, and if you treat the two as parallel workstreams you will consistently make regulatory choices that quietly undermine the company you are trying to build. The founders who ship on a startup budget are the ones who fuse the two: they write the intended purpose as a business pivot, sequence markets with classification in mind, treat clinical evidence as a commercial asset, and use post-market surveillance as customer intelligence. When the two are aligned, the regulatory work accelerates the business. When they are not, it drains it.

By Felix Lenhard and Tibor Zechmeister. Last updated 10 April 2026.

TL;DR

  • Regulatory strategy and business strategy are the same strategy seen from two angles. Treating them as separate projects is the most expensive mistake in early-stage MedTech.
  • The intended purpose under Article 2(12) is the single most leveraged business decision in the company. Change it and the classification, the clinical evidence, the addressable market, and the cost of entry all move with it.
  • Classification under Article 51 and Annex VIII drives market sequencing. The lightest defensible class lets you enter the first market faster and fund the heavier follow-ups from revenue.
  • Clinical evidence built for Article 61 and Annex XIV is a commercial asset, not just a compliance deliverable. Hospitals buy on it, investors fund on it, and competitors cannot copy it.
  • Post-market surveillance under Article 83 and Annex III is the cheapest and most honest customer intelligence system you will ever run. Most startups waste it as a binder exercise.
  • The failure mode is treating regulatory as a track that the business strategy team does not need to understand. The founders who survive MDR read the Regulation themselves, at least the articles that shape their company.

The founder who ran two strategies in parallel and lost both

A founder Felix coached spent eighteen months running what he thought were two disciplined workstreams. One workstream was the business — pitch deck, fundraising, market maps, conference circuit, investor updates. The other was the regulatory project — QMS build, technical file, clinical evaluation plan, Notified Body conversations. Two tracks, two project plans, two sets of weekly meetings. He was proud of the separation. He thought it showed maturity.

Felix kept asking him the same question every month. Where are the customer conversations? The founder always had an answer about the regulatory milestone he was chasing. He was going to talk to customers after the classification was locked. After the clinical evaluation plan was approved. After the Notified Body had signed the contract. The regulatory track kept producing reasons the business track could wait.

Eighteen months in, the company dissolved. Not because the regulatory work was bad — it was actually reasonable. Not because the product was bad — it was defensible. The company died because the business strategy and the regulatory strategy had never been the same strategy. The regulatory work was optimised for regulatory milestones. The business work was starved because the regulatory work kept consuming the attention and the money. And when the runway ran out, there was no revenue, no letters of intent, no clinical partners with a commercial conversation started, and no reason for an investor to put in the next round.

That is what running two strategies in parallel looks like. It feels organised. It is not. It is two half-projects, each drifting away from the other, each producing work that the other cannot use.

The alternative — the one this post is about — is to treat regulatory strategy as a dimension of the business strategy itself. Same plan. Same decisions. Same owner. Every major regulatory choice evaluated as a business choice, and every major business choice evaluated against its regulatory consequences. That is how you keep the company alive through a project that the regulation alone cannot justify.

How regulatory decisions shape business outcomes

Every regulatory decision a MedTech startup makes is also a business decision. The mapping is not abstract — it is direct, line for line.

The intended purpose decides which patients and clinical settings you are allowed to claim. That is also your addressable market. The classification under Article 51 decides how much evidence you need, how long the project takes, and how much it costs. That is also your break-even timeline and your fundraising ask. The conformity assessment route decides which Notified Body you need and how tightly you are coupled to their queue. That is also your critical path to revenue. The clinical evaluation strategy decides what claims you can make and what data you own. That is also your sales collateral and your defensibility against a competitor. The post-market surveillance system decides what you learn after launch. That is also your product roadmap input.

A founder who does not see these mappings will make regulatory decisions that look sensible in isolation and are quietly disastrous for the business. They will pick an intended purpose that is technically correct and commercially dead. They will pick a classification that is defensible and strategically wrong. They will build clinical evidence that satisfies the Notified Body and sells nothing. They will design PMS that checks the Annex III boxes and teaches the company nothing about its own product.

The fix is not to learn both strategies and toggle between them. The fix is to recognise that there is one strategy, and every senior decision has both faces.

The intended purpose as the pivot

Article 2(12) defines intended purpose as "the use for which a device is intended according to the data supplied by the manufacturer on the label, in the instructions for use, or in promotional or sales materials or statements, and as specified by the manufacturer in the clinical evaluation." (Regulation (EU) 2017/745, Article 2, paragraph 12.) That one sentence is the highest-leverage piece of text in the entire Regulation, and it is where business and regulatory strategy meet most visibly.

The intended purpose is not a compliance artefact. It is a business pivot point. It decides whether you are a medical device at all, which patients you can claim to serve, which clinical settings you can sell into, which doctors you can address, which reimbursement codes might apply, and which clinical evidence you must produce to support your claims. Tibor has seen companies rescue years of work by rewriting the intended purpose carefully. He has also seen companies destroy a viable product by writing it carelessly on a website and a pitch deck before anyone on the team understood what they had written.

There is a Graz-based company Tibor worked with whose initial plan assumed a full MDR project. A disciplined review of the intended purpose produced a different route — the product could be positioned as a wellness device without changing the technology, just by making the claims deliberate and coherent across every surface where they appeared. Market entry became dramatically faster. The lesson is not that every product can do that. Most cannot. The lesson is that the intended purpose is where you look first when you want to change the regulatory outcome, and it is the first place the business strategist and the regulatory strategist should be the same person sitting at the same table.

The intended purpose is also the discipline test. If you cannot state it in one paragraph that a clinician would sign as accurate and a Notified Body auditor would accept as specific, your business strategy is not yet real. The sentence that passes both tests is also the sentence you can put in front of a hospital buyer. Until it exists, the company is not ready to commit the regulatory budget.

Market sequencing and classification

Classification under Article 51 and Annex VIII is usually discussed as a compliance decision. It is also a market sequencing decision.

The class of the device drives the cost of entry, the time to first revenue, and the amount of clinical evidence you need before you can make a claim. A startup that needs to generate revenue before the seed round runs out cannot afford to enter the market at the highest class first if a lower-class entry exists. A startup that is well funded and needs to protect a position against fast followers might prefer the higher class because the evidence bar works in its favour after launch. The right choice depends on the business situation, not only on the device.

Many devices have a lower-class version and a higher-class version that share most of the technology. The lower-class version ships first, generates revenue, builds the clinical dataset, and funds the higher-class follow-up from cash flow instead of dilution. The higher-class version inherits the QMS, the PMS system, the supplier controls, and the first set of real-world data from the lower-class launch. This is the standard pattern for a startup that wants to survive long enough to reach the interesting part of the market.

The failure mode is entering at the most ambitious class first because it feels braver. Every month of Class IIb or Class III certification is a month the company is not selling anything. Every euro of clinical investigation is a euro not spent on sales or on the next product generation. If the lighter class is defensible and the device functions in that positioning, you ship it first, earn from it, and use the cash to climb. If the lighter class is not defensible, you accept the heavier path with both eyes open and fundraise for it honestly.

The classification decision should never be made by a regulatory person alone. It is a decision about market sequencing, cash flow, and fundraising risk. A regulatory expert should say what is defensible. A commercial operator should say which of the defensible options makes the business work. Both sit at the same table.

Clinical evidence as a commercial asset

Article 61 and Annex XIV set out what clinical evidence a device must have. Most founders treat this as a compliance cost — a necessary expense to get through the Notified Body. That framing leaves money on the table.

Clinical evidence is one of the most durable commercial assets a MedTech company can build. It is what a hospital procurement committee asks for before they sign. It is what a clinical champion cites in a grand round when they are defending the device to peers. It is what an investor asks for in the data room. It is what a distributor uses to open a new geography. It is what a competitor cannot copy overnight, because clinical data takes time to accumulate and is tied to specific study designs, specific sites, and specific patient populations.

When you design the clinical evaluation around the cheapest legitimate pathway to a Notified Body signature, you get a signature and very little else. When you design it around the evidence your first five hospital customers will actually ask for, you get the signature and a commercial asset at the same time, for roughly the same money. The difference is not in the study design itself. The difference is in which endpoints you pick, which comparators you run against, and which settings you choose. The Regulation accepts a wide range of valid approaches. The business decides which of those approaches produces data the company can sell on afterwards.

The same logic applies to clinical partners. A clinical partner who joins a study that was designed to satisfy the Notified Body walks away when the study ends. A clinical partner who joins a study that also answers a question their department cares about becomes a reference site, a co-author on a peer-reviewed paper, and the first commercial customer when the CE mark lands. The cost of the study is the same. The business outcome is different by an order of magnitude.

Every clinical evaluation decision should be reviewed through two lenses in the same meeting. Does the Notified Body accept this? Does the hospital buyer value this? If only the first lens is applied, the evidence is an expense. If both are applied, the evidence is an asset.

Post-market surveillance as customer intelligence

Article 83 requires every manufacturer to have a post-market surveillance system that is proportionate to the risk class and appropriate for the device. Annex III describes the technical documentation for that system. (Regulation (EU) 2017/745, Article 83 and Annex III.) Most startups treat PMS as a binder exercise — write the plan, file the updates, mention it in the QMS, keep the Notified Body happy.

That is the most expensive way to do PMS.

A well-designed PMS system is the cheapest customer intelligence platform a MedTech company will ever run. It produces structured, routine information about how the device is actually used in the field — which users struggle with which steps, which workflows break in which settings, which edge cases appear in which populations, which complaints cluster around which features. It captures what users say when they are not being sold to. It captures what happens after the sale, when the company would otherwise be blind.

The founder who runs PMS as a binder exercise is paying for a data collection system and throwing the data away. The founder who runs PMS as a business process is paying for the same system and getting the product roadmap, the training content for the next launch, the marketing claims for the next version, and the early warning system for the next recall — all for free, because the regulatory obligation already paid for the plumbing.

The practical move is to design the PMS plan with the product team in the room, not only the quality team. Ask what the product team needs to learn to improve the device, the training, and the sales story. Build the PMS data collection around those questions wherever it does not conflict with the regulatory requirements — and it almost never does, because Annex III is broad enough to accommodate the questions that matter to the business. The resulting system satisfies the Notified Body and feeds the company at the same time.

The mistake of treating regulatory as a separate track

The single recurring failure pattern Tibor and Felix see across early-stage MedTech is the founder who treats regulatory as a separate track. Sometimes it is an outsourced track — a consultant runs it, the founder pays invoices, and the intended purpose, the classification, and the clinical evidence plan all get written by someone who has never spoken to a hospital buyer. Sometimes it is an internal track — a regulatory hire runs it, reports in a weekly meeting, and the business team nods politely without understanding what they are approving.

Both versions produce the same outcome. The regulatory deliverables get finished. They are often technically competent. They are built on assumptions about the business that the business team never validated, and they commit the company to a positioning, a class, an evidence base, and a post-market plan that do not match the company's actual market reality.

The fix is not to add more review meetings. The fix is for the founder — the person who owns the business strategy — to own the regulatory strategy as well, with expert support but without delegation of the key decisions. The founder does not need to read all 180 pages of the Regulation. They do need to read the articles that shape their company: Article 2(12) for intended purpose, Article 51 for classification, Article 61 for clinical evaluation, Article 83 for PMS, the relevant Annex VIII rules, and the specific GSPR from Annex I that drive their device's evidence requirements. That is a weekend of reading, at most. It is the cheapest education in business strategy a MedTech founder will ever buy.

When the founder owns both sides, the two strategies fuse. Every regulatory decision gets evaluated against the business. Every business decision gets evaluated against the regulation. Waste gets cut from both sides at once, because the same person sees both. That is the alignment this post is about, and it is the only alignment that scales on a startup budget.

The Subtract to Ship angle

Applying the Subtract to Ship discipline to regulatory-business alignment produces a short rule. Every regulatory activity in the plan must trace to both a specific MDR obligation and a specific business outcome. If it traces only to the obligation, it is a compliance cost — acceptable but minimised. If it traces only to the business outcome, it does not belong in the regulatory plan. If it traces to both, it is leveraged work, and you prioritise it.

This test flushes out the work that is expensive and produces neither compliance nor commercial value. It also flushes out the work that is technically optional from a regulatory standpoint but is disguised as required because a consultant added it out of habit. Both categories are where the money leaks in a first-time founder's regulatory budget.

Read the Subtract to Ship framework for MDR for the underlying methodology and the no-bullshit MDR guide for the orientation a first-time founder needs before running the framework.

Reality Check — Where do you stand?

Answer these honestly. If more than two answers are weak, your regulatory and business strategies are drifting apart.

  1. Can you name the business outcome that each activity in your regulatory plan is meant to support, or are some activities justified only by compliance?
  2. Is your intended purpose written in a single paragraph that a clinician would sign as accurate and a hospital buyer would recognise as describing something they want?
  3. Do you know the lowest defensible classification of your device, and have you evaluated whether a lighter-class entry first would let you fund a heavier follow-up from revenue?
  4. Is your clinical evaluation designed to produce evidence your first five hospital customers will actually ask for, or only evidence the Notified Body will accept?
  5. Does your post-market surveillance plan answer product questions the business team cares about, or is it a binder exercise disconnected from the product roadmap?
  6. When was the last time the business strategy and the regulatory strategy were reviewed in the same meeting, by the same people, against the same objectives?
  7. Have you — the founder — read the MDR articles that shape your specific company: Article 2(12), Article 51, Article 61, Article 83, and the Annex VIII rule that applies to your device?
  8. If a senior regulatory decision had to be made tomorrow, would it be made by the person who also owns the business strategy, or by someone downstream who does not?

Frequently Asked Questions

Is regulatory strategy really part of business strategy, or is that a stretch? It is not a stretch. Every major regulatory decision — intended purpose, classification, clinical evidence path, post-market surveillance design — has a direct, measurable effect on addressable market, cost of entry, time to revenue, competitive defensibility, and product roadmap. Treating them as separate is a modelling mistake, not a neutral choice.

Who should own regulatory strategy in a MedTech startup? The founder, with expert support. The founder does not need the depth of a regulatory affairs professional, but they need enough fluency to make the senior decisions themselves. The regulatory expert proposes, the founder decides, the business strategy absorbs the consequences in the same meeting.

How much of the MDR does a founder actually need to read? At minimum the articles that shape the specific company — Article 2(12) for intended purpose, Article 51 and the relevant Annex VIII rule for classification, Article 61 and Annex XIV for clinical evaluation, Article 83 and Annex III for PMS, and the GSPR in Annex I that drive the device's evidence requirements. A disciplined weekend of reading covers it.

Can clinical evidence really be a commercial asset, or is that rebranding a cost? It is a real asset when the study is designed with both the Notified Body and the hospital buyer in mind. The cost of the study is almost identical. The difference is in endpoint selection, comparator choice, and site selection. Studies built with both lenses produce data that hospital procurement and clinical champions actually cite. Studies built only for the Notified Body produce a signature and no further value.

What is the biggest red flag that regulatory and business strategy are drifting apart? The founder does not know why a specific regulatory activity is in the plan. When you ask "why are we doing this?" and the answer is "the consultant said so" or "it's for the file" with no business rationale, that activity is either waste or a business decision that was made without the business being in the room.

When should this alignment work happen? Before the regulatory budget is committed. The intended purpose, the classification hypothesis, the clinical evidence strategy, and the PMS plan all get first-draft answers during market verification, not after the Notified Body contract is signed. Rewrites after commitment are the most expensive kind of pivot in MedTech.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, consolidated text. Articles cited: Article 2(12) intended purpose; Article 51 classification; Article 61 clinical evaluation; Article 83 post-market surveillance system. Annexes cited: Annex III PMS technical documentation; Annex VIII classification rules; Annex XIV clinical evaluation. Official Journal L 117, 5.5.2017.
  2. Regulation (EU) 2023/607 of the European Parliament and of the Council of 15 March 2023 amending Regulations (EU) 2017/745 and (EU) 2017/746 as regards the transitional provisions for certain medical devices and in vitro diagnostic medical devices. Official Journal L 80, 20.3.2023.

This post is part of the MedTech Startup Strategy & PMF series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. Regulatory strategy and business strategy are the same strategy. Treat them that way, and the work gets lighter on both sides.