---
title: When to Bring in a Regulatory Consultant: The Signs Your Startup Needs Expert Help
description: Knowing when to hire an MDR consultant is as important as knowing how to evaluate one. Here are the concrete signs that mean it is time.
authors: Tibor Zechmeister, Felix Lenhard
category: MedTech Startup Strategy & PMF
primary_keyword: when to bring in regulatory consultant
canonical_url: https://zechmeister-solutions.com/en/blog/when-to-bring-in-regulatory-consultant
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# When to Bring in a Regulatory Consultant: The Signs Your Startup Needs Expert Help

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

> **You bring in a regulatory consultant the moment a decision in front of you is hard to reverse, your team does not have the experience to make it confidently, and the cost of getting it wrong is larger than the cost of help. Specifically: intended purpose and classification before you freeze them, clinical evidence strategy before you start generating data, Notified Body selection before you sign, and the PRRC arrangement under MDR Article 15 before you place anything on the market. If any of those decisions is in front of you now and you are improvising, it is time.**

**By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.**

---

## TL;DR

- The question "when to bring in a regulatory consultant" is not about a calendar. It is about which decision is in front of you and whether your team can make it safely.
- Four moments are almost always worth paying for: intended purpose and classification, clinical evidence strategy, Notified Body selection, and PRRC arrangement under MDR Article 15.
- The single clearest trigger is the sentence "we have a dedicated expert handling regulatory" being said about someone whose competence nobody on your board has independently verified.
- The cost of not hiring, when help is needed, is not measured in euros. It is measured in months of rework and, in the worst cases, in the company itself.
- The cost of hiring, when help is not needed, is measured in runway spent on work you could have done yourself.
- A good consultant reduces your total cost of ownership on regulatory work. A bad one increases it. The evaluation test is the same either way: are they a sparring partner who sits next to you and fixes things, or a vendor who sends slides and invoices?

---

## Why this post exists

In the companion post, [DIY vs. Hiring a Regulatory Consultant](/blog/diy-vs-mdr-consultant), we laid out how to decide whether MDR work belongs in-house or outside. This post is the other half of that decision: once you have agreed that some of the work needs expert input, how do you know when to actually pick up the phone? What are the concrete signals that a founder should stop improvising and start asking for help?

The reason the question matters is that most startups get the timing wrong in one of two directions. Either they hire too early — paying a senior regulatory rate to do paperwork a disciplined co-founder could have done with a weekend of reading — or they hire too late, after an irreversible decision has already gone sideways and the consultant is now doing archaeology on a broken file instead of prevention on a healthy one. Both mistakes are common. Both are expensive. Both are avoidable with a clear list of trigger signs.

## The trigger signs

These are the moments, in practice, when a founding team should stop and bring in expert input. You do not need all of them to be present. Any one of them is usually enough.

- **You are about to freeze your intended purpose.** The single most leveraged sentence in your entire regulatory file. If your team has not drafted an intended purpose before, or has not seen how small wording changes flip classification, this is the moment.
- **You are reading MDR Annex VIII and the answer is not obvious.** Classification rules look like a lookup table and are not. If two people on your team read the same rule and arrive at different classes, that disagreement is a trigger.
- **You are about to commit to a clinical evidence pathway.** Literature-based, equivalence-based, or full clinical investigation under MDR Article 61 and Annex XIV — the choice is hundreds of thousands of euros and a year or more of development. This is not a decision to make by reading summaries.
- **You are about to contact your first Notified Body.** The first interaction sets the tone for the entire certification. If you do not know what to ask, how to ask it, and how to interpret the answer, you want someone who does sitting with you.
- **You need a PRRC and you do not have one.** MDR Article 15 defines specific qualification requirements for the Person Responsible for Regulatory Compliance. Micro and small enterprises can use an external arrangement under Article 15(2). Getting this structure wrong is a legal exposure, not just a regulatory one. See [PRRC and MDR Article 15](/blog/prrc-mdr-article-15) and [PRRC Options for Startups](/blog/prrc-options-startups).
- **Your internal "regulatory expert" has not been independently verified.** If the person in charge of regulatory on your team was hired on the strength of a CV and a vocabulary test, and nobody with real MDR experience has looked at their actual work output, that is a trigger regardless of how confident they sound.
- **An investor or acquirer is about to do regulatory due diligence.** If a third party with domain experts is about to read your file, you want someone friendly to read it first.
- **A Notified Body audit, major or minor, is on the calendar.** Not the day before — months before. Preparation is where expert input compounds; firefighting is where it barely helps.
- **You discover an inconsistency between documents.** Intended purpose in the IFU differs from the technical file. Classification rationale points at a rule the file does not actually apply. The risk file references hazards the clinical evaluation does not address. Inconsistencies are rarely isolated. They are usually symptoms.

If any of those describe where you are today, the answer to "when to bring in a regulatory consultant" is "now, before the next irreversible step."

## The cost-of-not-hiring calculation

Founders underestimate the cost of not hiring because the cost is invisible until it is not. The invoice from a consultant is a number you can see. The cost of a misclassification discovered eighteen months later is a number nobody writes down in advance.

The honest way to think about it is in three buckets.

**Direct rework cost.** A wrong classification that needs to be redone means the technical file is redone, the clinical evaluation strategy may need to change, the conformity assessment route may shift, and the Notified Body submission restarts. A wrong intended purpose can cascade into label changes, IFU rewrites, and in some cases a requalification of whether the device is a medical device at all. Rework on a mature file is routinely two to five times the cost of doing the same work correctly the first time.

**Runway cost.** Every month the certification path slips is a month of burn with no revenue. For a startup with twelve to eighteen months of runway, a six-month regulatory delay is often the difference between a successful certification and a bridge round negotiated from a position of weakness. The consultant invoice looks expensive in isolation. Compared to a bridge round, it is a rounding error.

**Reputational cost.** Notified Bodies talk. A first submission that arrives with obvious deficiencies is a signal about the applicant that does not disappear when the deficiencies are corrected. A second submission on a previously-bungled file is reviewed with sharper eyes. None of this is officially tracked. All of it is real.

**The worst-case cost.** In the worst cases, the "cost of not hiring" is the company itself. There is an Austrian company we came across where the founders had been telling every investor and every auditor that they had a dedicated regulatory expert on the team. The sentence did its job. Everyone relaxed. The "dedicated expert" turned out to be beginner-level — fluent in the vocabulary, short on the regulation. The QMS documents looked right from the outside. Under the surface, intended purpose was inconsistent, classification rationale pointed at the wrong Annex VIII rule, and the clinical evaluation strategy would not have survived a serious review. Nobody caught it until a real audit hit. Rebuilding cost a multiple of what getting it right the first time would have cost, and they were lucky they found the gap before it reached a patient. The cost of not hiring, in that case, was years of work built on a foundation that had to be torn out.

## The four moments worth paying for

If we had to compress the whole decision into four moments, these are the ones. Every startup we have worked with has benefited from expert input at each of them. Every startup that tried to skip one of them paid for it later.

**Moment 1 — Intended purpose and classification.** Before the wording is frozen. Before the classification is written into the file. Before anything downstream is built on the sentence. This is where one hour of expert conversation saves months of downstream rework.

**Moment 2 — Clinical evidence strategy.** Before you start generating data. Before you commit to a pathway under MDR Article 61 and Annex XIV. The choice between literature, equivalence, and investigation shapes the next twelve to twenty-four months of development. Making it without expert input is a gamble with bad odds.

**Moment 3 — Notified Body selection and first engagement.** Before you sign anything. Before the first formal meeting. The Notified Body market is tight; the wrong choice is queue time you cannot get back, and the first impression shapes every audit that follows. See [How to Choose the Right Notified Body](/blog/choose-right-notified-body).

**Moment 4 — PRRC arrangement under MDR Article 15.** Before you place anything on the market. The Person Responsible for Regulatory Compliance role has legal teeth. Micro and small enterprises can use an external PRRC under Article 15(2), and for many startups this is the right structure, but it has to be set up correctly. See [PRRC and MDR Article 15](/blog/prrc-mdr-article-15).

## What a good consultant actually does at each moment

At Moment 1, a good consultant does not write your intended purpose for you. They sit with you, ask uncomfortable clarifying questions, and make you defend every word. The output is a sentence you own and can explain to anyone who asks. The classification rationale is written with you, not handed to you.

At Moment 2, a good consultant does not pick your clinical evidence pathway from a menu. They walk through the specifics of your device, the state of the art, the competitor landscape, and the realistic options under MDR Article 61. They tell you what each pathway will actually cost in time and money, and what the failure modes are. Then you pick, and they document the rationale with you.

At Moment 3, a good consultant tells you which Notified Bodies are currently accepting applications in your device category, which have reasonable timelines, which have particular reviewer cultures to be aware of, and how to structure the first conversation so that it goes well. They do not just hand you a list.

At Moment 4, a good consultant explains the Article 15(1) qualification criteria honestly, tells you whether anyone on your team plausibly meets them, and if not, helps you structure an external PRRC arrangement under Article 15(2) that is real — not a name-on-paper arrangement with a person who will never read your file.

None of this is glamorous. All of it is cheaper than the alternative.

## When not to hire

There are real situations where bringing in a consultant is premature or unnecessary, and we would rather say so than take the fee.

- You are still in very early feasibility work. The design is not frozen. The intended purpose is still moving. Manufacturer obligations under MDR Article 10 have not fully attached yet. Do not pay a consultant to write a regulatory strategy for a device that does not exist. Read, sketch, learn.
- You have a genuinely experienced co-founder. Not a regulatory course certificate; a person who has taken a device through MDR or the legacy MDD with real Notified Body interaction. Trust them, support them, and save the consulting budget for the edges of their experience.
- Your device is clearly Class I, your intended purpose is stable, and you are not in a borderline case. A disciplined founder with good reading skills can credibly run the certification with only occasional sanity-check calls.
- You have a competent external PRRC already engaged under Article 15(2) and that person is substantive enough to flag problems early. Do not pay twice for the same oversight.
- The question you have is one you can answer by reading the primary source for an afternoon. If the question is "what does MDR Article 15 actually say," the answer is: read MDR Article 15. Then if you still have a question, bring it to an expert. A consultant is not a substitute for reading the regulation.

## Common mistakes

A few patterns we have seen repeatedly.

- **Hiring too late.** The classic mistake. The founder calls after the decision has already been made, and the consultant is now doing archaeology instead of prevention. By then the cost multiplier is already in place.
- **Hiring too much.** Retaining a full-scope consultant to do work your team could have done, because it feels safer. This is runway you do not get back.
- **Hiring the wrong shape.** Choosing a vendor that sells template packages when you needed a sparring partner, or vice versa. Both have their place; confusing them is expensive. See the sparring-partner-versus-vendor framing in [DIY vs. Hiring a Regulatory Consultant](/blog/diy-vs-mdr-consultant).
- **Hiring without verification.** Believing the CV and the vocabulary without asking the hard questions. Ask what they do not know. Ask about a device they got wrong. Listen for specifics.
- **Hiring and then not listening.** Paying for advice and then ignoring it because it is inconvenient. The work of the consultant is wasted; the cost is not.
- **Hiring one person with no backup.** A single-person practice with no contingency plan is a single point of failure on the most important workstream in your company. At minimum, ask what happens if they get sick.

## The Subtract to Ship angle

The [Subtract to Ship framework](/blog/subtract-to-ship-framework-mdr) applies to the hiring decision the same way it applies to every other MDR decision. Strip the work to what actually needs doing, map each item to the specific MDR article or annex it serves, and for each item ask two questions: does our team have the competence to do this correctly, and what is the cost of getting it wrong?

Where the answer is "no" and "large," bring in help. Where the answer is "yes" or "small," keep the work in-house. Where the answer is "sort of" and "medium," you are in the grey zone, and that is where a [both-sides perspective](/blog/both-sides-perspective-auditor-entrepreneur) — someone who has seen audits from both the regulator and the applicant side — earns its keep.

Subtraction is also how you keep the consulting bill honest. If a consultant is offering you work that does not trace to a specific article, a specific annex, or a specific unresolved decision, cut it. The right engagement is narrow, deep, and tied to named decisions — not a rolling retainer for unspecified "regulatory support."

## Reality Check — Where do you stand?

1. Is any of the four pay-for moments — intended purpose and classification, clinical evidence strategy, Notified Body selection, PRRC arrangement — in front of you right now? If yes, is the person making the decision someone whose competence has been independently verified?
2. If your current "regulatory expert" disappeared tomorrow, could you list the decisions they have made on your behalf and explain the rationale for each one?
3. Can you name, for every significant regulatory deliverable in your plan, the person responsible, the hours budgeted, and the competence rationale for assigning it to that person?
4. Has anyone on your team read the actual text of MDR Article 10 and Article 15 — not a summary, the text?
5. If a serious audit landed on your current technical file tomorrow, which sections would you not want an expert reading?
6. Are you paying a consultant for work that does not map to a specific MDR article, annex, or decision?
7. If the answer to any of the above made you uncomfortable, what is the first phone call you should make this week?

## Frequently Asked Questions

**When is the earliest a startup should bring in a regulatory consultant?**
The earliest productive moment is usually when you are about to freeze your intended purpose and classification. Before that, the design is too fluid for a consultant to anchor to anything useful. After that, downstream work starts building on decisions that are expensive to undo.

**What is the single clearest sign that it is time to hire?**
An irreversible regulatory decision is in front of you, and nobody on your team has made that decision before on a real device that reached market. If that is true, the cost of expert input at that moment is almost always smaller than the cost of getting it wrong.

**How much should a startup budget for this kind of help?**
Less than you think if the engagement is narrow and decision-focused, more than you think if you are paying a retainer for unspecified support. Ask for scope broken down by activity and hours, not a lump sum. Be suspicious of both very low and very high quotes.

**Do we need a consultant if we already have an internal regulatory hire?**
Only if the internal hire is experienced enough to be trusted on the four pay-for moments. If not, the consultant is there to supervise the high-stakes decisions, not to duplicate the daily work. See [Hiring Regulatory Affairs in a Startup](/blog/hiring-regulatory-affairs-startup).

**What if we cannot afford a consultant at the moment one is needed?**
Then you cannot afford to make the decision yet. Uncomfortable, but honest. Do the reversible preparation work — read the primary sources, write the draft intended purpose, sketch the classification rationale — and do not commit to anything irreversible until the expert review is in place.

**Is this post meant to steer readers toward Zechmeister Strategic Solutions?**
No. The triggers above apply whether you hire us, a competitor, or nobody. If the right choice for your situation is a different consultant, or none at all, we would rather you make that choice well than hire us badly.

## Related reading

- [DIY vs. Hiring a Regulatory Consultant](/blog/diy-vs-mdr-consultant) — the companion decision framework this post builds on.
- [The Subtract to Ship Framework for MDR](/blog/subtract-to-ship-framework-mdr) — the methodology behind the hire-or-not decision.
- [PRRC and MDR Article 15](/blog/prrc-mdr-article-15) — the legal foundation of the PRRC role and why Moment 4 matters.
- [PRRC Options for Startups](/blog/prrc-options-startups) — how micro and small enterprises structure PRRC under Article 15(2).
- [MedTech Startup Team: Key Roles](/blog/medtech-startup-team-key-roles) — where regulatory fits in the overall team shape.
- [Hiring Regulatory Affairs in a Startup](/blog/hiring-regulatory-affairs-startup) — when to hire internal versus external.
- [PRRC: Hiring, Outsourcing, and Training in a Startup](/blog/prrc-startup-hiring-outsourcing-training) — the practical options for staffing the PRRC role.
- [Building a QA/RA Quality Team in a Startup](/blog/building-qa-ra-quality-team-startup) — the team around the PRRC and the regulatory function.

## Sources

1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 10 (general obligations of manufacturers), Article 15 (person responsible for regulatory compliance), Article 15(1) (qualification requirements), Article 15(2) (external PRRC arrangements for micro and small enterprises), Article 61 (clinical evaluation), Annex VIII (classification rules), Annex XIV (clinical evaluation and post-market clinical follow-up). Official Journal L 117, 5.5.2017.

---

*This post is part of the Startup Strategy & PMF series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The triggers in this post apply whether you hire us, a competitor, or nobody. If the right answer for your situation is to keep the work in-house, the post has done its job.*

---

*This post is part of the [MedTech Startup Strategy & PMF](https://zechmeister-solutions.com/en/blog/category/startup-strategy) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*