Start MDR regulatory work the moment your intended purpose stabilizes — not on day one, and not after your prototype is done. The intended purpose is the single decision that determines classification, conformity assessment route, clinical evidence burden, and timeline. Everything else is downstream of it. Founders who delay regulatory work until "we have a product" underestimate timelines by 12–18 months. Founders who start on day one burn runway documenting products that still change weekly.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • MDR regulatory work should start the moment the intended purpose of the device is stable, not on day one and not after prototyping.
  • The intended purpose drives classification under MDR Article 51 and Annex VIII, and classification drives conformity assessment route, clinical evidence burden, and timeline.
  • The most expensive failure pattern is not starting early — it is ignoring regulatory work until a competitor, authority, or court forces the issue. By then the company is out of money.
  • The second most expensive failure is starting the full QMS and technical file machinery before the intended purpose has stopped changing.
  • Practical rule: write your intended purpose. If it has not changed for 60 days and you can defend every word of it, start regulatory work. If it is still moving, stabilize it first.

Why this matters

There is a Vienna-based startup that we will never forget. They were told, repeatedly, that they were building a medical device. They insisted — to themselves, to their investors, to anyone who would listen — that they were not. They got a product onto the market without MDR compliance. Gained traction. Started generating revenue. Things looked good for a little while.

Then a competitor sued them. The court ruled they must stop selling until the device was MDR-compliant. Revenue went to zero overnight. They finally hired Tibor. He looked at the device and told them what was especially bitter about the situation: the device, as designed and intended, was a Class I device. No Notified Body was needed. The regulatory path would have been the fastest and cheapest available under the Regulation — a matter of organized documentation and self-certification per Article 52(7) and Annex IV. If they had started the work 18 months earlier, the cost would have been a fraction of what they had already spent fighting the legal battle. Instead, they had burned the runway on lawyers and lost revenue. The company went bankrupt.

The pattern is common enough that Felix can name four other stories just like it from his coaching practice, and Tibor sees one every few months. Not starting regulatory work is the most expensive decision a MedTech founder can make. And it is expensive precisely because founders think they are saving money.

At the other end, Felix has worked with founders who claimed they would have the full CE mark "in two months." They needed three bridge rounds and were still not on the market two years later. Two-month MDR timelines are not optimistic — they are a fantasy. A founder who promises them is either lying or has never been through the process.

The decision that unblocks everything: intended purpose

The intended purpose is the single most consequential decision in the regulatory process. MDR Article 2(12) defines intended purpose as "the use for which a device is intended according to the data supplied by the manufacturer on the label, in the instructions for use, or in promotional or sales materials or statements, and as specified by the manufacturer in the clinical evaluation." It is the manufacturer's own statement of what the device is for.

That statement determines whether the product is a medical device at all, per MDR Article 2(1). It determines the classification under Article 51 and the rules in Annex VIII. It determines the conformity assessment route under Articles 52 and 53. It determines what clinical evidence is required under Article 61 and Annex XIV. It determines the PMS obligations under Articles 83 to 86.

Change the intended purpose, and every downstream decision changes. Classification might jump a class. Clinical evidence requirements might shift from literature review to a full pre-market clinical investigation. Conformity assessment might move from self-certification to full Notified Body involvement. A month of intended-purpose drift can translate into a year of downstream regulatory rework.

This is why "start regulatory work on day one" is bad advice for startups. On day one, the intended purpose is an educated guess. Starting the QMS machinery, the technical documentation, the risk file, and the clinical evaluation against a moving intended purpose is how you end up with the Graz over-documentation problem — documentation that is immediately out of date, thrown away with every pivot, and never actually useful.

But "wait until we have a product" is equally wrong, because by the time the product exists the founder has made dozens of design decisions that should have been informed by regulatory constraints. The right answer is in between.

The trigger: a stable intended purpose

The correct trigger for starting MDR regulatory work is not a calendar date or a milestone like "prototype complete" or "first customer." It is a stable intended purpose.

"Stable" means three things simultaneously. First, you can write the intended purpose down in a single paragraph that captures the medical condition addressed, the target patient population, the intended user, the clinical benefit, and the setting of use. Second, that paragraph has not changed for 60 days — no new edits, no arguments among founders, no "we should also add X." Third, everyone on the team who matters — technical lead, clinical lead, founder — can defend every word of it when pressed by a hostile question.

The 60-day stability test matters because intended purpose drift is invisible while it is happening. A founder who changes the phrasing twice a month does not feel like they are pivoting. They feel like they are polishing. But a regulatory file built on a phrasing that keeps drifting is a regulatory file that never reaches closure.

When those three conditions are met, start regulatory work. Not before. Not after. Exactly then.

What "starting regulatory work" actually means at this moment

At the stable-intended-purpose moment, the first regulatory activities are not QMS build-out or technical file drafting. They are the four decisions that unblock everything else.

Decision 1: Is it a medical device at all? Apply MDR Article 2(1) and the MDCG Borderline and Classification Manual (Version 4, September 2025) to the intended purpose. If the answer is uncertain, engage expert judgment before committing.

Decision 2: What class is it? Apply MDR Annex VIII rules. For software, MDCG 2019-11 Rev.1 (June 2025) is the primary guidance. For harder cases, MDCG 2021-24 is the comprehensive classification guide. Class determines almost everything that comes next.

Decision 3: What conformity assessment route applies? Per MDR Article 52 and the corresponding annexes (Annex IX full QMS + technical documentation assessment, Annex X type examination, Annex XI production quality assurance, and so on). Different routes mean different cost, timeline, and NB involvement.

Decision 4: Which Notified Body, if any? This is a strategic decision, not an administrative one. Capacity, scope designation, communication speed, and fit all vary enormously between NBs. This decision alone can mean the difference between 6 months and 18 months of waiting.

These four decisions can be made in one to two weeks of focused work with a competent regulatory sparring partner. Without a partner, they can take months and still be wrong. The ROI on getting these decisions right early is the highest of any regulatory spend a startup will make.

Everything else — the QMS build, the risk file, the technical documentation, the clinical evaluation, the PMS system — comes after the four decisions are settled.

What should NOT happen on day one

A few things founders routinely start too early.

  • Building a full ISO 13485 QMS before the classification is known. The depth and scope of QMS obligations scale with class. A QMS sized for a Class III device will crush a Class I startup. A QMS sized for Class I will be inadequate for anything higher. Size it after you know.
  • Writing a technical file template. Templates look like progress. They are mostly waste. The technical file gets written against the real device, the real intended purpose, and the real classification — not a speculative placeholder.
  • Starting clinical evaluation planning. Clinical evaluation per MDR Article 61 and Annex XIV depends heavily on classification, device type, and whether literature, equivalence, or clinical investigation will be the primary source of evidence. None of that can be decided without a stable intended purpose.
  • Engaging a Notified Body. Notified Bodies are expensive and their time is scarce. Starting the conversation before you have a clear intended purpose, classification, and assessment route wastes their time and yours. You do not want to be the founder the NB remembers as "the one who did not know what their device was."

Common mistakes startups make with timing

  • Delaying until pressure forces it. The Vienna bankruptcy pattern. Every month of delay compounds the cost of eventual compliance.
  • Starting everything at once. Founders who read one article and decide to build a QMS, hire a PRRC, and draft a technical file in the same week. Burnout and wasted work.
  • Starting before the intended purpose is stable. The Graz over-documentation pattern. Paralysis dressed in diligence.
  • Waiting for "more data." Intended purpose is not a data problem. It is a strategic decision. More data rarely makes it clearer. More conversations with clinicians often do.
  • Outsourcing the decision itself. A consultant can help you sharpen the intended purpose, but they cannot choose it for you. Founders who ask "what intended purpose should I pick?" are asking the wrong question.

The Subtract to Ship approach to timing

The discipline is: do nothing until a concrete regulatory decision unblocks concrete downstream work. Then do only that decision. Then the next.

The four-decision sequence above (device or not → class → route → NB) is exactly this discipline applied to the start of regulatory work. Each decision unblocks a specific set of next activities. None of the downstream activities should begin until the upstream decision is settled.

Tibor has a line he uses with founders who want to "get started on everything in parallel." Every euro you try to save by rushing through the early decisions will cost you hundreds or thousands later. Slow and correct on the first four decisions. Then fast and focused on everything that follows.

Reality Check — Where do you stand?

  1. Can you state your intended purpose in one paragraph, right now, without looking it up?
  2. Has that paragraph changed in the last 60 days?
  3. Do you know, with confidence, whether your product is a medical device under MDR Article 2(1)?
  4. Do you know your classification under Annex VIII, and can you name the specific rule that applies?
  5. Do you know your conformity assessment route under MDR Article 52?
  6. If the answer to any of the above is "no" or "not sure," have you engaged someone qualified to help you get to yes?
  7. What is your honest estimate of the cost of being wrong about any of the above, in euros and in months?

Frequently Asked Questions

How early is too early to start MDR work? Before the intended purpose is stable. The earliest useful regulatory work is a one-paragraph intended purpose statement and a classification sketch. Anything more is premature.

Can I start regulatory work in parallel with R&D? Yes — once the intended purpose is stable. Phase 1 feasibility work (see the two-phase development approach) should precede formal regulatory work in most cases. Parallel work is fine once feasibility is demonstrated and the intended purpose is fixed.

What is the single most important first regulatory decision? The intended purpose statement itself, closely followed by classification. Get these two right and everything else is downstream work. Get either wrong and everything else is rework.

What if my intended purpose is still changing? Then you are not ready to start MDR work. You are still in product discovery. Finish discovery first. Trying to run regulatory activities on a moving intended purpose wastes time and money.

How much does it cost to get the first four decisions right? Typically between a few thousand euros of expert consulting and a few tens of thousands depending on device complexity and the founder's own regulatory literacy. Compared to the cost of getting these decisions wrong — months to years of rework, or bankruptcy — it is the highest-ROI spend in the entire MedTech journey.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 2(1) (definition of medical device), Article 2(12) (intended purpose), Article 10 (manufacturer obligations), Article 51 (classification), Articles 52–53 (conformity assessment), Article 61 and Annex XIV (clinical evaluation), Articles 83–86 (post-market surveillance), Annex IV (EU declaration of conformity), Annex VIII (classification rules), Annex IX (full QMS and technical documentation conformity assessment). Official Journal L 117, 5.5.2017.
  2. MDCG 2019-11 Rev.1 (June 2025) — Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 — MDR and Regulation (EU) 2017/746 — IVDR.
  3. MDCG 2021-24 — Guidance on classification of medical devices, October 2021.
  4. Borderline and Classification Manual, Version 4, September 2025 — Manual on borderline and classification for medical devices under Regulation (EU) 2017/745.
  5. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes.

This post is part of the MDR Fundamentals & Regulatory Strategy series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The four-decision sequence at the start of regulatory work is one of the highest-leverage moments in the MedTech journey — and also one of the most common moments at which founders benefit from a sparring partner who has made these decisions many times before.