Why regulatory planning must start early
There is a version of this story that plays out in health technology companies every year. The product works. Clinicians like it. A buyer is interested. Then someone asks whether it is a medical device, and the answer turns out to be yes, and the next nine months are spent producing documents about work that was finished long ago.
Retrofitting compliance is legal, common and avoidable. It is also the most expensive way to reach market.
Why late compliance costs more than early compliance
Documentation cannot be back-filled honestly at low cost. A technical file is not a description of the product; it is evidence of how the product was designed, verified and risk-managed. Standards such as IEC 62304 for medical device software expect a lifecycle: requirements, architecture, unit verification, integration testing, configuration and problem resolution, all traceable. Reconstructing that trail for software written without it means re-reading code, re-running tests and writing rationale for decisions nobody recorded.
Risk management drives design, not paperwork. ISO 14971 expects hazards to be identified and controlled by design where possible. Discovering a hazard after launch usually means a design change, not a warning in the manual.
Quality systems change how teams work. ISO 13485 governs design controls, supplier management, change control and post-market activity. Introducing it mid-flight interrupts delivery and frustrates engineers who have never worked that way.
Claims get cut. The fastest route out of trouble is often to narrow the intended purpose, which narrows what marketing and sales can say. That is a commercial loss, not just a regulatory one.
The regulatory ground is moving
The UK and EU frameworks are both in transition, which increases the cost of guessing.
In Great Britain, new post-market surveillance requirements took effect on 16 June 2025, tightening obligations for monitoring devices once they are on the market. In May 2026 the MHRA published draft Medical Devices (Amendment) Regulations 2026, proposing an international reliance pathway for devices approved by trusted overseas regulators, formal predetermined change control plans for AI and software, revised IVD classification, unique device identification and strengthened post-market obligations. Commentators expect adoption around the end of 2026, with core provisions applying from mid-2027 (MedDeviceGuide, 2026; Patient Guard, 2026).
Meanwhile CE-marked devices may still be placed on the Great Britain market until 30 June 2028 or 30 June 2030, depending on the device and the EU legislation it complies with, and the MHRA has consulted on recognising EU MDR and IVDR devices indefinitely (MHRA, Regulating medical devices in the UK; Latham & Watkins, 2026).
In the EU, notified body capacity remains the practical constraint, with reported review timelines of roughly 12 to 24 months for higher-risk devices (ElendiLabs, 2026). A queue of that length cannot be absorbed by a company that discovers it needs a notified body six weeks before a launch date promised to investors.
For AI-enabled devices there is a second regime. The EU AI Act’s high-risk obligations were deferred by the Digital Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026: AI embedded in products covered by sectoral law such as the MDR now applies from 2 August 2028, with standalone Annex III systems from 2 December 2027 (White & Case, 2026). The deferral buys preparation time, not exemption: if your device needs a notified body under the MDR or IVDR, it is high-risk under the AI Act, and the requirements are folded into the conformity assessment you already run (MDCG 2025-6 guidance summarised by mdxCRO, 2026).
What early regulatory work actually looks like
It is less onerous than founders fear, and it is mostly decisions rather than documents.
- Write the intended purpose before you write the code. Everything else, including classification, evidence and claims, follows from it.
- Classify early, in every target market. Classification determines whether you need a notified or approved body, and therefore your timeline and cost base.
- Choose your standards up front. ISO 13485, IEC 62304, ISO 14971 and IEC 62366 shape how the team works; adopting them at the start costs a fraction of adopting them later.
- Design the evidence with the product. Clinical evaluation, usability and performance data are cheaper to collect while you are building than to recreate afterwards.
- Plan for change. Software changes constantly. Predetermined change control plans, where available, let you define in advance which modifications you can make without a new assessment.
- Keep a regulatory plan investors can read. Diligence will ask. A credible plan is an asset in a funding round.
The commercial argument
Regulatory work is often framed as a tax on innovation. In practice it is closer to insurance on valuation. A company with a clean intended purpose, a defensible classification, a working quality system and an evidence plan can enter markets predictably, answer diligence quickly and price with confidence. A company without those things carries an unquantified liability that surfaces at the worst possible moment, usually during a funding round or a major procurement.
How FastForward can help
We work with software medical device and digital health companies to make regulation a planned part of product development rather than a crisis.
- Classification and intended purpose. A clear, defensible position for the UK and EU, and what it means for your claims.
- Regulatory strategy and roadmap. The route, the body, the standards, the timeline and the cost, mapped against your commercial plan.
- Quality system design. Pragmatic ISO 13485 and IEC 62304 implementation sized for a small team.
- Remediation. Where compliance has been left late, we help you prioritise what must be fixed before launch and what can follow.
To discuss your product, email hello@fwdtech.co.uk.
References
1. MHRA, Regulating medical devices in the UK, GOV.UK — https://www.gov.uk/guidance/regulating-medical-devices-in-the-uk
2. MedDeviceGuide (2026), UK MHRA International Reliance Pathway: draft regulations 2026 — https://meddeviceguide.com/blog/uk-mhra-international-reliance-pathway-draft-regulation-2026-guide
3. Patient Guard (2026), The MHRA 2026 regulatory roadmap explained — https://patientguard.com/the-mhra-2026-regulatory-roadmap-explained/
4. Latham & Watkins (2026), UK MHRA consultation on indefinite recognition of CE-marked devices — https://www.lw.com/en/insights/uk-mhra-launches-consultation-on-indefinite-recognition-of-ce-marked-medical-devices
5. ElendiLabs (2026), EU medical device regulation in 2026 — https://elendilabs.com/en/articles/eu-medical-device-regulation-2026-comprehensive-analysis
6. White & Case (2026), EU AI Omnibus enters into force — https://www.whitecase.com/insight-alert/eu-ai-omnibus-enters-force-amending-ai-act
7. mdxCRO (2026), EU AI Act for medical devices and SaMD — https://mdxcro.com/eu-ai-act-medical-devices-samd/