Balancing Innovation and Regulation in MedTech Development with Karandeep Singh Badwal | Ep. 35 - Full Transcript | The Med Device Cyber Podcast
Read the complete, searchable transcript of Episode 7 of The Med Device Cyber Podcast - expert conversations on medical device cybersecurity, FDA premarket and postmarket guidance, SBOM management, threat modeling, and penetration testing.
Prefer the listening experience? Open the episode page for the synopsis, key takeaways, topics, and Apple / YouTube listen links.
Episode summary
In this episode of The Med Device Cyber Podcast, hosts Christian Espinosa and Trevor Slattery are joined by Karandeep Anand, a UK-based quality and regulatory consultant and founder of QRA Medical. The discussion centers on the complex landscape of regulatory affairs and quality management systems (QMS) for medical devices, with a particular focus on the unique challenges presented by Software as a Medical Device (SaMD) and artificial intelligence (AI). Karandeep shares his background, which began in pharmaceutical science before pivoting to the medical device industry. Over the last several years, his work has concentrated on the burgeoning field of software, AI, and machine learning, where he observes a significant disconnect between rapid innovation and the rigorous demands of regulatory compliance. He also hosts the MedTech Podcast, aiming to demystify these often-confusing topics for a wider audience. The core of the conversation revolves around the common pitfalls that MedTech startups and innovators encounter. Karandeep draws a helpful analogy, describing regulatory affairs as the "offense" (getting the product to market) and quality management as the "defense" (ensuring the product and processes are safe and effective through proactive, preventative measures). He argues that quality is not just a department but a fundamental company culture. A major issue he frequently encounters is companies developing their software products well into advanced versions before considering a QMS or proper design controls. This creates a massive, often insurmountable, challenge of retrospectively building a design history file and validating the product's development, a process that should have been integrated from the very beginning. Similarly, cybersecurity is often treated as an afterthought, with companies conducting penetration tests on early versions that become irrelevant as the software rapidly evolves, leaving the final product with unassessed vulnerabilities. Karandeep and the hosts also explore the broader reasons for the high failure rate among MedTech startups. Beyond technical hurdles, many ventures fail due to a lack of early planning around market fit, reimbursement strategies, and the specific regulatory pathways for their target markets. A crucial piece of advice is for companies to shift their mindset: they are not software companies that happen to make a medical device, but medical device companies that use software. This perspective change prioritizes the highly regulated nature of the industry from day one. He stresses that integrating regulatory, quality, and cybersecurity frameworks at the project's inception is far more cost-effective and efficient than trying to patch them in later. The conversation underscores that while standards like IEC 62304 provide a baseline, the dynamic nature of AI and software demands a more continuous and integrated approach to ensure patient safety and successful market entry.
Key takeaways from this episode
- Quality management should be viewed as a proactive, preventative "defense" and a company-wide culture, while regulatory affairs is the "offense" focused on achieving market approval.
- A major pitfall for software medical device companies is neglecting to implement a Quality Management System (QMS) and proper design controls from the start, making regulatory compliance difficult and costly to achieve retrospectively.
- Many innovators treat their product as a software product first and a medical device second. To succeed, this mindset must be flipped to prioritize the rigorous requirements of a regulated medical device from its inception.
- Cybersecurity is often an afterthought in SaMD development. Companies must integrate continuous security testing, such as penetration testing, throughout the agile development lifecycle, not just on early versions.
- The validity and quality of data used to train AI and machine learning models are critical for regulatory submission but are often an area where companies lack sufficient documentation and validation.
- Successful MedTech startups do extensive early-stage research not just on technology, but also on their target markets, reimbursement pathways, and specific regulatory hurdles like FDA or EU MDR requirements.
- The agile, fast-moving development process common in the tech world often clashes with the structured, documentation-heavy design control process required for medical devices.
- Building quality and regulatory frameworks into the product lifecycle from day one is significantly cheaper and more effective than trying to apply them after the product is already developed.