From Concept to Compliance: A Guide to Med Device Approval | Ep. 24 - Full Transcript | The Med Device Cyber Podcast
Read the complete, searchable transcript of Episode 16 of The Med Device Cyber Podcast - expert conversations on medical device cybersecurity, FDA premarket and postmarket guidance, SBOM management, threat modeling, and penetration testing.
Prefer the listening experience? Open the episode page for the synopsis, key takeaways, topics, and Apple / YouTube listen links.
Episode summary
In this episode of The Med Device Cyber Podcast, host Trevor Slattery is joined by Mark Swanson and Steve Gompertz, partners at QRX Partners, a consulting firm specializing in quality and regulatory affairs for the medical device industry. The conversation centers on the critical importance of navigating the complex regulatory landscape, particularly for small and early-stage MedTech companies. Swanson and Gompertz, who have extensive experience from large corporations like Medtronic, established QRX Partners to serve this often-underserved market. They argue that many startups, typically founded by brilliant engineers or doctors with a great product idea, have little to no understanding of the regulatory pathway, leading to significant and often fatal missteps. Their firm aims to provide this crucial guidance from the outset, helping companies with everything from initial device classification and defining the intended use, to building a robust Quality Management System (QMS) and planning for funding rounds. The guests emphasize that seeking expert regulatory help early is a form of preventative action, which is always far less expensive than the corrective actions required after a failed submission or a negative FDA finding. They share an anecdote about an investor whose portfolio has a 93% failure rate, a statistic they attribute largely to companies running out of money due to underestimating the time and cost of the regulatory process. A core part of their work is formalizing what's in the founders' heads into a concrete regulatory strategy. This begins with the most fundamental step: accurately classifying the device. They illustrate the complexity of this task with an example: a simple search for "balloon" in the FDA database yields over 30 different product codes, each with a different classification and regulatory pathway. Without expert navigation, a company can easily choose the wrong path, leading to wasted time and resources. The discussion also delves into the nuances of current hot topics like AI, machine learning, and cybersecurity. Swanson and Gompertz clarify that while AI is often used as a marketing buzzword, the underlying technology isn't new. The key regulatory distinction is whether the AI or machine learning is a tool used during development or if the device itself is designed to learn and adapt *after* it's on the market—the latter of which invites intense scrutiny from regulators. They also address a common misconception regarding the FDA's definition of a "cyber device," explaining that it applies to any device with software, not just those with network connectivity. Ultimately, they stress that whether dealing with established regulations or emerging technologies, the principle remains the same: understand the requirements, document everything within a compliant QMS, and don't be afraid to ask for help before you've gone too far down the wrong path.
Key takeaways from this episode
- Early-stage medical device companies often underestimate the time and money required for regulatory approval, a primary reason for the high failure rate in the industry.
- Engaging with quality and regulatory (Q&R) experts early in the development process is a critical preventative action that is far less expensive than correcting major issues downstream.
- The first step for any MedTech startup should be to formally define the device's 'Intended Use' and correctly determine its regulatory classification, as this dictates the entire pathway to market.
- Startups should avoid being 'hobbyists' in the regulatory space; the landscape is too complex and the cost of mistakes is too high.
- FDA 'guidance' documents, while technically not law, should be treated as requirements, as they reflect the agency's current expectations for submissions.
- The definition of a 'cyber device' is broad. A product is typically considered a cyber device if it contains software OR has connectivity, not necessarily both.
- While AI and machine learning are popular marketing terms, devices that are designed to learn and change after market release face significant regulatory hurdles and require a carefully managed development process.
- Building a compliant Quality Management System (QMS) before or during product design, rather than after, is essential for a smoother and more successful regulatory approval journey.