”A forty person SaMD company shipping model updates against a Class IIa claim set has regulatory sitting on the critical path of every release. Not support. The throttle on the roadmap”
Why I am the one writing this
I have spent fourteen years standing in an unusual place: one foot in Quality and Regulatory, one foot in Operations. I have run a manufacturing operation with a hundred plus people and carried the throughput and cost accountability that comes with it. I have also led an IVDR transition, built a first eQMS, taken a site through its first MDSAP, and owned QA/RA for an AI-SaMD platform.
That intersection is the reason I can write the next section: I have sat on both sides of the table when the regulatory number and the operations number were in direct conflict, and I have been the person who had to reconcile them. I have refined that conversation many times, from both chairs.
From the Operations chair, I learned that QA/RA almost never arrives with a number an operator can act on. From the QA/RA chair, I learned that we usually have the data and simply do not convert it. That gap is the subject of this article
The Uncomfortable Part First
Look at what a normal quarterly review contains. Fourteen SOPs revised. Three internal audits completed. Ninety two percent CAPA on-time closure. Notified Body audit passed with two minors. Training compliance at 98 percent.
Every line describes work performed. Not one describes cash accelerated, margin protected, or risk priced. It is a description of effort, and effort is a cost. The function submits a cost report and is then wounded that it was booked as a cost.
The usual defences do not survive contact with that observation. “We prevent catastrophic failure” is true, and so does insurance, which is also a cost line. Prevention does not lift you out of overhead. It makes you overhead that people are afraid to cut. “Nothing ships without us” is an argument from obstruction rather than contribution, and a tollbooth is on the critical path too.
And before anyone accuses me of talking down my own profession, note who reached this conclusion first. FDA’s Case for Quality initiative grew out of a 2011 study that found something the industry still has not absorbed: being compliant did not reliably predict whether an organisation avoided quality problems. The regulator looked at pass/fail compliance, the thing we spend our budget producing, and concluded it was not the signal.
If compliance is not even a good predictor of quality, it is certainly not a good argument for being treated as strategic.
So the label is earned. That is the concession, and it is not a rhetorical move. It is where the argument starts, because once you accept it you are forced onto a much more interesting question: under what conditions does it stop being true?
The Wrong Axis is Company Size. The Right axis is Rate of Change
This debate usually gets segmented by size. Startups get told they need real regulatory strategy, mid-size firms are allowed their grievance, large firms are told they are just maintaining a tested system. That segmentation is wrong, and it is why the conversation goes nowhere.
The variable is not headcount or revenue. It is how fast the product and its claims change.
A four thousand person company selling an unchanged Class I device into unchanged markets since 2014 has, in economic terms, an advanced clerical need. The system is built, the claims are fixed, the markets are open. Maintenance is the correct spend, and anyone in that company insisting QA/RA is a hidden strategic engine is asking to be ignored.
A forty person SaMD company shipping model updates against a Class IIa claim set has regulatory sitting on the critical path of every release. Not support. The throttle on the roadmap.
Same job title, same standards, opposite economics.
That reframing kills the guild argument, which is the point. The function is not universally strategic and we should stop pretending it is. It becomes strategic exactly when the rate of change is high, and it stays clerical when the rate of change is low. That is diagnosable. It has an answer. It is not a culture complaint.
Mechanism One: Approval Date is Revenue Start Date
Approval and audit clearance are the entry fee, and nobody pays a premium for the entry fee. Here is the mechanism nobody computes.
The European Commission’s Notified Body survey published in March 2026, with data through October 2025, shows 3,634 IVDR applications against 2,194 certificates issued. Team-NB puts typical conformity assessment at nine to twenty four months, and its own member survey puts the majority of IVDR certificates in a thirteen to eighteen month band. The most frequently cited reasons applications stall are not scientific. They are incomplete documentation and misclassification.
Read that last sentence again. It is the whole argument in one line. The bottleneck is substantially self-inflicted, and we are the ones inflicting it.
Now price it. Take a Class C IVD under IVDR with a board-approved plan of EUR 12 million in year one. Call it EUR 1 million a month, roughly EUR 230,000 a week of plan. A round of major deficiencies is not a document exchange. It is a clock stop, a response cycle, a re-review and a re-queue, and the queue position is not yours to control. Three to six months per round is realistic.
Two avoidable rounds is therefore not “some back and forth with the NB.” It is six to twelve months of deferred revenue landing in a different fiscal year, against a number someone already said out loud to investors.
What would have prevented it is unglamorous. A structured pre-submission gap assessment. A senior reviewer with review-side instincts reading the technical documentation adversarially before it leaves the building. Clinical evidence mapped to the specific claim rather than assembled and hoped over. Call it EUR 60,000 to 80,000 of internal and external effort, against six figures a week of exposure.
Notice what I am not claiming. RA does not generate the EUR 12 million. Sales does. RA determines when it starts, and in a business with a cost of capital and a fiscal calendar, when is worth a great deal. That is not a revenue center and I would not insult a CFO by calling it one. It is a time-to-revenue lever, which is language finance already owns.
Mechanism Two: The Margin is Already in the P&L - Unlabelled
McKinsey’s Capturing the value of good quality in medical devices put the industry’s direct cost of quality at roughly 6.8 to 9.4 percent of sales. The part that should stop a CFO mid-scroll is the split: only about a third of that is the cost of ensuring good quality. The rest is the direct cost of poor quality. Scrap, rework, complaints, recalls, regulatory action.
The same work estimates that segment-leading practice can recover in the order of 1.5 to 3.0 percent of sales.
Sit with the size of that. It is not a compliance statistic. It is basis points of operating margin, and it is larger than most of the efficiency programmes the business runs with far more ceremony.
Yet the function that owns that number almost never states it in those terms, and most companies cannot produce their own cost of poor quality on request. We hold the ledger for one of the largest recoverable margin pools in the business and we report it as CAPA closure percentage.
Mechanism Three: Claims Determine Price, Registrations Determine Market
What you are legally permitted to say determines what you can charge, whether it is reimbursed, and which tenders you can enter. That chain runs from evidence strategy to label claim to reimbursement pathway to price, and every link is owned or heavily shaped by Regulatory. Almost none of it is ever described in pricing terms, which is precisely why it gets filed as paperwork rather than recognised as the binding constraint on the commercial model.
The same logic applies to geography. Registration breadth is addressable market expressed in a different unit. Percentage of revenue from markets opened in the last twenty four months is a regulatory output and a growth metric at the same time, and I have almost never seen it on a regulatory dashboard.
Mechanism Four: The PCCP is a Product Velocity Feature
ment reaches a user four to nine months later, if the roadmap survives the wait. With an authorised PCCP, the same change is pre-approved and ships under change control.
The FDA’s final guidance on PCCPs for AI-enabled device software functions sets out exactly what the plan must contain. The joint FDA, Health Canada and MHRA guiding principles confirm this is an international direction of travel, not a single-jurisdiction quirk, and it sits within the FDA’s wider AI in SaMD programme.
The distance between those two worlds is the distance between one release a year and four.
That is a roadmap decision being made inside a regulatory document, by a regulatory strategist, usually with no product leader in the room aware that the roadmap was just set. That is not support work. It is release engineering conducted through a regulatory instrument.
The conversion is not Theoretical. It already has a name
Here is the part I wish more people in both chairs knew about.
FDA’s Voluntary Improvement Program, facilitated through the Medical Device Innovation Consortium, does something the industry keeps insisting is impossible. It assesses a manufacturer’s process maturity through third-party appraisal, and in return offers actual regulatory efficiencies: informing risk-based inspection planning, and streamlining certain premarket submission activity such as 30-day change notices and site changes. FDA formalised its participation in the Fostering Medical Device Improvement guidance in 2023, and the original pilot report is public.
Read what that actually is. Operational maturity, measured, exchanged for regulatory burden reduction, which converts to cycle time, which converts to cash. A regulator built the bridge between the QA/RA chair and the COO chair and published the blueprint, and most quality functions still discuss it as a compliance curiosity rather than as the proof of concept for their own repricing.
The evolution people keep asking about is not hypothetical. Someone already built a working example. We just did not read it as an economic instrument.
The metrics split, which is the whole argument
On one side, the metrics that price you as clerical, and price you correctly: SOPs revised, audits passed, CAPAs closed on time, training completion, documents released, nonconformities per audit.
On the other, the metrics that price you as an asset:
First-pass acceptance rate. Percentage of submissions closing with zero major deficiencies.
Submission cycle time, split. Days you control versus days the Notified Body controls. Only one of those measures your performance.
Regulatory-attributable revenue delay. Weeks between planned and actual approval, multiplied by weekly revenue plan.
Revenue per registered market, and revenue from markets opened in the last twenty four months.
Cost of poor quality as a percentage of revenue, trended, with scrap, rework, field actions and recall reserve inside it.
CAPA recurrence rate, not closure rate. Closure measures administration. Recurrence is the only honest measure of effectiveness.
Process maturity level, appraised rather than self-declared.
For SaMD: releases shipped under PCCP per year against releases requiring a new submission.
Here is the part my own profession will not enjoy. Almost none of these are measured. The underlying data mostly exists already, sitting in the eQMS, unconverted. The failure to express it in economic language is not management’s fault. It is ours, and it is the entire reason the classification has not moved.
What the four people at the top actually do with this
CEO. Ask which company you are: high rate of change or low. If high, your regulatory strategist is setting your roadmap whether or not anyone has noticed, and they belong in the room where the roadmap is set. If low, stop asking that team to be strategic and let them be excellent at maintenance instead. Both answers are respectable. The ambiguity is not.
CFO. Ask for three numbers: first-pass acceptance rate, regulatory-attributable revenue delay, and cost of poor quality as a percentage of sales against the 6.8 to 9.4 percent benchmark. If the function cannot produce them, you have learned something real about the function. If it can, you have just acquired a forecasting input and a margin programme you did not have this morning.
COO. Cost of poor quality and CAPA recurrence are operations metrics wearing a compliance costume. Take them back. I have run that argument from your chair, and the function will not hand them over until you ask.
QA/RA. Stop asking for a seat at the table. Nobody at that table is negotiating for your inclusion. Bring one number, in their unit, that changes a decision they were about to make. Do it twice and the seat question resolves itself permanently, without a single conversation about respect.
The Clock is About to Become Public Anyway
Here is why this stops being optional.
In December 2025 the Commission moved on the conformity assessment process itself, alongside a broader package of targeted MDR and IVDR revisions. The direction includes standardised quotation inputs, maximum timelines for each review stage, structural limits on the serial interruptions that make review durations so unpredictable, and public reporting by Notified Bodies on duration and cost. EUDAMED’s first four modules became mandatory on 28 May 2026, which means certificate and registration status is increasingly a matter of public record rather than internal folklore.
Translate that. Regulatory cycle time is becoming an externally published, comparable number. Your competitor’s number will be visible. Yours will be visible.
At that point the argument I am making stops being a professional development suggestion and becomes a benchmarking exercise someone else runs on you. The functions that already measure themselves in economic units will be fine. The functions still reporting SOPs revised will be measured anyway, by people who never asked them how they would like to be framed.
The Honest Close
The cost center label is not an insult. It is a valuation, and valuations respond to evidence.
We have spent a decade arguing that the valuation is unfair, which has produced nothing, because an appeal does not move a P&L. The alternative is duller and works: measure what is already true, say it in the language finance already speaks, and let the classification move on its own.
Approval and audit clearance are the bare minimum. The value starts after.
If the function will not do that work, the label stands, and it should.
Open the link one that Relates your Chair
CEO: European Commission, targeted MDR and IVDR revisions. The rules your market access depends on are being rewritten right now.
CFO: McKinsey, Capturing the value of good quality in medical devices. Cost of quality at 6.8 to 9.4 percent of sales, two-thirds of it the cost of poor quality, and a recoverable pool measured in basis points of margin.
COO: FDA Case for Quality and the Voluntary Improvement Program. Compliance does not predict quality, maturity does, and maturity is purchasable regulatory relief.
QA/RA: Team-NB on certification timelines and the FDA PCCP final guidance. One tells you what your delay costs. The other tells you what your leverage looks like.
I would like to be argued with on this one, particularly by anyone who has actually put first-pass acceptance rate in front of a board.
