It's been a very long while - our last newsletter was in October 2025. Since then, I had operated under the assumption that my time was better spent on other activities. Turns out, I was wrong - a friendly dudess at DMEA (see below) asked me what the hell had happened to the newsletter. Apparently, she and other humans on her teams enjoyed reading it and, every time, they would send around some funny quotes from it for the next few days.

So here's another edition; I do hope I can continue to deliver on the funny quotes (no pressure, right).

Besides that.. I've detached myself a bit from the day-to-day changes of EU regulation to preserve my mental sanity and not lose trust in the general organizational fabric of our society ("you don't want to know how the sausage is made"). It turns out that this strategy worked really well because the EU has developed a recent tendency to simply postpone, revert, or both postpone and revert their planned regulations - see below.

DMEA 2026: No more startups?

We attended DMEA, a huge medical device conference in Berlin. What struck me was that 1) people actually recognize us (this "OpenRegulatory" company seems to be a real thing) and 2) there weren't a whole lot of truly new "product" startups around.

I feel bit like a dinosaur in this space - I remember the overall enthusiasm of building stuff back in 2018-2022, when every dude, dudess and their dog was founding a Healthtech startup and going to market pretty-much-instantly as MDD class I device. All of that has disappeared, and I feel like no one seems to remember it. Instead, people get lost in details which don't matter, like nitty-gritty change proposals to the upcoming AI Act and MDR, where the more appropriate solution would be to throw them out entirely and start from scratch.

Besides that.. we had awesome conversations at the conference with the (few) remaining founder people actually building things, notably with a founder dudess who encouraged me to write the newsletter again (thanks!). I have a lot of respect for people building in this space nowadays, it's an epic regulated mess. Still - there's hope. Good luck!

​Here's a longer write-up of my DMEA thoughts, and here's the LinkedIn discussion.

Free Medical Device Roadmap!

Here's an awesome freebie for you - our medical device roadmap. We had quite an elaborate internal discussion on how to handle this, because it contains a huge chunk of our accumulated consulting knowledge of the past ~5 years. We could probably sell it for 5k€ or so, but then we'd be in the business of selling PDFs, and I think it's fair to say that humanity has concluded that selling PDFs (especially ISO standards) is a very questionable line of business, at least for most humans with an intact understanding of ethical business practices.

So we just made it available for free. You can either access it via Formwork, which is the way better user experience because you can click on things, or you can download it as PDF by clicking on this link and scrolling down to the download link. No strings attached!

As always, the goal is to provide you with everything you need to get your own medical device certification done, for free.

Claude Code + eQMS = 📈 (MCP Server)

Our eQMS software, Formwork, now has an MCP server. That means you can use it with Claude Code or any other LLM agent of your choice. The possibilities are amazing. Here's a quick video walkthrough:

​

And here's the link to our docs.

EUDAMED Milestone: Mandatory use of first four modules confirmed for May 2026

It's hard to believe that progress is being made on EUDAMED. The European Commission has formally declared that the first four EUDAMED modules have reached full functionality and meet all required specifications. In accordance with the transitional provisions of Regulation (EU) 2024/1860, this publication triggers a six-month window for manufacturers and stakeholders to finalize their integration. The Deadline is 28th, May 2026 (that's pretty soon).

Effective then, usage of the modules Actor Registration, UDI/Devices Registration, NBs & Certificates and Market Surveillance will become mandatory.

Link to MDCG statement here.

(Want to hear a fun fact? Under the AI Act, the EU plans to build a similar database like EUDAMED, but this time for keeping track of AI software. Given the EUs great track record on building databases, let's just say I'm skeptical that this database will be delivered on schedule and on budget)

Micro-managing Notified Bodies: New EU Rules set strict deadlines

As a regulatory consultant, I've had the questionable pleasure of working with some companies which were completely mis-managed. Now, one of the hallmarks of a mis-managed company is that, once the (incompetent) managers realized that hardly anything got done and progress was slow, they would swoop in and create a spreadsheet with arbitrary deadlines. The lower-level employees were then left to scramble to somehow achieve these deadlines. Needles to say, this never worked.

Now, the EU has realized that MDR certifications hardly get done and progress is slow, and likewise, the EU has swooped in and created Regulation 2026/977 with arbitrary deadlines for notified bodies, just like an incompetent manager.

The notified bodies are now left scrambling, trying to work within these deadlines. The root cause, of course, is the complexity of the MDR, but fixing or repealing that would of course be politically way less popular than just issuing a new regulation with some hard deadlines instead.

Here's a quick summary:

The regulation introduces specific, non-negotiable timeframes for various stages of the conformity assessment process. If you are planning a submission or a change, these are the numbers you need to know:

Initial certifications:

• Application & Contract: Notified Bodies now have 30 days to review an application and sign the formal contract.
• QMS Audits: The clock for Quality Management System audits is capped at 120 days.
• Product Verification: Technical documentation and product verification must be completed within 90 days.

Existing certificates:

• Initial Review: Once a manufacturer proposes a change, the Notified Body has 30 days to decide if further assessment is required.
• Assessment Phase: Any necessary additional assessment activities must be wrapped up within 90 days.
• Issuance: Once approved, the actual certificate supplement must be issued within 20 days.

Good luck to everyone involved in implementing this, especially to the notified bodies.

Other MDR Updates

• New guidance MDCG 2025-10: A comprehensive guidance document designed to clarify the complex requirements for post-market surveillance (PMS) under the MDR and IVDR. The core message of MDCG 2025-10 is that manufacturers must play an active role in the post-market phase. Key takeaways include: Systematic Gathering, Risk-Proportionate Systems and Continuous Improvement. ISO/TR 20416 provides some more hands-on information.
• Updates of the MDCG 2021-24 rev.1 and the Borderline Manual: In April 2026 the MDCG updated the guidance on classification of medical devices (MDCG 2021-24). The first revision includes mainly minor updates and wording. Unfortunately, the revision does not focus on software as a medical device.
• Also, the Manual on Borderline Classifications was updated for the fifth time in April 2026. Likewise, no (new) software examples here. But it does include a Penis Holster now - it's reassuring to see that the EU prioritizes Penis Holsters over Software. Gotta get those priorities right, I suppose.

And that's it for this time! Slightly longer than usual, but there was a lot to cover.

Have a great rest of the week!

Oliver