A reference for founders, RA/QA leads and operators building medical device companies.

The MedTech Startup Glossary

Focus on Regulatory Affairs, with adjacent Quality, Clinical, Reimbursement and Startup terms. Acronyms are spelled out on first use so any entry can be read on its own. Jurisdiction tags: [EU], [US], [UK], [INTL].

Search the glossary

1. Core regulatory concepts

Medical device: Any instrument, apparatus, software, implant, reagent, or article intended by the manufacturer for a medical purpose, such as diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease or injury, or investigation, replacement, or modification of the anatomy or of a physiological or pathological process, that does not achieve its principal intended action in or on the human body by pharmacological, immunological, or metabolic means (that would make it a drug). Definitions differ slightly between [EU] MDR Art. 2(1) and [US] FD&C Act §201(h)(1) but the concept is shared.
Intended purpose / intended use: The use for which a device is intended according to the data the manufacturer supplies on the label, in the instructions for use, and in promotional or sales materials or statements, and, in the EU, as specified in the clinical evaluation (MDR Art. 2(12)) or, for an in vitro diagnostic device, in the performance evaluation (IVDR Art. 2(12)). It is the single most consequential decision in RA: it drives classification, applicable requirements, clinical evidence needs, and claims. [US] uses 'intended use'; [EU] uses 'intended purpose.'
Indications for use: [US] term describing the specific disease/condition the device diagnoses/treats and the target patient population. Narrower and more clinical than 'intended use.'
Classification: Risk-based categorization of a device that determines the regulatory pathway and scrutiny. Higher class = higher perceived risk = more evidence and oversight. Rules differ by jurisdiction (see EU and FDA sections).
Manufacturer: The legal entity that designs/manufactures a device and markets it under its own name, and that bears ultimate regulatory responsibility. You are the manufacturer even if you outsource all production (see virtual manufacturer / OBL).
Economic operator: [EU] umbrella term for the manufacturer, authorised representative, importer, and distributor, each with defined obligations under the MDR and IVDR. Under the MDR it also covers anyone who puts devices together as a system or procedure pack, or sterilises such packs, for placing on the market (MDR Art. 2(35) and Art. 22(1) and (3)).
Conformity assessment: The process by which compliance with regulatory requirements is demonstrated before market access (e.g., CE marking route in the EU, premarket submission in the US).
Regulatory pathway / route to market: The specific sequence of submissions, assessments, and approvals required to legally place a device on a given market. Choosing it early is the foundation of a regulatory strategy.
Predicate / equivalence: Reliance on an already-marketed comparable device to reduce the evidence burden. [US] calls it a predicate (510(k)); [EU] calls it equivalence and applies stricter criteria (technical, biological, clinical).
Labeling: All written, printed, or graphic information on the device, its packaging, or accompanying it (label + Instructions for Use). Regulated content; a frequent source of non-conformities.
Instructions for Use (IFU): The manufacturer's document telling the user how to use the device safely and effectively. Content is prescribed by regulation and standards (e.g., EN ISO 20417, IEC/IEEE 82079-1).
Off-label use: Use of a device outside its cleared/approved intended purpose. Manufacturers may not promote off-label use; clinicians may sometimes practice it.
Placing on the market: The first making available of a device on a given market. The legal trigger for most obligations. [EU] distinguishes 'placing on the market' from 'putting into service.'
Grace period / transition provision: Time-limited rules letting devices certified under an old framework remain on the market while transitioning to a new one (e.g., MDR/IVDR transitional timelines).
Regulatory strategy: The documented plan mapping target markets, classifications, pathways, evidence, standards, timelines, and cost for a product. The deliverable a startup should build before spending on clinical or design freeze.

2. EU — MDR & IVDR

MDR — Medical Device Regulation (EU) 2017/745: The regulation governing medical devices in the EU, applicable since 26 May 2021. Replaced the Medical Device Directive (MDD 93/42/EEC) and AIMDD. Far more demanding on clinical evidence, post-market surveillance, and traceability.
IVDR — In Vitro Diagnostic Regulation (EU) 2017/746: The parallel regulation for in vitro diagnostics (tests run on samples taken from the body), applicable since 26 May 2022. Shifted most IVDs from self-certification to notified-body oversight.
MDD / AIMDD: The predecessor Medical Device Directive (93/42/EEC) and Active Implantable Medical Device Directive (90/385/EEC), replaced by MDR. Legacy 'MDD certificates' persist under transitional rules.
CE marking: The mark indicating a device conforms to applicable EU legislation and may be sold across the EU/EEA. Not a quality badge — a declaration of regulatory conformity.
Notified Body (NB): An independent, government-designated organization that audits QMS and reviews technical documentation for medium/high-risk devices, and issues CE certificates. The bodies designated under the MDR and IVDR, with the scope of each, are listed in the Commission's NANDO (New Approach Notified and Designated Organisations) database. NB capacity is a well-known bottleneck under MDR.
Competent Authority (CA): The national regulator in each Member State (e.g., BfArM in Germany, ANSM in France) responsible for market surveillance, vigilance, and designating notified bodies (with the Commission).
MDCG — Medical Device Coordination Group: EU expert group issuing influential guidance documents (e.g., MDCG 2019-11 on software qualification). Guidance is not legally binding but is treated as de facto expectation.
Classification (MDR): Four classes by increasing risk: Class I (low; e.g., non-sterile bandages), Class IIa (medium-low), Class IIb (medium-high), Class III (high; e.g., implantable heart valves). Subtypes: Is (sterile), Im (measuring function), Ir (reusable surgical instruments). Determined by MDR Annex VIII rules (22 rules).
Classification (IVDR): Four classes A (low individual/public-health risk) to D (high, e.g., blood-donor screening for HIV), per IVDR Annex VIII. Most IVDs moved up in oversight vs. the old IVDD.
Rule 11: The MDR classification rule for medical device software (MDSW), set out in MDR Annex VIII, Section 6.3. Software that provides information used to take diagnostic or therapeutic decisions is Class IIa, or Class IIb where such a decision may cause a serious deterioration of health or a surgical intervention, or Class III where it may cause death or an irreversible deterioration of health. Software that monitors physiological processes is Class IIa, or Class IIb for vital physiological parameters whose variations could result in immediate danger to the patient. All other software is Class I. Notorious for pushing most clinical software above Class I.
GSPR — General Safety and Performance Requirements: MDR Annex I / IVDR Annex I: the essential requirements every device must meet. The GSPR checklist maps each requirement to evidence and applied standards — a core technical-documentation artifact.
Technical Documentation (Tech File): The dossier demonstrating conformity (MDR Annex II & III): device description, GSPR, risk management, design/manufacturing info, clinical evaluation, PMS plan. The evidentiary heart of a CE submission.
Declaration of Conformity (DoC): The manufacturer's signed legal statement that the device meets all applicable requirements. Required before affixing the CE mark.
Authorized Representative (EC REP / EU-Rep): A natural or legal person established in the EU who holds a written mandate from a manufacturer located outside the EU to act on its behalf for specified regulatory tasks. A manufacturer outside the EU must designate one before placing a device on the EU market (MDR and IVDR Art. 11(1)); importers must verify that one has been designated (Art. 13(2)).
PRRC — Person Responsible for Regulatory Compliance: MDR Art. 15 role: a qualified person within the manufacturer (or EC REP) accountable for conformity, vigilance, and PMS. Micro/small enterprises may use an external PRRC.
EUDAMED: The EU database for medical devices (registration, UDI, certificates, vigilance, market surveillance). Since 28 May 2026, use of four modules (actor registration, UDI and device registration, Notified Bodies and certificates, and market surveillance) has been mandatory under the MDR and IVDR, following Commission Decision (EU) 2025/2371. Devices first placed on the market before that date, legacy devices included, must be registered by 28 November 2026 if further units are placed on the market after it, subject to limited exceptions. The vigilance and clinical investigation modules are not yet mandatory.
UDI — Unique Device Identification: A globally standardized device identifier (UDI-DI = the model; UDI-PI = production/lot/serial) enabling traceability. Placed on labels and registered in EUDAMED / the FDA GUDID.
Basic UDI-DI: The primary key in EUDAMED grouping devices of the same intended purpose, class, and design. Distinct from the UDI-DI on the label.
CER — Clinical Evaluation Report: The document assessing clinical data to demonstrate safety/performance and benefit-risk over the device's lifetime (MDR Annex XIV). Must be actively updated.
PMS — Post-Market Surveillance: Proactive, systematic collection and review of device experience once on the market (MDR Art. 83–86). Outputs feed the PMS Report or PSUR and the clinical evaluation.
PSUR — Periodic Safety Update Report: Class IIa/IIb/III recurring report summarizing PMS data, benefit-risk conclusions, and PMCF findings. Frequency scales with class (annually for IIb/III).
PMCF — Post-Market Clinical Follow-up: Ongoing collection of clinical data after CE marking to confirm safety/performance and detect emerging risks (MDR Annex XIV Part B). A PMCF plan and evaluation report are expected for most devices.
Vigilance: The system for reporting serious incidents and Field Safety Corrective Actions (FSCAs) to Competent Authorities within defined timelines.
FSCA / FSN: Field Safety Corrective Action / Field Safety Notice — A corrective action to reduce risk of a marketed device (e.g., recall, modification); the FSN is the communication to users/customers.
SSCP — Summary of Safety and Clinical Performance: A public-facing summary (for implantable and Class III devices) published via EUDAMED for patients and clinicians.
Common Specifications (CS): EU-adopted technical requirements that function like mandatory standards where harmonized standards are lacking (used notably for certain IVDs and Annex XVI products).
Harmonized standard: A European standard whose reference is published in the Official Journal; conformity to it confers presumption of conformity with the corresponding legal requirement. The MDR and IVDR lists began in 2021 and are still being extended by Commission implementing decisions, most recently (EU) 2026/1231 and (EU) 2026/1313 of June 2026, so check that a standard you rely on is listed.
Annex XVI products: Products without a medical purpose but covered by MDR (e.g., cosmetic contact lenses, dermal fillers, liposuction equipment).
Article 117: MDR provision amending Directive 2001/83/EC for integral drug-device combinations regulated as medicinal products, such as prefilled syringes and single-use prefilled pens. The marketing authorisation dossier must include the device part's EU declaration of conformity or Notified Body certificate where available. If neither is included and the device used on its own would need a Notified Body, the applicant must provide a Notified Body opinion on the device part's conformity with MDR Annex I. Drug-coated devices whose medicinal substance is ancillary, such as drug-eluting stents, are devices under the MDR (Rule 14) and fall outside Article 117.
Legacy device: A device placed on the market under the MDR or IVDR transitional provisions on the basis of a valid MDD, AIMDD, or IVDD certificate, or of a Directive-era declaration of conformity where the Regulation now requires a Notified Body (MDR Art. 120(3a) and (3b), IVDR Art. 110(3a) and (3b)). Depending on the regulation and the class, the transition runs until 31 December 2027, 2028, or 2029, and only while the conditions in MDR Art. 120(3c) or IVDR Art. 110(3c) are met.
Notified Body designation scope: The device types and technologies a Notified Body (NB) is designated to assess, expressed as the codes set out in Commission Implementing Regulation (EU) 2017/2185 and published in the Commission's NANDO (New Approach Notified and Designated Organisations) database. Choosing an NB requires matching its scope to your device.

3. US — FDA

FDA — Food and Drug Administration: The US federal agency regulating medical devices via the CDRH (Center for Devices and Radiological Health).
FD&C Act: The Federal Food, Drug, and Cosmetic Act, the statute underpinning device regulation. Key device provisions added by the 1976 Medical Device Amendments.
Device classification (FDA): Three classes: Class I (low risk, mostly exempt; e.g., tongue depressors), Class II (moderate risk, usually 510(k); e.g., infusion pumps), Class III (high risk / life-sustaining, PMA; e.g., implantable defibrillators). Tied to a product code and regulation number in the CFR.
Product code: A three-letter FDA code identifying a device type and its regulatory requirements; central to database searches and predicate hunting.
510(k) — Premarket Notification: The most common pathway (Class II). Demonstrates the device is substantially equivalent (SE) to a legally marketed predicate. Cleared, not 'approved.' Types: Traditional, Special (own device modification), Abbreviated (relies on standards/guidance).
Substantial Equivalence (SE): The 510(k) standard: the same intended use as a predicate and either the same technological characteristics, or different technological characteristics that do not raise different questions of safety and effectiveness, with data showing the device is as safe and effective as a legally marketed device (FD&C Act §513(i)(1)(A)).
PMA — Premarket Approval: The most stringent pathway for Class III devices; requires valid scientific evidence (usually clinical trials) of safety and effectiveness. Results in approval, not clearance.
De Novo: A pathway for novel low/moderate-risk devices with no predicate; creates a new classification and can itself become a future predicate. Faster/cheaper than PMA when granted.
513(g): A formal request for FDA's view on the classification and regulatory requirements of a device. Useful when classification is ambiguous.
HDE / HUD: Humanitarian Device Exemption / Humanitarian Use Device — A pathway for devices treating rare conditions (≤8,000 US patients/year); reduced effectiveness evidence burden.
IDE — Investigational Device Exemption: FDA authorization to use an unapproved device in a clinical study to collect safety/effectiveness data. Significant Risk (SR) studies need FDA + IRB approval; Non-Significant Risk (NSR) need IRB only.
Pre-Submission (Pre-Sub) / Q-Sub: FDA's structured mechanism for early feedback on your regulatory/testing plan before formal submission. High-value, free, and strongly recommended for novel devices.
QSR / QMSR: The Quality System Regulation (21 CFR 820), historically the US device QMS rule. It was replaced on 2 February 2026 by the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference (21 CFR 820.7 and 820.10) and adds FDA-specific requirements, for example on records (820.35) and on labelling and packaging controls (820.45).
Design controls (FDA): FDA's requirements for systematic design (inputs, outputs, review, verification, validation, transfer, changes, and the design and development file). Since the Quality Management System Regulation (QMSR) took effect on 2 February 2026, they come from ISO 13485:2016 clause 7.3, which 21 CFR 820.10(c) applies to Class II and III devices and to listed Class I devices; the former 21 CFR 820.30 has been removed.
DHF / DMR / DHR: Design History File (how the device was designed), Device Master Record (how it is built), and Device History Record (proof that a specific unit was built to specification) were record types under FDA's former Quality System Regulation. Since the Quality Management System Regulation (QMSR) took effect on 2 February 2026, 21 CFR 820 no longer names them; their content sits in the ISO 13485:2016 design and development file (clause 7.3.10), medical device file (clause 4.2.3), and records for each device or batch (clause 7.5.1). The old names remain common shorthand.
MDR — Medical Device Reporting (21 CFR 803): The US adverse-event reporting system (note: same acronym as EU's regulation — context matters). Manufacturers report deaths, serious injuries, and malfunctions via MedWatch / eMDR.
MAUDE: The public FDA database of adverse-event reports; useful for competitive and safety research.
Establishment registration & device listing: Annual FDA registration of facilities and listing of marketed devices (21 CFR 807). Separate from any clearance/approval.
510(k) Summary / Decision Summary: Public documents describing the basis of a clearance or De Novo grant; a goldmine for predicate and testing research.
Breakthrough Devices Program: FDA programme granting priority review and interactive engagement for devices that provide more effective treatment or diagnosis of life-threatening or irreversibly debilitating diseases or conditions and meet at least one further criterion: a breakthrough technology, no approved or cleared alternative, significant advantages over existing alternatives, or availability in the best interest of patients (FD&C Act §515B). Designation does not change the standard a submission must meet for clearance or approval.
Safer Technologies Program (STeP): STeP mirrors Breakthrough for less-serious conditions; part of FDA's engagement programs.
Warning Letter / 483: A Form 483 lists inspection observations; a Warning Letter is a formal escalation citing violations. Both are public and material to investors and partners.
Refuse to Accept (RTA): An administrative screening where FDA rejects a submission as incomplete before substantive review. A common, avoidable cause of delay.
Predetermined Change Control Plan (PCCP): An FDA-authorized plan (notably for AI/ML devices) specifying anticipated modifications and how they'll be validated, so certain changes don't require a new submission.
Third Party Review (3P510k): Use of an FDA-accredited third party to review eligible 510(k)s, potentially speeding clearance.

4. International standards (ISO / IEC)

ISO 13485: The international standard for a medical device Quality Management System (QMS). The de facto global QMS baseline. In the EU, EN ISO 13485:2016+A11:2021 is a harmonised standard under the MDR and IVDR and the usual way to show that the QMS meets MDR Art. 10(9) or IVDR Art. 10(8); where a Notified Body is involved, it assesses the QMS during conformity assessment, and a separate ISO 13485 certificate is common but not legally required. In the US, FDA's Quality Management System Regulation (QMSR) has incorporated ISO 13485:2016 by reference since 2 February 2026. Current edition: ISO 13485:2016.
ISO 14971: The standard for application of risk management to medical devices. Defines the risk management process (analysis, evaluation, control, residual-risk evaluation, production/post-production feedback). Paired with ISO/TR 24971 guidance.
IEC 62304: The standard for medical device software life-cycle processes. Assigns software safety classes A/B/C by potential to cause harm and prescribes development, maintenance, risk, and configuration processes.
IEC 62366-1: The standard for usability engineering / human factors. Requires a use-related risk process and usability validation to reduce use error. Paired with IEC/TR 62366-2 guidance.
IEC 60601-1: The foundational safety/essential-performance standard for medical electrical equipment, with a family of collateral (-1-x, e.g., EMC -1-2) and particular (-2-x) standards for specific device types.
ISO 10993 series: Standards for the biological evaluation of medical devices (biocompatibility): -1 (evaluation/testing framework), plus parts for cytotoxicity, sensitization, irritation, systemic toxicity, etc.
ISO 11135 / 11137 / 17665: Sterilization validation standards: 11135 (ethylene oxide), 11137 (radiation), 17665 (moist heat/steam).
ISO 11607: Standard for packaging for terminally sterilized medical devices (sterile barrier systems).
ISO 15223-1: Standard for symbols used on medical device labels (the harmonized graphical symbols).
EN ISO 20417: Standard for information supplied by the manufacturer (labeling/IFU content requirements), often cited for MDR labeling compliance.
IEC/IEEE 82079-1: Standard for the preparation of information for use, including instructions for use (structure, content, presentation). The current edition, IEC/IEEE 82079-1:2019, was published jointly by IEC and IEEE and replaced IEC 82079-1:2012.
ISO 14155: Standard for Good Clinical Practice (GCP) for clinical investigations of medical devices in human subjects. The device-world analogue of ICH-GCP.
ISO 20916: Standard for clinical performance studies of IVDs using specimens from human subjects.
IEC 80001-1: Standard for risk management of IT-networks incorporating medical devices (relevant for connected/hospital-integrated devices).
IEC 81001-5-1: Standard for health software and health IT systems safety, effectiveness and security, covering the secure software life-cycle (cybersecurity development process).
MDSAP — Medical Device Single Audit Program: A single QMS audit (against ISO 13485 + national requirements) accepted by regulators in Australia, Brazil, Canada, Japan, and the USA. One audit, multiple markets.
GHTF / IMDRF: The Global Harmonization Task Force (now superseded by the) International Medical Device Regulators Forum, which publishes harmonization documents (e.g., SaMD framework, adverse-event terminology) influential across jurisdictions.
Harmonized / recognized / consensus standard: A standard formally recognized by a regulator such that conformity supports (but does not automatically prove) compliance. FDA maintains a Recognized Consensus Standards database; the EU publishes harmonized standards.
State of the art: The current, generally accepted best practice embodied in standards and guidance; regulators expect devices to reflect it, and risk controls to be judged against it. Not the same as 'most advanced technology.'

5. UK & other jurisdictions

MHRA: Medicines and Healthcare products Regulatory Agency — The UK regulator for medicines and medical devices post-Brexit.
UKCA: UK Conformity Assessed — The UK marking replacing CE for the GB market. CE-marked devices are still accepted in Great Britain: devices compliant with the MDD or AIMDD until 30 June 2028 or earlier certificate expiry, IVDD devices until 30 June 2030 or earlier certificate expiry, and MDR or IVDR devices until 30 June 2030. The Medicines and Healthcare products Regulatory Agency (MHRA) consulted in 2026 on recognising CE marking indefinitely and had published no outcome by 8 October 2026, so check the current position before planning.
UK Approved Body: The UK equivalent of an EU notified body, assessing conformity for UKCA marking.
UKRP: UK Responsible Person — The UK analogue of the EU Authorized Representative for non-UK manufacturers.
Northern Ireland / CE + UKNI: Under the Windsor Framework, Northern Ireland follows EU rules; the UKNI marking applies where a UK body performs conformity assessment for the NI market.
Swissmedic: Switzerland's regulator. Post-MDR, Switzerland is treated as a third country by the EU; devices need a CH-REP (Swiss Authorized Representative).
Health Canada / MDL / MDEL: Canada's regulator; Medical Device Licence (MDL) for Class II–IV devices (requires MDSAP-based ISO 13485 certification), Medical Device Establishment Licence (MDEL) for importers/distributors and Class I.
TGA — Therapeutic Goods Administration: Australia's regulator; devices are entered on the ARTG (Australian Register of Therapeutic Goods).
PMDA / MHLW: Japan's Pharmaceuticals and Medical Devices Agency and Ministry of Health, Labour and Welfare; approvals under the PMD Act (Shonin/Ninsho routes).
NMPA: China's National Medical Products Administration (formerly CFDA); requires product filing (Class I) or registration (Class II and III), with additional requirements for imported devices. Since the revised State Council regulation on medical devices (Order No. 739) took effect on 1 June 2021, the test report for filing or registration may be the applicant's own self-test report or one issued by a qualified testing institution.
ANVISA: Brazil's health regulator; participates in MDSAP.
Reference country / reliance: Many smaller markets grant faster approval if a device is already cleared/approved in a 'reference' jurisdiction (EU, US, Japan, etc.) — a lever for sequencing market entry.

6. Quality & QMS

QMS — Quality Management System: The documented system of processes ensuring devices are consistently designed and made to meet requirements. ISO 13485 is the reference model; a QMS is effectively mandatory to CE-mark or sell in most markets.
eQMS: An electronic QMS platform (e.g., Greenlight Guru, Qualio, MasterControl) digitizing documents, training, CAPA, and records. Popular with startups to avoid paper systems.
SOP — Standard Operating Procedure: A controlled document describing how a recurring activity is performed. The backbone of a QMS.
Design controls: The disciplined design process: design inputs (requirements) → design outputs (specs) → verification (did we build it right?) → validation (did we build the right thing?) → design transfer → design review → DHF. Required by ISO 13485 §7.3, which FDA's Quality Management System Regulation (QMSR) has applied through 21 CFR 820.10(c) since 2 February 2026.
Verification vs. validation (V&V): Verification confirms outputs meet inputs (testing to spec). Validation confirms the device meets user needs and intended use in real/simulated conditions. Distinct and both required.
Risk management file (RMF): The ISO 14971 record set: risk management plan, risk analysis (e.g., FMEA/hazard analysis), risk evaluation, controls, residual risk, and report.
FMEA — Failure Mode and Effects Analysis: A bottom-up technique cataloguing potential failure modes, their effects, causes, and controls, often scored by severity/occurrence/detection. A common (not mandatory) risk tool.
Hazard analysis: A top-down risk method starting from hazards and hazardous situations; ISO 14971 is method-agnostic but expects traceable hazard-to-harm reasoning.
CAPA — Corrective and Preventive Action: The closed-loop process to investigate problems, fix root causes (corrective) and prevent recurrence/occurrence (preventive). A top area of audit findings.
Nonconformity (NC): A failure to meet a requirement. Managed via nonconformance handling, disposition, and (if systemic) CAPA.
Root cause analysis (RCA): Structured investigation (5 Whys, fishbone/Ishikawa, fault tree) to find the true cause of a problem rather than the symptom.
Change control: The process governing how changes to design, process, suppliers, or documents are assessed, approved, and implemented without introducing risk.
Document control / record control: Managing the creation, review, approval, versioning, and retention of controlled documents (living) and records (evidence of past activity).
Supplier / vendor qualification: Evaluating and monitoring suppliers of components, sterilization, contract manufacturing, etc., with quality agreements and controls proportionate to risk.
Design freeze: The point at which the design is locked for verification/validation and transfer. Changing the intended purpose or design after freeze is costly — hence early regulatory strategy.
Process validation (IQ/OQ/PQ): Validating a manufacturing process that can't be fully verified by inspection: Installation Qualification, Operational Qualification, Performance Qualification.
Internal audit: Planned self-assessment of the QMS against ISO 13485/regulatory requirements; feeds management review.
Management review: Top-management's periodic review of QMS performance, feeding resource and improvement decisions. A required ISO 13485 input/output cycle.
Notified body audit / surveillance audit / recertification: NB assessments of your QMS: initial certification, annual surveillance, and (typically) recertification every few years, plus unannounced audits under MDR.
CE technical file review: The NB's assessment of your technical documentation; sampling depth scales with device class.
Complaint handling: The regulated process for capturing, evaluating, and (where needed) reporting customer complaints, with links to vigilance/MDR reporting.
Traceability: The ability to link requirements → design → V&V → risk → production records, and to trace a marketed unit back through its build (via UDI/DHR).

7. Clinical & evidence

Clinical evaluation: The systematic, ongoing appraisal of clinical data to verify safety, performance, and acceptable benefit-risk of a device for its intended purpose. Documented in the CER (EU MDR Annex XIV). Not a one-time event.
Clinical data: Safety/performance information from clinical investigations, literature on equivalent devices, and post-market clinical experience.
Clinical investigation / clinical trial: A prospective study of a device in human subjects to assess safety/performance. Governed by ISO 14155 (device GCP) and, in the EU, MDR Arts. 62–82.
GCP — Good Clinical Practice: International ethical/scientific quality standard for designing, conducting, and reporting trials involving human subjects.
Endpoint: A measured outcome used to judge a study. Primary endpoint = the main question; secondary endpoints = supporting. Choice drives sample size and claims.
Sample size / power: The number of subjects needed to detect an effect with acceptable statistical confidence; underpowering is a common, fatal study-design error.
Sensitivity & specificity: For diagnostics: sensitivity = true-positive rate (catches disease); specificity = true-negative rate (avoids false alarms). Core IVD performance metrics.
PPV / NPV: Positive/Negative Predictive Value — the probability a positive/negative result is correct, which depends on disease prevalence — important when translating trial performance to real-world settings.
Analytical vs. clinical performance (IVD): Analytical performance = does the assay measure the analyte correctly (precision, accuracy, LoD)? Clinical performance = does the result correlate with the clinical condition? IVDR requires both plus scientific validity.
Equivalence (clinical): [EU] Demonstrating your device is clinically, technically, and biologically equivalent to another to leverage its clinical data. MDR criteria are strict and require access to the other device's technical data.
Real-world evidence (RWE) / real-world data (RWD): Clinical evidence derived from routine-care data (registries, EHRs, claims). Increasingly accepted by FDA and EU to supplement or, sometimes, substitute trials.
IRB / Ethics Committee: The Institutional Review Board (US) / Ethics Committee (EU) that reviews and approves study ethics and protects subjects. Required before enrolling patients.
Informed consent: The process ensuring subjects understand and voluntarily agree to study participation.
Investigator's Brochure (IB): The compiled clinical/nonclinical information on the device given to trial investigators.
Adverse event (AE) / SAE / ADE: An untoward medical occurrence in a subject; 'serious' if it results in death, life-threatening condition, hospitalization, disability, etc. ADE = Adverse Device Effect (linked to the device).
Benefit-risk determination: The judgment that a device's clinical benefits outweigh its residual risks under normal use. The ultimate acceptance criterion across MDR, FDA, and ISO 14971.
Clinical Investigation Plan (CIP) / Protocol: The document specifying study objectives, design, endpoints, and methods.
Literature review / systematic review: A structured, reproducible search and appraisal of published evidence; a required component of most clinical evaluations.
Usability / human factors validation: Simulated-use or actual-use testing (per IEC 62366-1 / FDA HF guidance) confirming users can operate the device safely, especially for critical tasks.

8. Software, AI & cybersecurity

SaMD — Software as a Medical Device: Software intended for a medical purpose that performs that purpose without being part of a hardware device (IMDRF definition). E.g., an app that analyzes images to flag disease.
SiMD — Software in a Medical Device: Software that is embedded in or controls a hardware device (a.k.a. firmware/embedded software). Different from SaMD but often conflated.
MDSW — Medical Device Software: [EU] term (from MDCG 2019-11) covering software that is itself a device; guides qualification and classification (see Rule 11).
IEC 62304 software safety classes: Class A (no injury possible), Class B (non-serious injury possible), Class C (death or serious injury possible). Determines required rigor.
Locked vs. adaptive (continuous-learning) algorithm: A locked model gives the same output for the same input until deliberately updated; an adaptive model learns continuously. Regulators favor locked models plus a PCCP for controlled updates.
GMLP — Good Machine Learning Practice: FDA/MHRA/Health Canada joint principles for AI/ML device development (data quality, training-test separation, monitoring), first published in October 2021. The International Medical Device Regulators Forum (IMDRF) published its own final version, with ten guiding principles, in January 2025 (IMDRF/AIML WG/N88).
EU AI Act: EU regulation on artificial intelligence. Medical-device AI that requires third-party conformity assessment (for example MDR Class IIa and above software, IVDR Class B and above) is treated as high-risk, adding requirements on top of MDR and IVDR: risk management, data governance, transparency, human oversight, and logging. The high-risk obligations for AI that is, or sits inside, a medical device apply from 2 August 2028. That date is set by Regulation (EU) 2026/1744, the Digital Omnibus, which was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026; it supersedes the original 2 August 2027 date.
Cybersecurity (premarket/postmarket): Requirements to design, test, and maintain device security (threat modeling, SBOM, patching). FDA has explicit premarket cybersecurity requirements (FD&C Act §524B). In the EU, device cybersecurity sits in the general safety and performance requirements (MDR Annex I, Sections 17.2, 17.4, and 18.8; IVDR Annex I, Sections 16.2 and 16.4), with the Medical Device Coordination Group's guidance MDCG 2019-16 and IEC 81001-5-1 as common references. The Cyber Resilience Act (Regulation (EU) 2024/2847) does not apply to products covered by the MDR or IVDR (its Art. 2(2)), although it can apply to a company's other connected products.
SBOM — Software Bill of Materials: An inventory of software components and dependencies, increasingly required to manage vulnerabilities (e.g., FDA premarket cybersecurity).
Interoperability: The ability of a device to exchange and use information with other systems (EHRs, other devices); regulated for safety where it affects clinical function.
Verification & validation for software: Unit/integration/system testing plus validation against user needs; documented per IEC 62304 and design controls.
DiGA — Digital Health Applications: [EU/Germany] The German 'app on prescription' scheme: CE-marked digital health apps that, after listing in the BfArM DiGA directory, are reimbursed by statutory insurers. A landmark digital-health reimbursement route.

9. Reimbursement & market access

Market access: The set of activities (regulatory + reimbursement + pricing + evidence) required to get a device used and paid for, not just legally sold. Regulatory clearance ≠ commercial success.
Reimbursement: Payment to providers/patients for using a device or the associated procedure, by public or private payers. Often the true gating factor for adoption.
HTA — Health Technology Assessment: Systematic evaluation of a technology's clinical and economic value to inform coverage/pricing (e.g., NICE in the UK, IQWiG/G-BA in Germany). The EU now has a Joint Clinical Assessment (JCA) under the HTA Regulation (EU) 2021/2282, phasing in from 2025.
Coverage / coding / payment (the 'three Cs'): Coverage = will a payer pay for it? Coding = which billing code describes it (CPT, ICD, DRG, HCPCS)? Payment = how much? All three must line up for reimbursement.
CPT code: [US] Current Procedural Terminology codes (AMA) describing procedures/services; a Category I CPT is the goal, Category III is temporary/emerging.
ICD-10 / ICD-11: International Classification of Diseases codes for diagnoses (and procedures in some systems); used in claims and epidemiology.
DRG — Diagnosis-Related Group: A payment classification bundling an inpatient stay into a fixed payment; a new device must fit (or justify a new/adjusted) DRG to be adopted in hospitals.
HCPCS: [US] Healthcare Common Procedure Coding System — codes (esp. Level II) for products, supplies, and devices not in CPT.
CMS / NCD / LCD: [US] The Centers for Medicare & Medicaid Services; National Coverage Determinations (nationwide) and Local Coverage Determinations (regional MAC) set Medicare coverage.
TCET / NTAP / Breakthrough coverage: US mechanisms to accelerate payment for novel tech: NTAP (New Technology Add-on Payment) for inpatient; TCET (Transitional Coverage for Emerging Technologies) pathway for certain breakthrough devices.
Payer: The entity that pays for care: public (Medicare/Medicaid, statutory insurers, NHS) or private (commercial insurers).
Value-based / value dossier: Evidence package (clinical + economic) arguing a technology's value to payers; core to reimbursement strategy.
Health economics / HEOR: Health Economics and Outcomes Research: cost-effectiveness (e.g., cost per QALY — Quality-Adjusted Life Year), budget-impact modeling, used to justify price and coverage.
QALY / ICER: Quality-Adjusted Life Year (a year of perfect health = 1) and Incremental Cost-Effectiveness Ratio (extra cost per extra QALY vs. comparator); central HTA metrics (e.g., NICE thresholds).
DiGA / DiPA (Germany), PECAN (France): National digital-health reimbursement fast-tracks: Germany's DiGA (apps) and DiPA (care applications), France's PECAN early-access scheme. Bellwethers for digital-therapeutic reimbursement.
GPO / IDN: [US] Group Purchasing Organization and Integrated Delivery Network — hospital purchasing structures a device company must sell through; contracting is a real barrier to adoption.
Tender: [EU/public systems] Competitive public procurement process through which many hospitals/health systems buy devices.

10. Startup, funding & commercial

TAM / SAM / SOM: Total / Serviceable / Serviceable-Obtainable Market — nested market-size estimates investors expect: everyone who could use it, who you can reach, and who you'll realistically win.
ICP — Ideal Customer Profile: The precisely defined type of customer (specialty, facility size, geography, buyer) a company targets first.
Pre-seed / Seed / Series A/B/C: Successive equity financing rounds by maturity. In MedTech, rounds are often gated by regulatory and clinical milestones (e.g., 'raise to first-in-human' or 'raise to CE mark').
Runway: How many months of cash the company has at its current burn rate. MedTech runways must be planned around long regulatory/clinical timelines.
Burn rate: Net monthly cash consumption (gross burn = spend; net burn = spend minus revenue).
Cap table: The record of who owns what (equity, options, SAFEs/convertibles) and each stakeholder's ownership percentage and dilution.
SAFE / convertible note: Instruments that convert into equity at a later priced round. SAFE (Simple Agreement for Future Equity) is not debt; a convertible note is debt with interest and a maturity date. Both often use a valuation cap and/or discount.
Dilution: The reduction of existing owners' percentage when new shares are issued in a financing.
Pre-money / post-money valuation: Company value before (pre) and after (post) new investment: post-money = pre-money + new money raised.
Term sheet: The non-binding summary of key investment terms (valuation, board seats, liquidation preference, pro-rata rights) that precedes definitive documents.
Milestone-based financing / tranches: Capital released in stages tied to hitting milestones (e.g., design freeze, CE mark, first revenue) — common in capital-intensive MedTech.
Non-dilutive funding: Money that doesn't cost equity: grants (e.g., EU Horizon/EIC, NIH SBIR/STTR in the US), soft loans, revenue, and R&D tax credits. Especially valuable pre-revenue in MedTech.
Grant (SBIR/STTR, EIC, Horizon Europe): Government/EU non-dilutive R&D funding programs frequently used to fund early MedTech development and de-risk before a priced round.
IP — Intellectual property: Patents, trade secrets, trademarks, and design rights. Freedom to Operate (FTO) analysis checks you don't infringe others' patents — critical before scaling.
FTO — Freedom to Operate: A legal assessment that making/using/selling your device won't infringe third-party IP in target markets.
Regulatory milestone: A value-inflection event (Pre-Sub feedback, IDE/CE submission, clearance/approval, first PMCF data) that de-risks the company and unlocks the next raise or partnership.
Reimbursement milestone: Coverage/coding/payment wins (e.g., a Category I CPT, DiGA listing, positive HTA) that materially change commercial prospects.
Build vs. buy (manufacturing) / CDMO / CMO: Decision to manufacture in-house or via a Contract (Development and) Manufacturing Organization. Affects QMS scope, supplier controls, and capital needs.
OBL / PLM: Own-Brand Labeling / Private-Label Manufacturing — Selling a device made by another manufacturer under your own brand; MDR sharply limits the old 'virtual manufacturer' shortcut — you inherit full manufacturer obligations.
510(k)-to-revenue / CE-to-revenue timeline: The realistic gap between regulatory clearance and meaningful revenue once sales, reimbursement, and adoption ramp — frequently underestimated in plans.
Regulatory due diligence: Investor/acquirer assessment of a target's regulatory status, QMS maturity, clinical evidence, and liabilities (open 483s, NB findings, MDR readiness). A common deal-killer or price-adjuster.
Exit: The liquidity event for investors/founders: acquisition (most common in MedTech, often by a strategic like Medtronic/J&J/Stryker) or IPO.
Strategic (acquirer/partner): A large industry player that may acquire, license, or distribute a startup's technology; MedTech exits skew heavily toward strategics.
KOL — Key Opinion Leader: An influential clinician whose endorsement, trial participation, or publications drive credibility and adoption.
Value proposition / clinical claim: The specific, evidence-backed benefit statement. Claims are constrained by your cleared/approved intended purpose — marketing and RA must stay aligned to avoid off-label promotion.

See where you stand, in about ten minutes.

Free, AI-powered, and every gap comes with a next step.

Start the MedTech Compass