A reference for founders, RA/QA leads and operators building medical device companies.

The MedTech Startup Glossary

Focus on Regulatory Affairs, with adjacent Quality, Clinical, Reimbursement and Startup terms. Acronyms are spelled out on first use so any entry can be read on its own. Jurisdiction tags: [EU], [US], [UK], [INTL].

Search the glossary

1. Core regulatory concepts

Medical device: Any instrument, apparatus, software, implant, reagent, or article intended by the manufacturer for a medical purpose (diagnosis, prevention, monitoring, treatment, or alleviation of disease/injury) that does not achieve its principal intended action by pharmacological, immunological, or metabolic means (that would make it a drug). Definitions differ slightly between [EU] MDR Art. 2 and [US] FD&C Act §201(h) but the concept is shared.
Intended purpose / intended use: The use for which a device is intended according to the manufacturer's labeling, instructions, and promotional materials. It is the single most consequential decision in RA: it drives classification, applicable requirements, clinical evidence needs, and claims. [US] uses 'intended use'; [EU] uses 'intended purpose.'
Indications for use: [US] term describing the specific disease/condition the device diagnoses/treats and the target patient population. Narrower and more clinical than 'intended use.'
Classification: Risk-based categorization of a device that determines the regulatory pathway and scrutiny. Higher class = higher perceived risk = more evidence and oversight. Rules differ by jurisdiction (see EU and FDA sections).
Manufacturer: The legal entity that designs/manufactures a device and markets it under its own name, and that bears ultimate regulatory responsibility. You are the manufacturer even if you outsource all production (see virtual manufacturer / OBL).
Economic operator: [EU] umbrella term for manufacturer, authorized representative, importer, and distributor — each with defined obligations under MDR/IVDR.
Conformity assessment: The process by which compliance with regulatory requirements is demonstrated before market access (e.g., CE marking route in the EU, premarket submission in the US).
Regulatory pathway / route to market: The specific sequence of submissions, assessments, and approvals required to legally place a device on a given market. Choosing it early is the foundation of a regulatory strategy.
Predicate / equivalence: Reliance on an already-marketed comparable device to reduce the evidence burden. [US] calls it a predicate (510(k)); [EU] calls it equivalence and applies stricter criteria (technical, biological, clinical).
Labeling: All written, printed, or graphic information on the device, its packaging, or accompanying it (label + Instructions for Use). Regulated content; a frequent source of non-conformities.
Instructions for Use (IFU): The manufacturer's document telling the user how to use the device safely and effectively. Content is prescribed by regulation and standards (e.g., EN ISO 20417, IEC 82079-1).
Off-label use: Use of a device outside its cleared/approved intended purpose. Manufacturers may not promote off-label use; clinicians may sometimes practice it.
Placing on the market: The first making available of a device on a given market. The legal trigger for most obligations. [EU] distinguishes 'placing on the market' from 'putting into service.'
Grace period / transition provision: Time-limited rules letting devices certified under an old framework remain on the market while transitioning to a new one (e.g., MDR/IVDR transitional timelines).
Regulatory strategy: The documented plan mapping target markets, classifications, pathways, evidence, standards, timelines, and cost for a product. The deliverable a startup should build before spending on clinical or design freeze.

2. EU — MDR & IVDR

MDR — Medical Device Regulation (EU) 2017/745: The regulation governing medical devices in the EU, applicable since 26 May 2021. Replaced the Medical Device Directive (MDD 93/42/EEC) and AIMDD. Far more demanding on clinical evidence, post-market surveillance, and traceability.
IVDR — In Vitro Diagnostic Regulation (EU) 2017/746: The parallel regulation for in vitro diagnostics (tests run on samples taken from the body), applicable since 26 May 2022. Shifted most IVDs from self-certification to notified-body oversight.
MDD / AIMDD: The predecessor Medical Device Directive (93/42/EEC) and Active Implantable Medical Device Directive (90/385/EEC), replaced by MDR. Legacy 'MDD certificates' persist under transitional rules.
CE marking: The mark indicating a device conforms to applicable EU legislation and may be sold across the EU/EEA. Not a quality badge — a declaration of regulatory conformity.
Notified Body (NB): An independent, government-designated organization that audits QMS and reviews technical documentation for medium/high-risk devices, and issues CE certificates. Examples: TÜV SÜD, BSI, DEKRA. NB capacity is a well-known bottleneck under MDR.
Competent Authority (CA): The national regulator in each Member State (e.g., BfArM in Germany, ANSM in France) responsible for market surveillance, vigilance, and designating notified bodies (with the Commission).
MDCG — Medical Device Coordination Group: EU expert group issuing influential guidance documents (e.g., MDCG 2019-11 on software qualification). Guidance is not legally binding but is treated as de facto expectation.
Classification (MDR): Four classes by increasing risk: Class I (low; e.g., non-sterile bandages), Class IIa (medium-low), Class IIb (medium-high), Class III (high; e.g., implantable heart valves). Subtypes: Is (sterile), Im (measuring function), Ir (reusable surgical instruments). Determined by MDR Annex VIII rules (22 rules).
Classification (IVDR): Four classes A (low individual/public-health risk) to D (high, e.g., blood-donor screening for HIV), per IVDR Annex VIII. Most IVDs moved up in oversight vs. the old IVDD.
Rule 11: The MDR classification rule for software as a medical device (MDMD/SaMD). Software providing diagnosis/therapy decisions is typically Class IIa or higher; software that can cause death/serious deterioration is IIb/III. Notorious for pushing most clinical software above Class I.
GSPR — General Safety and Performance Requirements: MDR Annex I / IVDR Annex I: the essential requirements every device must meet. The GSPR checklist maps each requirement to evidence and applied standards — a core technical-documentation artifact.
Technical Documentation (Tech File): The dossier demonstrating conformity (MDR Annex II & III): device description, GSPR, risk management, design/manufacturing info, clinical evaluation, PMS plan. The evidentiary heart of a CE submission.
Declaration of Conformity (DoC): The manufacturer's signed legal statement that the device meets all applicable requirements. Required before affixing the CE mark.
Authorized Representative (EC REP / EU-Rep): An entity established in the EU appointed by a non-EU manufacturer to act on its behalf for regulatory obligations. Mandatory for importers of non-EU devices.
PRRC — Person Responsible for Regulatory Compliance: MDR Art. 15 role: a qualified person within the manufacturer (or EC REP) accountable for conformity, vigilance, and PMS. Micro/small enterprises may use an external PRRC.
EUDAMED: The EU database for medical devices (registration, UDI, certificates, vigilance, market surveillance). Being rolled out module-by-module; some modules mandatory, others still voluntary during transition.
UDI — Unique Device Identification: A globally standardized device identifier (UDI-DI = the model; UDI-PI = production/lot/serial) enabling traceability. Placed on labels and registered in EUDAMED / the FDA GUDID.
Basic UDI-DI: The primary key in EUDAMED grouping devices of the same intended purpose, class, and design. Distinct from the UDI-DI on the label.
CER — Clinical Evaluation Report: The document assessing clinical data to demonstrate safety/performance and benefit-risk over the device's lifetime (MDR Annex XIV). Must be actively updated.
PMS — Post-Market Surveillance: Proactive, systematic collection and review of device experience once on the market (MDR Art. 83–86). Outputs feed the PMS Report or PSUR and the clinical evaluation.
PSUR — Periodic Safety Update Report: Class IIa/IIb/III recurring report summarizing PMS data, benefit-risk conclusions, and PMCF findings. Frequency scales with class (annually for IIb/III).
PMCF — Post-Market Clinical Follow-up: Ongoing collection of clinical data after CE marking to confirm safety/performance and detect emerging risks (MDR Annex XIV Part B). A PMCF plan and evaluation report are expected for most devices.
Vigilance: The system for reporting serious incidents and Field Safety Corrective Actions (FSCAs) to Competent Authorities within defined timelines.
FSCA / FSN: Field Safety Corrective Action / Field Safety Notice — A corrective action to reduce risk of a marketed device (e.g., recall, modification); the FSN is the communication to users/customers.
SSCP — Summary of Safety and Clinical Performance: A public-facing summary (for implantable and Class III devices) published via EUDAMED for patients and clinicians.
Common Specifications (CS): EU-adopted technical requirements that function like mandatory standards where harmonized standards are lacking (used notably for certain IVDs and Annex XVI products).
Harmonized standard: A European standard whose reference is published in the Official Journal; conformity to it confers presumption of conformity with the corresponding legal requirement. MDR has suffered a shortage of newly harmonized standards.
Annex XVI products: Products without a medical purpose but covered by MDR (e.g., cosmetic contact lenses, dermal fillers, liposuction equipment).
Article 117: MDR provision requiring a notified-body opinion on the device part of certain drug-device combination products (e.g., prefilled syringes, drug-coated devices).
Legacy device: A device certified under MDD/AIMDD or IVDD still marketed under MDR/IVDR transitional provisions.
Notified Body nominated code / MDR designation scope: The specific device categories an NB is authorized to certify. Choosing an NB requires matching its scope to your device.

3. US — FDA

FDA — Food and Drug Administration: The US federal agency regulating medical devices via the CDRH (Center for Devices and Radiological Health).
FD&C Act: The Federal Food, Drug, and Cosmetic Act, the statute underpinning device regulation. Key device provisions added by the 1976 Medical Device Amendments.
Device classification (FDA): Three classes: Class I (low risk, mostly exempt; e.g., tongue depressors), Class II (moderate risk, usually 510(k); e.g., infusion pumps), Class III (high risk / life-sustaining, PMA; e.g., implantable defibrillators). Tied to a product code and regulation number in the CFR.
Product code: A three-letter FDA code identifying a device type and its regulatory requirements; central to database searches and predicate hunting.
510(k) — Premarket Notification: The most common pathway (Class II). Demonstrates the device is substantially equivalent (SE) to a legally marketed predicate. Cleared, not 'approved.' Types: Traditional, Special (own device modification), Abbreviated (relies on standards/guidance).
Substantial Equivalence (SE): The 510(k) standard: same intended use and same technological characteristics as a predicate, or different technology that raises no new questions of safety/effectiveness.
PMA — Premarket Approval: The most stringent pathway for Class III devices; requires valid scientific evidence (usually clinical trials) of safety and effectiveness. Results in approval, not clearance.
De Novo: A pathway for novel low/moderate-risk devices with no predicate; creates a new classification and can itself become a future predicate. Faster/cheaper than PMA when granted.
513(g): A formal request for FDA's view on the classification and regulatory requirements of a device. Useful when classification is ambiguous.
HDE / HUD: Humanitarian Device Exemption / Humanitarian Use Device — A pathway for devices treating rare conditions (≤8,000 US patients/year); reduced effectiveness evidence burden.
IDE — Investigational Device Exemption: FDA authorization to use an unapproved device in a clinical study to collect safety/effectiveness data. Significant Risk (SR) studies need FDA + IRB approval; Non-Significant Risk (NSR) need IRB only.
Pre-Submission (Pre-Sub) / Q-Sub: FDA's structured mechanism for early feedback on your regulatory/testing plan before formal submission. High-value, free, and strongly recommended for novel devices.
QSR / QMSR: The Quality System Regulation (21 CFR 820), historically the US device QMS rule. Being harmonized with ISO 13485 as the Quality Management System Regulation (QMSR), effective 2 February 2026.
Design controls (FDA): The 21 CFR 820.30 requirements for systematic design (inputs, outputs, review, verification, validation, transfer, changes, DHF). Also central to ISO 13485.
DHF / DMR / DHR: Design History File (how the device was designed), Device Master Record (how it's built — the recipe), Device History Record (proof a specific unit was built to spec).
MDR — Medical Device Reporting (21 CFR 803): The US adverse-event reporting system (note: same acronym as EU's regulation — context matters). Manufacturers report deaths, serious injuries, and malfunctions via MedWatch / eMDR.
MAUDE: The public FDA database of adverse-event reports; useful for competitive and safety research.
Establishment registration & device listing: Annual FDA registration of facilities and listing of marketed devices (21 CFR 807). Separate from any clearance/approval.
510(k) Summary / Decision Summary: Public documents describing the basis of a clearance or De Novo grant; a goldmine for predicate and testing research.
Breakthrough Devices Program: FDA program granting priority review and interactive engagement for devices offering more effective treatment/diagnosis of serious conditions.
Safer Technologies Program (STeP): STeP mirrors Breakthrough for less-serious conditions; part of FDA's engagement programs.
Warning Letter / 483: A Form 483 lists inspection observations; a Warning Letter is a formal escalation citing violations. Both are public and material to investors and partners.
Refuse to Accept (RTA): An administrative screening where FDA rejects a submission as incomplete before substantive review. A common, avoidable cause of delay.
Predetermined Change Control Plan (PCCP): An FDA-authorized plan (notably for AI/ML devices) specifying anticipated modifications and how they'll be validated, so certain changes don't require a new submission.
Third Party Review (3P510k): Use of an FDA-accredited third party to review eligible 510(k)s, potentially speeding clearance.

4. International standards (ISO / IEC)

ISO 13485: The international standard for a medical device Quality Management System (QMS). The de facto global QMS baseline; certification is expected by notified bodies and increasingly aligned with FDA's QMSR. Current edition: ISO 13485:2016.
ISO 14971: The standard for application of risk management to medical devices. Defines the risk management process (analysis, evaluation, control, residual-risk evaluation, production/post-production feedback). Paired with ISO/TR 24971 guidance.
IEC 62304: The standard for medical device software life-cycle processes. Assigns software safety classes A/B/C by potential to cause harm and prescribes development, maintenance, risk, and configuration processes.
IEC 62366-1: The standard for usability engineering / human factors. Requires a use-related risk process and usability validation to reduce use error. Paired with IEC/TR 62366-2 guidance.
IEC 60601-1: The foundational safety/essential-performance standard for medical electrical equipment, with a family of collateral (-1-x, e.g., EMC -1-2) and particular (-2-x) standards for specific device types.
ISO 10993 series: Standards for the biological evaluation of medical devices (biocompatibility): -1 (evaluation/testing framework), plus parts for cytotoxicity, sensitization, irritation, systemic toxicity, etc.
ISO 11135 / 11137 / 17665: Sterilization validation standards: 11135 (ethylene oxide), 11137 (radiation), 17665 (moist heat/steam).
ISO 11607: Standard for packaging for terminally sterilized medical devices (sterile barrier systems).
ISO 15223-1: Standard for symbols used on medical device labels (the harmonized graphical symbols).
EN ISO 20417: Standard for information supplied by the manufacturer (labeling/IFU content requirements), often cited for MDR labeling compliance.
IEC 82079-1: Standard for the preparation of instructions for use (structure, content, presentation).
ISO 14155: Standard for Good Clinical Practice (GCP) for clinical investigations of medical devices in human subjects. The device-world analogue of ICH-GCP.
ISO 20916: Standard for clinical performance studies of IVDs using specimens from human subjects.
IEC 80001-1: Standard for risk management of IT-networks incorporating medical devices (relevant for connected/hospital-integrated devices).
IEC 81001-5-1: Standard for health software and health IT systems safety, effectiveness and security, covering the secure software life-cycle (cybersecurity development process).
MDSAP — Medical Device Single Audit Program: A single QMS audit (against ISO 13485 + national requirements) accepted by regulators in Australia, Brazil, Canada, Japan, and the USA. One audit, multiple markets.
GHTF / IMDRF: The Global Harmonization Task Force (now superseded by the) International Medical Device Regulators Forum, which publishes harmonization documents (e.g., SaMD framework, adverse-event terminology) influential across jurisdictions.
Harmonized / recognized / consensus standard: A standard formally recognized by a regulator such that conformity supports (but does not automatically prove) compliance. FDA maintains a Recognized Consensus Standards database; the EU publishes harmonized standards.
State of the art: The current, generally accepted best practice embodied in standards and guidance; regulators expect devices to reflect it, and risk controls to be judged against it. Not the same as 'most advanced technology.'

5. UK & other jurisdictions

MHRA: Medicines and Healthcare products Regulatory Agency — The UK regulator for medicines and medical devices post-Brexit.
UKCA: UK Conformity Assessed — The UK marking replacing CE for the GB market. Note: transition timelines and continued CE acceptance in Great Britain have shifted repeatedly — verify current dates before planning.
UK Approved Body: The UK equivalent of an EU notified body, assessing conformity for UKCA marking.
UKRP: UK Responsible Person — The UK analogue of the EU Authorized Representative for non-UK manufacturers.
Northern Ireland / CE + UKNI: Under the Windsor Framework, Northern Ireland follows EU rules; the UKNI marking applies where a UK body performs conformity assessment for the NI market.
Swissmedic: Switzerland's regulator. Post-MDR, Switzerland is treated as a third country by the EU; devices need a CH-REP (Swiss Authorized Representative).
Health Canada / MDL / MDEL: Canada's regulator; Medical Device Licence (MDL) for Class II–IV devices (requires MDSAP-based ISO 13485 certification), Medical Device Establishment Licence (MDEL) for importers/distributors and Class I.
TGA — Therapeutic Goods Administration: Australia's regulator; devices are entered on the ARTG (Australian Register of Therapeutic Goods).
PMDA / MHLW: Japan's Pharmaceuticals and Medical Devices Agency and Ministry of Health, Labour and Welfare; approvals under the PMD Act (Shonin/Ninsho routes).
NMPA: China's National Medical Products Administration (formerly CFDA); requires local testing and registration, with additional requirements for imported devices.
ANVISA: Brazil's health regulator; participates in MDSAP.
Reference country / reliance: Many smaller markets grant faster approval if a device is already cleared/approved in a 'reference' jurisdiction (EU, US, Japan, etc.) — a lever for sequencing market entry.

6. Quality & QMS

QMS — Quality Management System: The documented system of processes ensuring devices are consistently designed and made to meet requirements. ISO 13485 is the reference model; a QMS is effectively mandatory to CE-mark or sell in most markets.
eQMS: An electronic QMS platform (e.g., Greenlight Guru, Qualio, MasterControl) digitizing documents, training, CAPA, and records. Popular with startups to avoid paper systems.
SOP — Standard Operating Procedure: A controlled document describing how a recurring activity is performed. The backbone of a QMS.
Design controls: The disciplined design process: design inputs (requirements) → design outputs (specs) → verification (did we build it right?) → validation (did we build the right thing?) → design transfer → design review → DHF. Required by ISO 13485 §7.3 and 21 CFR 820.30.
Verification vs. validation (V&V): Verification confirms outputs meet inputs (testing to spec). Validation confirms the device meets user needs and intended use in real/simulated conditions. Distinct and both required.
Risk management file (RMF): The ISO 14971 record set: risk management plan, risk analysis (e.g., FMEA/hazard analysis), risk evaluation, controls, residual risk, and report.
FMEA — Failure Mode and Effects Analysis: A bottom-up technique cataloguing potential failure modes, their effects, causes, and controls, often scored by severity/occurrence/detection. A common (not mandatory) risk tool.
Hazard analysis: A top-down risk method starting from hazards and hazardous situations; ISO 14971 is method-agnostic but expects traceable hazard-to-harm reasoning.
CAPA — Corrective and Preventive Action: The closed-loop process to investigate problems, fix root causes (corrective) and prevent recurrence/occurrence (preventive). A top area of audit findings.
Nonconformity (NC): A failure to meet a requirement. Managed via nonconformance handling, disposition, and (if systemic) CAPA.
Root cause analysis (RCA): Structured investigation (5 Whys, fishbone/Ishikawa, fault tree) to find the true cause of a problem rather than the symptom.
Change control: The process governing how changes to design, process, suppliers, or documents are assessed, approved, and implemented without introducing risk.
Document control / record control: Managing the creation, review, approval, versioning, and retention of controlled documents (living) and records (evidence of past activity).
Supplier / vendor qualification: Evaluating and monitoring suppliers of components, sterilization, contract manufacturing, etc., with quality agreements and controls proportionate to risk.
Design freeze: The point at which the design is locked for verification/validation and transfer. Changing the intended purpose or design after freeze is costly — hence early regulatory strategy.
Process validation (IQ/OQ/PQ): Validating a manufacturing process that can't be fully verified by inspection: Installation Qualification, Operational Qualification, Performance Qualification.
Internal audit: Planned self-assessment of the QMS against ISO 13485/regulatory requirements; feeds management review.
Management review: Top-management's periodic review of QMS performance, feeding resource and improvement decisions. A required ISO 13485 input/output cycle.
Notified body audit / surveillance audit / recertification: NB assessments of your QMS: initial certification, annual surveillance, and (typically) recertification every few years, plus unannounced audits under MDR.
CE technical file review: The NB's assessment of your technical documentation; sampling depth scales with device class.
Complaint handling: The regulated process for capturing, evaluating, and (where needed) reporting customer complaints, with links to vigilance/MDR reporting.
Traceability: The ability to link requirements → design → V&V → risk → production records, and to trace a marketed unit back through its build (via UDI/DHR).

7. Clinical & evidence

Clinical evaluation: The systematic, ongoing appraisal of clinical data to verify safety, performance, and acceptable benefit-risk of a device for its intended purpose. Documented in the CER (EU MDR Annex XIV). Not a one-time event.
Clinical data: Safety/performance information from clinical investigations, literature on equivalent devices, and post-market clinical experience.
Clinical investigation / clinical trial: A prospective study of a device in human subjects to assess safety/performance. Governed by ISO 14155 (device GCP) and, in the EU, MDR Arts. 62–82.
GCP — Good Clinical Practice: International ethical/scientific quality standard for designing, conducting, and reporting trials involving human subjects.
Endpoint: A measured outcome used to judge a study. Primary endpoint = the main question; secondary endpoints = supporting. Choice drives sample size and claims.
Sample size / power: The number of subjects needed to detect an effect with acceptable statistical confidence; underpowering is a common, fatal study-design error.
Sensitivity & specificity: For diagnostics: sensitivity = true-positive rate (catches disease); specificity = true-negative rate (avoids false alarms). Core IVD performance metrics.
PPV / NPV: Positive/Negative Predictive Value — the probability a positive/negative result is correct, which depends on disease prevalence — important when translating trial performance to real-world settings.
Analytical vs. clinical performance (IVD): Analytical performance = does the assay measure the analyte correctly (precision, accuracy, LoD)? Clinical performance = does the result correlate with the clinical condition? IVDR requires both plus scientific validity.
Equivalence (clinical): [EU] Demonstrating your device is clinically, technically, and biologically equivalent to another to leverage its clinical data. MDR criteria are strict and require access to the other device's technical data.
Real-world evidence (RWE) / real-world data (RWD): Clinical evidence derived from routine-care data (registries, EHRs, claims). Increasingly accepted by FDA and EU to supplement or, sometimes, substitute trials.
IRB / Ethics Committee: The Institutional Review Board (US) / Ethics Committee (EU) that reviews and approves study ethics and protects subjects. Required before enrolling patients.
Informed consent: The process ensuring subjects understand and voluntarily agree to study participation.
Investigator's Brochure (IB): The compiled clinical/nonclinical information on the device given to trial investigators.
Adverse event (AE) / SAE / ADE: An untoward medical occurrence in a subject; 'serious' if it results in death, life-threatening condition, hospitalization, disability, etc. ADE = Adverse Device Effect (linked to the device).
Benefit-risk determination: The judgment that a device's clinical benefits outweigh its residual risks under normal use. The ultimate acceptance criterion across MDR, FDA, and ISO 14971.
Clinical Investigation Plan (CIP) / Protocol: The document specifying study objectives, design, endpoints, and methods.
Literature review / systematic review: A structured, reproducible search and appraisal of published evidence; a required component of most clinical evaluations.
Usability / human factors validation: Simulated-use or actual-use testing (per IEC 62366-1 / FDA HF guidance) confirming users can operate the device safely, especially for critical tasks.

8. Software, AI & cybersecurity

SaMD — Software as a Medical Device: Software intended for a medical purpose that performs that purpose without being part of a hardware device (IMDRF definition). E.g., an app that analyzes images to flag disease.
SiMD — Software in a Medical Device: Software that is embedded in or controls a hardware device (a.k.a. firmware/embedded software). Different from SaMD but often conflated.
MDSW — Medical Device Software: [EU] term (from MDCG 2019-11) covering software that is itself a device; guides qualification and classification (see Rule 11).
IEC 62304 software safety classes: Class A (no injury possible), Class B (non-serious injury possible), Class C (death or serious injury possible). Determines required rigor.
Locked vs. adaptive (continuous-learning) algorithm: A locked model gives the same output for the same input until deliberately updated; an adaptive model learns continuously. Regulators favor locked models plus a PCCP for controlled updates.
GMLP — Good Machine Learning Practice: FDA/MHRA/Health Canada joint principles for AI/ML device development (data quality, training-test separation, monitoring).
EU AI Act: EU regulation on artificial intelligence. Medical-device AI that requires third-party conformity assessment (for example MDR Class IIa and above software, IVDR Class B and above) is treated as high-risk, adding requirements on top of MDR and IVDR: risk management, data governance, transparency, human oversight, and logging. The high-risk obligations for AI that is, or sits inside, a medical device apply from 2 August 2028. That date is set by Regulation (EU) 2026/1744, the Digital Omnibus, which was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026; it supersedes the original 2 August 2027 date.
Cybersecurity (premarket/postmarket): Requirements to design, test, and maintain device security (threat modeling, SBOM, patching). FDA has explicit premarket cybersecurity requirements (FD&C Act §524B); EU relies on MDR GSPRs + IEC 81001-5-1 and the emerging Cyber Resilience Act.
SBOM — Software Bill of Materials: An inventory of software components and dependencies, increasingly required to manage vulnerabilities (e.g., FDA premarket cybersecurity).
Interoperability: The ability of a device to exchange and use information with other systems (EHRs, other devices); regulated for safety where it affects clinical function.
Verification & validation for software: Unit/integration/system testing plus validation against user needs; documented per IEC 62304 and design controls.
DiGA — Digital Health Applications: [EU/Germany] The German 'app on prescription' scheme: CE-marked digital health apps that, after listing in the BfArM DiGA directory, are reimbursed by statutory insurers. A landmark digital-health reimbursement route.

9. Reimbursement & market access

Market access: The set of activities (regulatory + reimbursement + pricing + evidence) required to get a device used and paid for, not just legally sold. Regulatory clearance ≠ commercial success.
Reimbursement: Payment to providers/patients for using a device or the associated procedure, by public or private payers. Often the true gating factor for adoption.
HTA — Health Technology Assessment: Systematic evaluation of a technology's clinical and economic value to inform coverage/pricing (e.g., NICE in the UK, IQWiG/G-BA in Germany). The EU now has a Joint Clinical Assessment (JCA) under the HTA Regulation (EU) 2021/2282, phasing in from 2025.
Coverage / coding / payment (the 'three Cs'): Coverage = will a payer pay for it? Coding = which billing code describes it (CPT, ICD, DRG, HCPCS)? Payment = how much? All three must line up for reimbursement.
CPT code: [US] Current Procedural Terminology codes (AMA) describing procedures/services; a Category I CPT is the goal, Category III is temporary/emerging.
ICD-10 / ICD-11: International Classification of Diseases codes for diagnoses (and procedures in some systems); used in claims and epidemiology.
DRG — Diagnosis-Related Group: A payment classification bundling an inpatient stay into a fixed payment; a new device must fit (or justify a new/adjusted) DRG to be adopted in hospitals.
HCPCS: [US] Healthcare Common Procedure Coding System — codes (esp. Level II) for products, supplies, and devices not in CPT.
CMS / NCD / LCD: [US] The Centers for Medicare & Medicaid Services; National Coverage Determinations (nationwide) and Local Coverage Determinations (regional MAC) set Medicare coverage.
TCET / NTAP / Breakthrough coverage: US mechanisms to accelerate payment for novel tech: NTAP (New Technology Add-on Payment) for inpatient; TCET (Transitional Coverage for Emerging Technologies) pathway for certain breakthrough devices.
Payer: The entity that pays for care: public (Medicare/Medicaid, statutory insurers, NHS) or private (commercial insurers).
Value-based / value dossier: Evidence package (clinical + economic) arguing a technology's value to payers; core to reimbursement strategy.
Health economics / HEOR: Health Economics and Outcomes Research: cost-effectiveness (e.g., cost per QALY — Quality-Adjusted Life Year), budget-impact modeling, used to justify price and coverage.
QALY / ICER: Quality-Adjusted Life Year (a year of perfect health = 1) and Incremental Cost-Effectiveness Ratio (extra cost per extra QALY vs. comparator); central HTA metrics (e.g., NICE thresholds).
DiGA / DiPA (Germany), PECAN (France): National digital-health reimbursement fast-tracks: Germany's DiGA (apps) and DiPA (care applications), France's PECAN early-access scheme. Bellwethers for digital-therapeutic reimbursement.
GPO / IDN: [US] Group Purchasing Organization and Integrated Delivery Network — hospital purchasing structures a device company must sell through; contracting is a real barrier to adoption.
Tender: [EU/public systems] Competitive public procurement process through which many hospitals/health systems buy devices.

10. Startup, funding & commercial

TAM / SAM / SOM: Total / Serviceable / Serviceable-Obtainable Market — nested market-size estimates investors expect: everyone who could use it, who you can reach, and who you'll realistically win.
ICP — Ideal Customer Profile: The precisely defined type of customer (specialty, facility size, geography, buyer) a company targets first.
Pre-seed / Seed / Series A/B/C: Successive equity financing rounds by maturity. In MedTech, rounds are often gated by regulatory and clinical milestones (e.g., 'raise to first-in-human' or 'raise to CE mark').
Runway: How many months of cash the company has at its current burn rate. MedTech runways must be planned around long regulatory/clinical timelines.
Burn rate: Net monthly cash consumption (gross burn = spend; net burn = spend minus revenue).
Cap table: The record of who owns what (equity, options, SAFEs/convertibles) and each stakeholder's ownership percentage and dilution.
SAFE / convertible note: Instruments that convert into equity at a later priced round. SAFE (Simple Agreement for Future Equity) is not debt; a convertible note is debt with interest and a maturity date. Both often use a valuation cap and/or discount.
Dilution: The reduction of existing owners' percentage when new shares are issued in a financing.
Pre-money / post-money valuation: Company value before (pre) and after (post) new investment: post-money = pre-money + new money raised.
Term sheet: The non-binding summary of key investment terms (valuation, board seats, liquidation preference, pro-rata rights) that precedes definitive documents.
Milestone-based financing / tranches: Capital released in stages tied to hitting milestones (e.g., design freeze, CE mark, first revenue) — common in capital-intensive MedTech.
Non-dilutive funding: Money that doesn't cost equity: grants (e.g., EU Horizon/EIC, NIH SBIR/STTR in the US), soft loans, revenue, and R&D tax credits. Especially valuable pre-revenue in MedTech.
Grant (SBIR/STTR, EIC, Horizon Europe): Government/EU non-dilutive R&D funding programs frequently used to fund early MedTech development and de-risk before a priced round.
IP — Intellectual property: Patents, trade secrets, trademarks, and design rights. Freedom to Operate (FTO) analysis checks you don't infringe others' patents — critical before scaling.
FTO — Freedom to Operate: A legal assessment that making/using/selling your device won't infringe third-party IP in target markets.
Regulatory milestone: A value-inflection event (Pre-Sub feedback, IDE/CE submission, clearance/approval, first PMCF data) that de-risks the company and unlocks the next raise or partnership.
Reimbursement milestone: Coverage/coding/payment wins (e.g., a Category I CPT, DiGA listing, positive HTA) that materially change commercial prospects.
Build vs. buy (manufacturing) / CDMO / CMO: Decision to manufacture in-house or via a Contract (Development and) Manufacturing Organization. Affects QMS scope, supplier controls, and capital needs.
OBL / PLM: Own-Brand Labeling / Private-Label Manufacturing — Selling a device made by another manufacturer under your own brand; MDR sharply limits the old 'virtual manufacturer' shortcut — you inherit full manufacturer obligations.
510(k)-to-revenue / CE-to-revenue timeline: The realistic gap between regulatory clearance and meaningful revenue once sales, reimbursement, and adoption ramp — frequently underestimated in plans.
Regulatory due diligence: Investor/acquirer assessment of a target's regulatory status, QMS maturity, clinical evidence, and liabilities (open 483s, NB findings, MDR readiness). A common deal-killer or price-adjuster.
Exit: The liquidity event for investors/founders: acquisition (most common in MedTech, often by a strategic like Medtronic/J&J/Stryker) or IPO.
Strategic (acquirer/partner): A large industry player that may acquire, license, or distribute a startup's technology; MedTech exits skew heavily toward strategics.
KOL — Key Opinion Leader: An influential clinician whose endorsement, trial participation, or publications drive credibility and adoption.
Value proposition / clinical claim: The specific, evidence-backed benefit statement. Claims are constrained by your cleared/approved intended purpose — marketing and RA must stay aligned to avoid off-label promotion.

See where you stand, in about ten minutes.

Free, AI-powered, and every gap comes with a next step.

Start the MedTech Compass