> Those things are all necessary anyway
It's a bold statement. Have you ever actually been working on any compliance yourself? 80% of everything is just senseless bureaucracy. I've worked in a medical startup and we had it all: GDPR, HIPPA, FDA approvals etc. The requirements are completely detached from reality and are usually written for some X-Ray producing firms from 20th century, not an health-tech AI startup. And they're trying to regulate everything, even how your organizational structure should look like, how you should create tickets in Jira (or any other _compliant_ products). Developers had to take useless trainings on how a medical organization should operate, which were essentially the courses of Aesopian language of medical bureaucracy. And legal expenses, boy o boy, the company had to spend twice as much on compliance staff than it did on developers. And what was the result? Rich American competitors with a ton of VC money were getting approvals while our company was struggling with all this idiocy despite having a much more superior product.
I'm specifically criticising the claim that GDPR was among the most burdensome requirements. Very little of GDPR is additional to what you need to do anyway, apart from DSARs (which aren't burdensome: you may charge a fee if someone's abusing the process), appointing a DPO (optional for most organisations), and the third-country restrictions (which are partly necessary, and article 45 reduces the burden). I don't dispute that regulations can be silly and a waste of time (e.g. PCI compliance requiring the removal of effective security measures, as directed by incompetent auditors, because the legal requirement is "passes an audit"), but I do dispute the use of GDPR as an example.
I'll note that of the three regulatory acronyms you gave, two of them (HIPPA and FDA approvals) are American.
> two of them (HIPPA and FDA approvals) are American
I specified all three via comma to highlight that we had quite some history in compliance, in different jurisdictions.
HIPPA covers only medical devices, GDPR covers everything. FDA approval process is convoluted and expensive, especially for new types of devices, but it's still much easier than European MDR.
Also, I mentioned FDA because we didn't even try to get a proper compliance in the EU, because it's impossible for a startup without huge support.
No, the HIPAA Privacy Rule covers only medical information: see https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg.... Perhaps with your organisation, this was restricted to devices, but within a hospital environment there's a lot more covered by the HIPAA Privacy Rule than just medical devices. NB: the combined text of the applicable HIPAA rules (115 pages) are a lot longer than the entire text of the GDPR (88 pages, including recitals).
> The certificates shall be valid for the period they indicate, which shall not exceed five years. On application by the manufacturer, the validity of the certificate may be extended for further periods, each not exceeding five years, based on a re-assessment in accordance with the applicable conformity assessment procedures.
Other than that, it just seems like "do actual science to determine safety" and "if there's no 'intended medical purpose', also do actual science to demonstrate efficacy". The HMT Medizintechnik GmbH consultation feedback seems to say that a small company providing, say, basic sutures, is required to repeatedly prove the adequacy of those sutures, even though everybody knows that basically any sutures are adequate for those cases where sutures are adequate; but I don't think that's a correct reading of the law. (And this shouldn't affect a new device.) So I'm a bit confused. https://www.medtecheurope.org/wp-content/uploads/2025/03/250... clinical evaluation TOP 3 (on page 18) does not describe a problem with the text of MDR, but as a long-term mitigative measure they suggest:
> Possibly making this clearer in the text revision so Notified Bodies do not feel they must ask for PMCF clinical investigations as a default.
You never claimed that the text of the regulation was the issue; and I think I'm starting to see where the problem lies. While the rules are mostly sensible, they delegate to national bodies empowered to exercise discretion, and these bodies are (reportedly) erring on the side of excessive requirements. Was this the reason you gave up on EU certification without attempting it?
