Class IIa is the moment a digital health product stops being software and starts being a medical device with regulatory consequences. We learned that the hard way — and the good way. The timeline from "draft the intended-purpose statement" to "certificate in hand" spans roughly a year and a half in our experience, split fairly evenly between technical-file authoring and risk management, quality-system iteration and internal audits, and notified body interaction and remediation.
What surprised us
The intended-purpose statement is the single most leveraged document. Tighten it before anything else.
Risk management never freezes. New device integrations re-open it every time.
Post-market surveillance is the underrated long-term cost — plan capacity for it from year one.
A clean clinical-evaluation strategy saves more time than any tooling investment.
Where we would do things differently
We would start the post-market surveillance plan in parallel with the technical file, not as an afterthought once certification is close. We would also bring a regulatory affairs lead into the team earlier — that role pays for itself before the first audit.
“Certification is a one-time effort the way a marathon is a one-time effort.”
— DIETRICH CHARISIUS — CTO
Notified Body Regulatory Authorities