From idea to CE mark, a realistic compliance timeline for software startups

Most founders ask some version of "how long until I can sell?" and gets some version of "it depends." True, but useless. Here is the ladder we use with founders, six milestones on a shared path, then a fork that depends on your device class. With honest durations.

The ladder

1. Classified. You know whether your software is a medical device, and if so, what class under EU MDR and what software safety class under IEC 62304. This takes an afternoon with our classifier, or a short specialist engagement if you are genuinely borderline. Everything downstream, cost, timeline, whether a notified body is in your future, hangs on this answer, which is why guessing is the most expensive shortcut in medtech.

2. Goal confirmed. Target market chosen, applicable standards known, end state defined. For most readers: EU first, ISO 13485 plus IEC 62304 plus ISO 14971, aiming at a CE mark. A day of thinking, best done deliberately rather than by drift.

3. Core QMS built. Document control, management responsibility, training records, supplier management, CAPA, internal audit. The ISO 9001-shaped foundation quality systems share. A focused founder with good scaffolding gets here in two to four weeks alongside product work. This is also the stage at which you are, quietly, ahead of most of your competitors.

4. Medical device QMS built. The device-specific layer: intended use statement, risk management file under ISO 14971, complaint handling, usability records, and the IEC 62304 software lifecycle evidence, requirements, system tests, SOUP register, release discipline. Four to eight weeks for a software-only product, largely because your engineering practices already produce most of the raw material and the work is structuring it into evidence.

5. Operating. The milestone founders skip in their planning, and auditors do not. A QMS with empty registers is a theory. You need roughly three months of live records: real CAPAs opened and closed, a management review held, an internal audit completed, complaints handled if any arrived. This is the one duration money cannot compress, because evidence has a minimum age. The trick is that it runs in parallel with everything else in your company, so the founders who start the clock early feel this stage as zero delay, and the ones who start late feel it as a quarter of lost revenue.

6. Ready to apply or declare. Requirements checklist passes, self-audit is clean, and, our standing advice, one targeted consultant review has confirmed the system holds up to unfriendly eyes. Days of specialist time, not months.

The fork

Class I: declare and sell. Technical file complete, Declaration of Conformity signed, EUDAMED registration done, product on market. No audit, no certificate, no notified body, that is what self-declaration means. Realistic total from a standing start: six to twelve months, dominated by stages 3 to 5.

Class IIa: the notified body path. Application, QMS audit, technical documentation review, findings closed, CE certificate issued. Notified bodies have queues, audits reveal findings, findings take cycles to close. Realistic total: twelve to twenty-four months from QMS setup, and initial notified body fees typically in the €26,000 to €41,000 range based on their published rate schedules. If this is your class, the ladder is not optional sequencing, it is your critical path, and stage 5 belongs on it as early as possible.

Certification track (either class, when customers demand it): certification body audit against ISO 13485, typically adding three to six months from an operating QMS, and available whenever the commercial case appears. We covered when that certificate is actually needed in Do I need ISO 13485 to sell?

What actually causes delay

Not paperwork volume. In our experience watching founders move through this, the delays are: classification done late or wrong, forcing rework of everything built on it; the operating clock started at the end instead of the beginning; the intended use statement drifting because marketing kept editing claims; and traceability rebuilt by hand before each review instead of maintained continuously.

Notice what is on that list: sequencing mistakes, each of them avoidable, and free to avoid. Notice what is not on it: any task that requires €50,000 or a consultant on retainer.

Start the clocks

If you take one thing from this post: two clocks matter, and both reward starting early. The classification clock, five minutes on the classifier, unlocks correct planning today. The operating-evidence clock, started the week your QMS exists, runs silently in the background and saves you a quarter at the far end.

The ladder is long, but each rung is knowable in advance. That is the difference between a hard journey and a scary one, and this one is only the first kind.