We stand up a QMS built for software teams, not for paperwork, and we run it with you afterwards. Audit-ready from the day you ship.
Completed DHF and 510(k) documentation in 7 weeks. FDA cleared 4 months after submission."
Fast 510(k) cleared vascular AI CADt in 9 months after stalled strategy, with only two FDA deficiencies.
First submission, first clearance: multi-model cardiac MRI AI cleared in 5.5 months with an FDA-authorized PCCP.
Recent FDA submissions
Our Clients Include
Is this for you?
Exiting R&D
The trigger is rarely the submission. It is the moment you stop exploring and start making choices somebody will later ask you to justify. The design history file has to begin here, and retrofitting it later costs far more than starting it now.
Hardware QMS, software team
One client described getting quality records out of their engineers as pulling blood from a stone. A QMS written for manufacturing does not fit a team that ships weekly. We build the software half so it fits how your engineers already work.
A system nobody can run
Procedures written to satisfy an auditor and nothing else get ignored by week three. We write them to match how your company actually operates, train your team, and either hand over or stay on. Both are real options and we will tell you which fits.
Proof, not promises
Software and AI-enabled devices where we owned the documentation and served as regulatory correspondent.
What exists today, what pathway you are on, and when you plan to ship. We will tell you whether two months is realistic and what would stop it.
The core differentiation
A QMS that satisfies an auditor and nothing else gets worked around by week three, and then you have two problems: a system nobody follows and records that do not match reality. That is what an investigator finds.
What moves our timeline is almost never the regulation. It is fitting the procedures to how your company already works. We have supported more than 60 FDA submissions, so we know which parts a reviewer will stop on and which parts you are free to shape around your team.
We needed to start documenting design decisions as we exited R&D. Innolitics stood up the system in Notion, and it is the first quality process our engineers have not routed around.
What you get
Procedures written for your company, the platform they live in, the records already started, and your team trained to run them.
Which regulations apply, which procedures you need first, and the order we build them in. Two weeks, and it is what makes the rest predictable.
Design and development, risk management, cybersecurity, document control, training, and supplier control first, because those gate your submission. Post-market procedures follow.
Your eQMS running on Notion with our compliance layer: electronic signatures, Part 11, SBOM handling, and tool validation with test cases and documentation.
Document change orders, training matrix, approved supplier list, the design history file. An empty system passes nothing, so we start the records with you.
FDA establishment registration, device listing, UDI, and GUDID. The administrative work that blocks shipping and that nobody budgets time for.
We run the first internal audit and the first management review inside your first year, which is both a regulatory requirement and the best rehearsal you will get.
A readiness report for an FDA inspection. Registered firms can be inspected on about a week’s notice, so being ready is not a project you start when the letter arrives.
We train your team to run it. You can take it from there, or keep us on to maintain it. The audit guarantee applies while we are the ones running it.
How the two months run
Pre-market procedures first, so your design file can start immediately. Post-market procedures, training and the first internal audit follow.
Pre-market QMS work and design history file preparation run concurrently. Neither waits on a submission, and neither waits on FDA.
Which situation looks like yours?
Most engagements are one of these. If yours is not on the list, it is still worth a call.
The packaged engagement. Scope and plan, then the pre-market procedures that gate your submission, then the post-market half. Two months to a system you can be inspected against.
Your manufacturing procedures do not describe how software gets built, and your engineers work outside them. We build the software half, map it to what you already have, and avoid standing up a second parallel system.
Model training, data provenance, acceptance criteria for third-party algorithms, and change control for retraining. These are the procedures most quality systems are missing, and the ones an AI-focused investigator asks for.
Drawing the boundary so the regulated product sits under design controls and the rest of the platform stays free to ship weekly. Decided early this is cheap, and it keeps the unregulated side fast.
A gap assessment runs about one to two weeks and tells you what is actually missing. Remediation is usually about six weeks after that. We would rather scope from findings than from a guess.
Registered firms can be inspected on about a week's notice. We triage what matters before the visit, run a mock audit, and write the readiness report. This is the one engagement where we work backwards from a date.
Fixed fee. One guarantee. One team.
Pre-market first so your design file can start, post-market after the submission goes in. We write the procedures, train your team, and stay on if you want the guarantee to stay on.
Before you book the call
Later than most people assume, and the answer depends on your pathway.
For a 510(k), the quality system is not required until you sell the device. You can submit without it. Teams routinely stand up the QMS after the submission goes in, while FDA is reviewing.
For a De Novo, it should be running during the review. Scrutiny is higher, post-market expectations are heavier, and FDA can audit during the review. It is rare, but it happens.
The other trigger has nothing to do with FDA. The day you stop exploring and start making design decisions somebody will later ask you to justify, your design history file needs to exist. That is usually earlier than either of the dates above.
We guarantee your quality system passes its first audit.
The condition: it applies while we are the ones maintaining the QMS. If we implement it and your team takes it over, the guarantee ends with the handover. A quality system is only as good as the records being kept in it, and once we are not the ones keeping them we have no control over whether it is being run properly.
You can absolutely take it over. Plenty of clients do, and we train your team for exactly that. Just know that the guarantee goes with the maintenance.
A fixed fee, paid at key milestones, quoted once we know what exists today.
It is the same for a 510(k) or a De Novo. A PMA costs more, because the quality system carries heavier obligations and more scrutiny.
What moves it is the starting point. Greenfield is the most predictable. An existing system is scoped from a gap assessment rather than a guess, because we would rather quote from findings. Be aware that existing documentation rarely transfers directly, so having procedures already written does not usually reduce the price much.
Separate from our fee: your own Notion licences, and any hourly or retained quality support after the implementation.
Yes. Our team is trained on Medtech OS, and that is a large part of how we hit the timeline.
There are plenty of other good quality management and eQMS tools out there. We do not support them.
Medtech OS runs on Notion, so you will need Notion licences for the people using it. That cost is yours rather than ours.
Your choice, and we will be straight about the trade.
We can train your RAQA team and phase out, which is what we do when you have quality staff already. Or we can keep running it, which is what we do when you do not want to hire for it yet.
The audit guarantee applies while we are maintaining it. If you take it over, you get the system and the training, and the guarantee ends there.
Yes. Every procedure, work instruction and record template you need is included, and we customise them to your company rather than handing over a generic pack.
You are not supplying the content. That is the expensive part of standing up a quality system, and it is the part we bring.
Yes. Templates for the full set of cybersecurity documentation needed for a submission are included: the cybersecurity management plan, threat model, security risk assessment, SBOM and its support documentation, and the testing and metrics reports.
This is the package FDA now refuses submissions without, so it is part of the quality system rather than something you assemble separately later.
Yes. Data provenance, model training and validation, acceptance criteria for algorithms you did not build, and change control for retraining are all covered.
Most quality systems do not have these, which is why we built them in. If you have a PCCP, the quality system has to be able to execute it: a plan FDA authorized and a company that cannot follow it is a worse position than not having one.
It feeds it directly. The product development plan, the cybersecurity management plan, and the risk management file written for a submission become the starting point for your internal procedures.
If we are doing both, you are not paying twice for the same thinking. If somebody else did your submission, we will use what they produced.
If you are registered with products listed, an investigator can arrive on roughly a week’s notice, and that is a different part of FDA from the people reviewing your submission.
Inspection readiness is a deliverable here, not an afterthought: a readiness report, the first internal audit, and the first management review. The audit is the rehearsal.
Two things, both recurring.
Medtech OS is a subscription, billed quarterly, which covers support for the platform and keeps the compliance layer maintained. It does not cover customising the system to new business needs; that is quoted separately.
Notion licences are paid by you directly to Notion, per user, for everyone who needs access. We cover the Notion cost during the implementation itself.
Optional on top of both: retained or hourly quality support after the implementation. That is also what carries the audit guarantee.
No. This service sets up a new quality management system, not an assessment of one you already have.
If you do have an existing QMS and you want it assessed, we are happy to do that. It is a separate piece of work, and we would scope it on its own terms.
We build to the Quality Management System Regulation, 21 CFR Part 820. Since February 2026 the QMSR incorporates ISO 13485:2016 by reference, so the requirements we build to are ISO 13485.
Certification is a separate matter. FDA does not require a certificate of conformance to ISO 13485, does not issue one, and a certificate does not exempt you from an FDA inspection. What we build is a sound foundation if you later pursue certification through a registrar, but we do not lead certification or MDSAP engagements, and we will say so on the call rather than after you sign.
Often yes. Exempt from premarket review is not the same as exempt from the quality management system regulation, and the exemptions that do apply are narrower than people expect.
It is worth getting the listing strategy right before you register, because registering products you did not need to register pulls you into obligations you could have avoided.
When ISO 13485 certification or MDSAP is the real goal rather than FDA compliance.
When you want a platform licence and nothing else. We are not an eQMS vendor, and if all you need is software there are cheaper ways to buy it.
When the device is hardware-first and the software is incidental. Our quality work is built around software lifecycle, and a manufacturing-heavy system is not where we add the most value.
30 minutes. No deck.
We will tell you when you actually need a QMS, what the gap is, and whether you need us at all. If a gap assessment is the right first step, we will say so.
What people read before booking
The same reasoning that goes into a quality system, written up in public.
What does a QMS actually require?
A comprehensive FAQ for people who are interested in creating a new medical device software to learn the basics about the US regulations.
J. David Giese
How do we write design inputs?
The FDA says developing your design inputs is “the single most important design control activity,” yet writing good design inputs is difficult. This article presents Innolitics’...
J. David Giese
Do we rewrite the prototype?
This article discusses engineering and regulatory factors to consider when deciding to rewrite or reuse existing prototype code. It should be useful to researchers or companies ...
J. David Giese
When does a software change need a new 510(k)?
This FDA guidance document provides manufacturers of medical devices with information on when a new premarket notification (510(k)) is required for a software change to an exist...
How often can we ship updates?
Medical-device software release frequency is a common question, particularly from software engineers familiar with agile development. The answer hinges on two key factors: wheth...
J. David Giese & Jim Luker
Can we clear AI-generated code?
From solo clinicians prototyping algorithms to enterprise teams shipping production software, tools like Cursor, Claude Code, ChatGPT Codex, GitHub Copilot, Lovable, Replit, Ant...
Yujan Shrestha
How do we keep updating the model after clearance?
With predetermined change control plans (PCCPs), FDA has given manufacturers a great new regulatory tool. In this article, we discuss PCCP best practices and questions based on ...
J. David Giese
What does FDA expect on cybersecurity?
This article provides an in-depth exploration of medical device cybersecurity requirements, including best practices and FAQs. It also includes examples and resources for those ...
J. David Giese
Need something else?
Regulatory strategy and FDA Pre-Sub, concept to cleared device, AI/ML submissions, and FDA cybersecurity, each sold on its own.
Every great partnership starts with a conversation. Fill out the form below for a discovery call, and an Innolitics team member will contact you soon.
I learned more from an hour-long Innolitics sales call than an entire paid engagement from other consultants.
Richard Clark
Executive in Residence at Washington University
