Qualio Blog

The Agentic Compliance Era

Robert Fenton — Tue, 25 Aug 2026 12:00:00 GMT

Every time enterprise software has evolved, most of the incumbents haven't successfully made the transition. It's happening again, and compliance is one of the greatest opportunities for disruption.

Enterprise software has had three eras.

Era 1: Systems of record (1980s–2000s). The first wave of enterprise software was about structured data storage. ERPs, CRMs, databases. The first interfaces were black screens with green text, requiring keyboard commands to navigate, enter, and retrieve data.

Era 2: Systems of engagement (2000s–2020s). Around the same time that SaaS emerged, we also saw improvements in the user interface layer across products. This brought modern UIs that made it easier for people to use software to do their work. The underlying data model didn't change much, but the experience did. Software became much easier to use, and became a bigger and bigger part of our everyday lives.

Era 3: Systems of action (2020s+). We are now entering a new era for software. One where the value delivered by software isn't measured by its ability to store your data or help you do your work; it's measured by its ability to take action and drive outcomes that matter to customers. This includes initiating and executing work on its own, surfacing decisions for people to approve, and operating continuously without needing a human to drive every step.

What does this mean for life sciences compliance?

Compliance is a category being rebuilt around AI. It's already happening in financial services, transforming everything from KYC to transaction monitoring. It's also coming to life sciences, and the stakes are higher here, because the output is a safe product reaching a patient rather than a filing.

Life sciences has evolved over the last decade. Product development cycles are shorter, AI and software are embedded in more products, and companies are placing greater emphasis on efficiency. But the standard compliance model hasn't kept pace, and the fragmented, outdated approach to compliance is now a critical bottleneck and risk for the industry.

Today, companies scramble to meet their obligations using a combination of traditional, fragmented reactive systems and growing headcount, and are starting to experiment with AI in their work. This approach requires constant human coordination, adds friction to the product development process, and prevents real-time visibility into audit readiness.

In a perfect world, companies could take a continuous compliance approach that integrates product lifecycle, quality management, and regulatory compliance. It would be designed for both humans and AI agents to collaborate to solve problems and increase speed to market. And it would provide real-time visibility into progress, risks, and the actions needed to meet compliance requirements and regulatory goals, without slowing you down.

The systems-of-action era enables this for life sciences companies, and we see this emerging category as agentic compliance. It's where we are going as a company.

Qualio: the agentic compliance platform

Picture running compliance the way it should work. Your product teams move without stopping to wait on the quality team for every answer. Impact assessments, gap analyses, and evidence collection run continuously in the background instead of pausing development. You walk into an audit already ready, because readiness is a real-time state and not a fire drill. And you see a regulatory risk the moment it emerges, not in the postmortem.

That is the company Qualio is building. Qualio is the agentic compliance platform for life sciences. Our software and AI agents accelerate product development and automate quality and regulatory compliance, so teams can bring safe products to market faster. In practice, this means less manual evidence-chasing, earlier visibility into gaps, and faster progress toward regulatory milestones.

We believe an agentic compliance platform has to operate across four distinct quadrants:

Human component

Internal + human: the Copilot. A quality and compliance expert available to every person in the organization, around the clock. The Copilot answers regulatory questions in context, guides people through complex procedures, and dispatches agents to create work products such as document drafts and RFI responses. This replaces the "ask the quality team and wait" bottleneck that slows down every life sciences company.

External + human: the connected ecosystem. Open APIs and integration capabilities that let your compliance platform connect into the systems your teams already live in. The goal is to avoid forcing context switching between applications and to meet people where they work, at the appropriate point in their workflow.

Agent component

Internal + agent: the compliance agent. Agents that autonomously run impact assessments, perform gap analyses, collect evidence, generate corrective actions, and drive them through approval workflows without a human initiating each step. The agent operates against the regulatory framework, identifies what's needed, and executes.

External + agent: observability. AI monitors scanning regulatory databases, third-party systems, and external sources in real time. Think of these as an early warning system, an observability layer that detects changes in the regulatory environment before they become findings in your next audit.

None of these quadrants works in isolation. The value is in the architecture that connects them: a compliance ontology that understands the relationships between standards, controls, processes, evidence, outcomes, and the customer's own operational data.

The knowledge model that makes it all work

At the center is a compliance ontology that connects two kinds of context. The first is industry knowledge: regulatory frameworks, controls, evidence, and outcomes. The second is the customer's operating context: the records, processes, and data that show how the organization actually works. Together, they constrain AI so its outputs are governed, auditable, and tied back to the underlying record. This ontology:

Maps across FDA, ISO 13485, EU MDR, GxP, and ICH frameworks

Connects regulatory requirements to customer records and data

Draws on knowledge from more than 1,000 customer deployments

Enables rapid deployment of new compliance workflows

What does that mean for QMS?

Quality management software has been a well-defined product category for over 30 years. And with this change, a new, better model is starting to emerge. The problem is that this approach focuses on optimizing inputs, while the compliance outcomes that drive company success are still largely left to the customer to figure out.

This isn't a gap you can close with a feature. It's an architectural problem. A system of record is built to store compliance artifacts like documents, signatures, CAPAs, and audit trails. You can bolt an AI assistant onto that architecture, but you can't bolt outcomes onto it, because the system was never designed to know what a good outcome is, let alone drive toward one. That is the trap the incumbents are in: two decades of product decisions optimized for capturing inputs, with no way to retrofit a system of action onto a foundation built for storage. Winning in this era takes more than adding agents to yesterday's data model. It takes rebuilding around the outcome.

For a closer look at how this works in practice, starting from the regulation and working backward, see Flipping the Compliance Model for Life Sciences.

Success in a new technological era means being willing to leave the old model behind, not the discipline that made it work. A strong system of record still matters, and powerful software still wins, even in the world of AI. What changes is what you build on top of that foundation, and what you measure it against. That is why we are expanding on our QMS foundation and building the agentic compliance platform for life sciences on top of it.

What changes for the industry?

If you're evaluating compliance technology today, document control, CAPA management, and a modern interface are table stakes. The more important questions are whether the platform can increase product development velocity, speed up regulatory milestones, and provide a continuously current view of risk as the company grows.

Looking forward

Every era of enterprise software creates a new generation of category leaders. The model has changed again. Systems of record gave way to systems of engagement, and now to systems of action. The same shift is coming to compliance.

The life sciences companies that lead over the next decade will treat compliance as an engine for speed. They will let agents carry work that used to depend on constant human coordination, while people retain control at the regulated decision points. They will move faster because their compliance is stronger.

Compliance has spent forty years slowing life sciences down. We want to make it the thing that speeds companies up, so the next generation of safe products reaches the people who need them sooner. That's the work that matters to us, and it's why we're building the agentic compliance era.

21 CFR Part 11 did not change in 2026. Everything around it did.

Meg Sinclair — Thu, 20 Aug 2026 09:00:00 GMT

Most quality leaders in life sciences can recite Part 11 without opening it. Validation. Audit trails. Signature manifestations. Access controls. Copies the FDA can actually read. The rule was published in 1997 and the requirements have barely moved since.

What has moved is the number of systems those requirements now apply to, and how fast those systems change underneath you.

The regulation held still. The environment did not.

On February 2, 2026, the amended Quality Management System Regulation took effect, replacing most of 21 CFR Part 820 with ISO 13485:2016 incorporated by reference. One day later, the FDA issued an updated final guidance, Computer Software Assurance for Production and Quality Management System Software, which supersedes the September 2025 version and aligns computer software assurance expectations to QMSR.

The interesting part is not the title change. It is the scope.

The guidance now formally defines cloud, IaaS, PaaS and SaaS. It names automation, analytics and AI or ML tools as in scope when they are used for production or quality purposes. It adds a subsection on software changes. It adds a worked example built around a SaaS product lifecycle system, in which the vendor is expected to document what an update changed, what was tested, and what the results showed. It retains a section on electronic records requirements, because Part 11 follows the record, not the vendor.

Read together, the message is straightforward. Your regulated record fabric is now assembled from systems whose release schedule you do not control.

One question is easy. The same question next quarter is hard.

"Is the system validated?" has a clean answer on the day you finish validation.

"Is the system validated?" has a much less comfortable answer eleven months later, after four vendor releases, two new integrations, a permissions restructure and a departure from the quality team.

That is the real shape of Part 11 work now, and it runs through every section of the checklist:

Validation. Validated against which version, and who confirmed the last three releases did not touch a function you rely on for record integrity?

Audit trailing. Every system that creates, modifies or deletes a regulated record needs a secure, time-stamped trail that survives the full retention period. Not just the eQMS. Every system.

Electronic record integrity. Signature manifestations have to carry printed name, date, time and meaning, and they have to survive display, print and export. Signatures have to stay bound to the record they signed.

Record copying. Accurate and complete copies, on paper and in electronic form, produced through an established export method. This is the question that gets answered in the room, under time pressure, with an investigator watching.

Record retention and access control. Unique identification code and password combinations, periodic validity checks, and a working procedure for revoking access when a person leaves or transfers.

None of these are hard to understand. They are hard to keep true.

The three answers that go stale first

Scope drift. An engineering team adopts a new tool. Design inputs start living there. Nobody classifies it as a system holding regulated records, so nobody asks a single Part 11 question about it. The record fabric grew and the compliance boundary did not.

Change lag. SaaS systems update on the vendor's calendar. The FDA now expects the vendor to tell you what changed and what was tested. Somebody on your side still has to read that, decide whether it touched anything risk-relevant, and record the decision. Multiply by every connected system.

Access decay. Leavers, transfers, contractors, elevated permissions granted for one release and never withdrawn. Access control is the requirement most likely to be true on paper and false in the system.

Every one of these is invisible to a checklist run once a year. That is not a criticism of checklists. It is a statement about frequency.

Point-in-time compliance cannot cover a continuous surface

The standard response to this problem is more effort. A bigger validation package. A consultant every twelve months. A second quality hire whose real job is chasing other teams for evidence.

That response does not scale, and the arithmetic shows why. Add a system and the reconciliation work grows. Add a framework, ISO 13485 alongside Part 11 alongside EU MDR, and it grows again. Add a product line and it grows again. Headcount rises in step with complexity, and the quality function turns into a permanent evidence-gathering operation with no capacity left for the work that actually reduces risk.

The alternative is not a better filing cabinet. It is compliance that executes continuously: controls monitored rather than sampled, gaps surfaced when they open rather than at audit prep, evidence assembled as work happens rather than reconstructed afterwards, and continuous gap analysis across all your standards instead of a separate manual pass for each one.

Run against that standard, the checklist changes function. It stops being an annual exercise and becomes a specification: forty-odd questions your systems should be able to answer on any given Tuesday, without a fire drill.

Start with the questions

Before deciding how to keep the answers current, get precise about the questions. The checklist breaks Part 11 into five sections, validation, audit trailing, electronic record integrity, record copying, and record retention, and gives you the specific requirement behind each one.

Work through it once for your eQMS. Then work through it for every other system that touches a regulated record. The gap between those two passes is the most useful diagnostic you will run this quarter.

Sources: FDA, Computer Software Assurance for Production and Quality Management System Software, final guidance, February 2026 (supersedes September 24, 2025). FDA, Medical Devices; Quality System Regulation Amendments, final rule effective February 2, 2026.

Your quality team has become an integration layer

Meg Sinclair — Thu, 20 Aug 2026 09:00:00 GMT

Ask a quality lead at a software-embedded life sciences company what they did last week and the answer is rarely quality work.

It is exporting test results from TestRail. Pulling design inputs out of Jira issues written for engineers, not auditors. Copying a complaint from Zendesk into an event record. Rebuilding a trace matrix in a spreadsheet because the source data lives in four systems and none of them agree on identifiers.

That is not administration around the job. At most companies of this shape, it has become the job.

The consolidation argument is over, and quality lost it correctly

The traditional answer is to bring everyone into one system. Engineering should manage requirements in the quality system. Support should log complaints there. Product should hold the roadmap there.

It does not happen, and the reason is sound. Engineering teams choose tools that make them fast. Jira, GitHub, GitLab, Azure DevOps, Asana, Xray, Zephyr Scale, TestRail. Those tools are load-bearing for product velocity. Asking a development team to leave them to satisfy a quality workflow is asking the company to slow down its product to speed up its paperwork. Nobody senior signs that trade.

So the record fabric stays distributed. And the quality team becomes the connective tissue, manually, forever.

Two costs follow.

The first is capacity. Reconciliation work grows with every system, every product line and every framework. Headcount rises with complexity, and the quality function spends its budget on evidence-gathering rather than risk reduction.

The second is exposure. A design input that lives only in a Jira ticket is a hole in the design history file. A test result that never leaves TestRail is a gap in verification traceability. A complaint that stays in Zendesk is a post-market surveillance failure. None of these show up as a red flag on a dashboard. They show up in an audit.

The regulator has already noticed where the records live

In February 2026 the FDA issued an updated final guidance, Computer Software Assurance for Production and Quality Management System Software, aligned to the amended Quality Management System Regulation that took effect on February 2, 2026.

The guidance formally defines cloud, IaaS, PaaS and SaaS deployments. It brings automation, analytics and AI or ML tools into scope when they are used for production or quality purposes. It expands expectations around vendor oversight. It retains a section on electronic records requirements.

The implication is direct. Part 11 follows the record, not the vendor. If a regulated record is created in a development tool, the obligations travel with it. The systems your engineers chose are already inside your compliance perimeter, whether or not your quality processes acknowledge them.

Manual reconciliation is not a workaround for that. It is a control with a human single point of failure, running at whatever frequency somebody has time for.

Connection is not convenience. It is the substrate.

Qualio connects to the systems where regulated work actually happens, in three groups:

Core. Jira, Azure AD, Google Suite, Okta and OneDrive, for single sign-on, project management and hybrid document control.

Product development. Asana, Azure DevOps, TestRail, GitHub, GitLab, Xray and Zephyr Scale, for product, test and risk data.

CRM, LMS and ticket management. Salesforce, HubSpot, ComplianceWire, Zendesk, Intercom and Microsoft Dynamics, for customer centricity, training and post-market surveillance.

What changes is not the number of logins. It is where the truth lives.

Create a test case in Xray and link it to a Jira requirement, and it synchronizes into design controls with current title, status and description. Run the test and the result arrives with the date and the responsible person attached. Raise a customer event in Salesforce that meets your trigger criteria and an event opens in Qualio with an owner and a workflow already routing. Approve a document with training requirements and the training event fires in ComplianceWire without anyone rekeying it.

Engineering stays in the tools that make it fast. Quality stops rebuilding the picture by hand.

Why this matters more than it did two years ago

Connected data is the precondition for compliance that executes continuously rather than compliance that gets assembled before an audit.

A system that can see a design input the moment it is written can check it against the frameworks you are held to. A system that can see a test result as it lands can tell you which requirement is now covered and which is still exposed. A system that can see a complaint at the moment of intake can start the workflow instead of waiting for a weekly export.

None of that is possible on data a person has to move. Every manual bridge adds latency, and latency is the difference between a control that monitors and a report that describes the past. Continuous gap analysis across all your standards requires continuous input.

This is also the difference between scaling a company and scaling a quality team. When the connection layer is the platform, adding a system, a product line or a framework does not add a person. Qualio customers report external audits running five times faster and more than a ninety percent reduction in time spent on document administration and location. Those figures are not really about software speed. They are about how much work was never manual to begin with.

See what connects, and what it changes

The integrations datasheet covers the full list of connected platforms, what data flows for each, the operational benefits customers report, and ten reasons to bring your quality layer and your engineering stack into permanent synchronization. For a walkthrough of how individual connections behave in practice, our guide to Qualio integrations goes deeper on each one.

Get the Qualio integrations datasheet

Sources: FDA, Computer Software Assurance for Production and Quality Management System Software, final guidance, February 2026. FDA, Medical Devices; Quality System Regulation Amendments, final rule effective February 2, 2026. Customer-reported figures from the Qualio integrations datasheet.

Flipping the compliance model for life sciences

Robert Fenton — Wed, 19 Aug 2026 12:00:00 GMT

The life sciences industry has undergone a significant transformation over the past decade. R&D cycles have accelerated, and companies are integrating software and AI into nearly every product pipeline. And the barrier to entry is lower than ever, as reflected by the FDA’s approval of over 1,250 AI-enabled devices by the end of 2024.

This rapid pace of change enables more effective treatments for a wider range of conditions and patients. However, requirements for demonstrating safety and efficacy are increasing, while compliance practices have not evolved accordingly. Most life sciences companies manage quality and regulatory obligations much as they did twenty years ago, which risks creating bottlenecks for those developing life-saving products.

Recent data shows FDA warning letters per 100 inspections have increased by 43% since 2019, with medical device warning letters rising 96% in FY2024. Regulatory agencies are accelerating their efforts and, as they adopt AI, their assessment capabilities will continue to expand.

What’s wrong with the status quo?

For decades, compliance approaches have remained largely unchanged. Companies begin by developing SOPs, building internal processes, and documenting activities affecting product quality, safety, and efficacy. However, when regulatory audits approach, teams often scramble for months to compile the necessary documentation for audits, submissions, and certifications.

Product development, quality assurance, and regulatory teams use various tools to manage compliance. Some rely on spreadsheets, shared drives, and paper-based workflows that require ongoing manual coordination. Others use traditional QMS, PLM, or RIM tools, which are inherently reactive and often result in issues being addressed only immediately before or after audits.

Some teams are experimenting with general-purpose AI tools such as ChatGPT and Claude. However, without validation, integration with business context, or adherence to policy rules, these tools require human review of every output due to their non-deterministic nature.

And over time, the linear growth of costs with scale means companies either build bigger teams or constrain their regulatory velocity to their available bandwidth. All this creates delays in developing life-saving treatments and drives up the costs to do so.

All four approaches share a core challenge: significant effort is spent building and managing systems from scratch, without an efficient way to measure progress against regulatory requirements.

Why now?

Today, medical device companies must comply with FDA 21 CFR Part 820, ISO 13485, EU MDR, and MDSAP. Products with software components also face AI- and SaMD-specific requirements, such as ISO 42001 and IEC 62304. Managing compliance across these frameworks and markets slows product development and delays submissions and approvals.

And in Pharma, between 2025 and 2030, the industry will encounter a $300 billion-plus patent cliff, with over 70 blockbuster drugs (nearly 200 in total) losing exclusivity. This exposes about one-sixth of annual revenue to biosimilar and generic competition. The industry is responding with compressed R&D cycles, aggressive acquisitions, and parallel market-entry programs. Companies must now manage a broader regulatory scope under greater time pressure than ever before.

Flipping the model

There is a better approach: start by flipping the sequence entirely.

Instead of building from process to regulation, begin with the regulation itself (FDA, ISO, GxP, etc.) and work backward. AI enables us to take the unstructured regulatory standards into objective, measurable controls. Mapping these controls to business data provides clear insight into compliance status. With agentic capabilities, this visibility is continuous, enabling proactive identification and remediation of gaps before audits.

This model has proven effective in other industries, such as cybersecurity. For example, global banks use compliance automation to continuously monitor and proactively manage IT security controls, reducing audit times and improving threat response. We have applied this approach to compliance intelligence, enabling companies to automate compliance as they grow. This accelerates product development, streamlines compliance, and provides real-time risk visibility for informed decision making.

The process works as follows: (1) Leaders identify the core regulatory frameworks relevant to the organization; (2) Qualio assesses all evidence, including current processes, data, and documentation, against these requirements; and (3) provides a prioritized list of issues with remediation support. Teams then automate controls mapping and reporting, create cross-functional remediation task lists, and establish regular checkpoints to maintain audit readiness.

In practice, customers adopting compliance intelligence achieve audit-readiness for new frameworks in weeks instead of months and spend over 80 percent less time on audit-related tasks. In several cases, AI-driven gap analysis has identified issues missed by both internal teams and external auditors, helping companies avoid costly delays and significantly reduce regulatory risk.

As the pace of change accelerates, we’re excited to be leading the way with automating compliance in life sciences, and can’t wait to deploy these capabilities to more and more of our customers.

Every quality management system on your shortlist will pass your evaluation

Meg Sinclair — Thu, 13 Aug 2026 18:13:00 GMT

You are building a shortlist of quality management software vendors. You have a criteria matrix, probably in a spreadsheet, with vendors across the top and requirements down the side. Document control. CAPA. Training records. Audit trail. Electronic signatures. Validation package. Integrations. Support model. Price.

Here is what happens next. Every vendor you shortlist will meet almost every requirement. The demos will all go well. The matrix will fill up with checkmarks, and the small number of gaps will be in places you do not care much about. You will end up choosing on price, on which sales team was less annoying, or on a gut feel you cannot defend to your CFO.

That is not a failure of research. The matrix is measuring something the market solved years ago.

Feature parity is real, and it is not a compliment to anyone

Quality software has been sold to life sciences for three decades. Document control with version history, routed approvals, a training matrix, a CAPA workflow, an audit trail, a validation package: every serious vendor has all of it. Including us.

There is a rule worth applying to any comparison you run. If every vendor on the page can make the same claim, it is not a differentiator. It is the floor. And a floor is not a reason to choose.

So when a vendor tells you they have the best document control, check the shortlist. If all nine of them say it, none of them said anything. That includes the vendor claiming to be the best QMS software for companies like yours. It is a claim with no mechanism attached, which means it cannot be tested, which means it cannot be trusted.

What the matrix does not ask

Look back at your criteria. Almost every line measures the same underlying thing: how well the system holds the compliance work you are already doing.

Configurability is about shaping where the work goes. Ease of use is about how much friction the work carries. Implementation time is about how fast you can start doing the work in the new place. Support is about who helps when the work gets stuck.

None of those questions asks whether the amount of work goes down.

That is the omission that matters, because it is where the real spread between systems sits. Two platforms can score identically across forty criteria and differ by a week of senior time per audit. The matrix cannot see the difference. Your calendar will.

Three questions that separate the field

Ask these of every vendor on your shortlist. Ask them of us. They are hard to answer with a feature, which is exactly why they work.

1. What does the system do between audits?

Most systems do nothing between audits. They store what you put in them and wait. The work concentrates in the eight weeks before an auditor arrives, which is why audit prep feels the way it does regardless of how good your software is. Ask what the system is doing on a random Tuesday in a quarter with no audit scheduled. If the answer is a version of "it is available," you have your answer.

2. What happens when a new framework enters scope?

You add a market, or a customer contract requires a certification, or a regulation gets amended. Does your team re-prove controls it has already proven, from the beginning, against a new clause list? Or does the system already know which of your existing controls and evidence map to the new requirement, and show you only the actual gaps?

This one question predicts your compliance cost curve for the next three years better than any other on your matrix. Ask for a demonstration on a standard you do not currently hold.

3. What does the system do without being asked?

This is the question that sorts the market into two groups. Some systems act only when a human initiates. A person notices something, opens the system, creates the record, routes it, chases it. The software is a place where work is recorded.

Others do work and bring it to you for approval. Gap analysis runs as your data changes. Evidence gets assembled as it is produced. Remediation arrives drafted, with the reasoning and the citation attached, waiting for a human decision.

Those two things are priced similarly and demo similarly. They are not the same category of product.

Why we publish forty comparisons anyway

We maintain head-to-head pages against most vendors you are likely to evaluate, and we are going to keep doing it. Two reasons.

The first is that you are comparing whether we participate or not. A vendor who refuses to engage with the comparison is not being principled. They are being unhelpful at the exact moment you need help.

The second is that the comparison is where we can be specific about fit, including where we are not it. A few cases where you should choose someone else:

You are replacing a quality system across a large enterprise estate. We land at the site, division, or subsidiary level. Ripping out an established enterprise deployment is not our motion, and a vendor who tells you otherwise is selling you a two-year project.

You are committed to an integrated enterprise ecosystem and want quality inside it. Ecosystem gravity is a legitimate reason to buy, and it usually beats product merit.

Your quality needs sit outside life sciences. We are opinionated about regulated life sciences product development. That focus is the point, and it makes us the wrong answer for a general industrial ISO 9001 program.

You want minimal document control to satisfy one requirement, with no intention of running quality in the system. Something cheaper will do that job.

That list is not modesty. It is the reason to believe the rest of the page. A vendor who fits everyone has told you nothing about whether they fit you.

The claim we actually make

We do not claim to be the best eQMS. We do not think that is the useful question anymore.

Here is the reasoning, and you can reject it, but it is testable.

A quality system of record was built to store compliance artifacts. Documents, signatures, CAPAs, audit trails. It captures inputs, and thirty years of product decisions made it good at that. What it cannot do is tell you whether you are compliant right now, or reduce the work required to become compliant, because it was never designed to know what a good outcome looks like. You can add an assistant to that architecture. You cannot add outcomes to it.

That is why the three questions above are hard for most vendors to answer well. It is not a gap in their roadmaps. It is a consequence of what their systems were built to be.

So the claim is narrower and more falsifiable than a superlative. The eQMS is the floor, not the destination. What matters is whether compliance work is executed continuously, with gap analysis running across every standard in scope, evidence assembled as it is produced, and remediation drafted and routed for human approval with clear boundaries on what may happen without a person. That is compliance as a system of action rather than a record of one. It is the category we are building, and the three questions are how you test whether anyone, including us, is actually doing it.

One last thing, and it is the most common way these evaluations go wrong. The biggest risk in front of you is not picking the wrong vendor from a strong shortlist. It is spending three quarters comparing, running a bake-off, losing the internal thread, and arriving at your next audit with the same spreadsheet you started with. A decision you can defend beats a matrix you cannot finish.

Take the three questions to your shortlist. Start with ours.

Compare Qualio against your shortlist

The compliance tax you are already paying

Sumatha Kondabolu — Thu, 13 Aug 2026 17:31:00 GMT

Every quality and regulatory leader in life sciences knows compliance costs money. Very few can say how much.

That is not carelessness. It is an accounting problem. Compliance spend almost never arrives as an invoice. It arrives as your best QA person disappearing for three weeks before a notified body visit. It arrives as a consultant retainer that renews without much discussion. It arrives as a submission that slips a quarter because the technical file was not ready. Each of those is a real cost. None of them appears on a line item called compliance.

So the number does not exist. And a cost with no number cannot be argued about, defended, or reduced.

Where the money actually sits

Compliance cost hides in six places. You already know all six, because you live in them.

Audit preparation. Every audit and every surveillance visit pulls senior people out of their work to assemble evidence that already exists somewhere. The evidence is not the problem. Finding it and proving it is.

QA and RA capacity. A team hired to make quality decisions spends a large share of its week on document control, chasing training records, and formatting. That is capacity you are paying senior salaries for and using on coordination.

Document management. SOPs, work instructions, forms, and records multiply with every product and every market. Version control, periodic review, and change routing scale with the count, not with the value of the documents.

Quality event resolution. Deviations, nonconformances, and complaints each carry investigation, root cause, and follow-up. The cycle time between event and closure is cost, and it is also risk sitting open on your books.

External consultants. Consultants are excellent at the thing you hired them for. They are also the mechanism by which knowledge leaves the building at the end of the engagement, which is why the next audit needs them again.

Initial certification prep. The first pass at a new standard is the most expensive one. It is also the one most often paid for twice, once by the team and once by the consultant brought in to check the team's work.

None of these six shows up as compliance spend. They show up as headcount, professional services, and a launch date that moved.

Why the number stays hidden

There are four ways companies handle this today, and none of them produces the number.

Spreadsheets and shared drives. The cost is distributed across dozens of calendars, so it never aggregates into anything a CFO reviews. Everyone is busy and nobody can prove why.

A traditional QMS, PLM, or RIM system. These record that the work happened. Effort per audit is unchanged. You get a cleaner filing cabinet and the same three weeks.

General purpose AI. Drafting an SOP in a chatbot is fast. The output is not validated, it varies run to run, and it is not connected to your record, so it cannot stand as evidence. Time saved drafting comes back as time spent checking.

More headcount and more consultants. This one works, which is why it is the default. It also scales in a straight line with every new framework, market, and product. That linearity is the tax.

Each of these is a reasonable response to an unreasonable problem. None of them puts a number on the cost, and none of them makes the cost smaller.

Why we built a calculator

Three reasons.

The first is that ROI validation is a real stage in how this market buys, and it usually lands on the person with the least time. The business case gets assembled at night, in a spreadsheet, by the quality leader who already knows the answer and now has to prove it to finance in finance's language. The calculator does that assembly instead.

The second is that finance is not going to accept a vendor's claim. So the model is deliberately conservative. It calculates only the six categories above, the ones defensible in a room with a CFO in it. It does not count revenue unlocked by faster market entry. It does not count the cost of a finding you avoided. It does not count valuation effects at diligence. Those are real and they are excluded, which makes the output a floor rather than a forecast.

The third is that it runs on your numbers, not ours. Eight inputs: team size, submissions planned, audits per year, document count, quality events, consultant use, products in market, geographies. You already know all eight. Nothing is gated behind a conversation with us.

The output is a diagnostic, not a quote.

What the number leaves out

Here is the part that matters more than the total.

The savings figure tells you what you are currently spending to stand still. It does not tell you what that capacity is worth pointed somewhere else. That is the actual return, and it does not fit in a savings model.

Recovered audit prep time is a submission filed a quarter earlier. Recovered QA capacity is a second and third framework taken on without a second and third hire. Recovered engineering time is product work that was previously documentation work. A quality function that is continuously ready can enter a new geography on the commercial team's timeline instead of setting it.

That is the difference between reducing a cost and removing a constraint.

The constraint is getting tighter, not looser. The QMSR took effect on February 2, 2026, and the FDA moved to an updated inspection compliance program the same day. Scope expanded. Very few quality teams expanded with it. If your compliance model is linear, and the requirements are not, the gap closes on your calendar.

Why the six numbers can only fall if something does the work

A savings figure is not a discount. It is the output of a different operating model, so it is worth being precise about the mechanism.

A system of record was built to store compliance artifacts. Documents, signatures, CAPAs, audit trails. It captures inputs, and it does that well. It can tell you that an audit happened. It cannot prepare for the next one, because it was never designed to know what a good outcome looks like, let alone drive toward one. You can add an assistant to that architecture. You cannot add outcomes to it. That is why the effort line stays flat no matter how good your filing gets.

The six numbers only move when the work itself is being executed continuously. Gap analysis running across every standard in scope as your data changes, rather than a project starting eight weeks before an audit. Evidence assembled as it is produced, rather than retrieved under time pressure. Remediation drafted and routed for human approval, with clear boundaries on what an agent may do on its own.

That is compliance as a system of action rather than a system of record. It is the category we are building, agentic compliance, and it is the only reason a savings figure like this is available at all.

Compliance stops being the brake on product development at that point. It becomes the reason safe products reach patients sooner.

Find your number first.

Calculate your compliance savings

The Sidekick Becomes a Coworker: What a Quality Leader Learned About Trusting AI With Compliance

Meg Sinclair — Mon, 27 Jul 2026 16:11:00 GMT

A year ago, most quality leaders would have called AI in compliance mostly hype. Christian, a quality and compliance leader who has spent his career in radiopharmaceutical manufacturing, said as much on a recent Accelerate conversation with Qualio. Then he watched the same teams move from asking AI to write an SOP, to feeding it context about their company and their process, to something else entirely: treating it like a coworker.

That progression is worth sitting with, because it maps almost exactly onto the gap between where most quality management systems are today and where they need to go.

The backlog is not a discipline problem

Christian has seen the same failure pattern across small and mid-sized life sciences companies for years. Regulations tighten. Processes get more detailed to close every gap. And the people running production, QC, and quality assurance, often just a handful of people total, are left executing an SOP that has grown more thorough and more burdensome every year it gets revised.

"The challenge that I see is actually that we do not have any support in the process," Christian said. "We still have to manually go through the process, and this is sometimes, and I see this very often, is really the bottleneck." Thirty or forty open deviations. Tens if not hundreds of change requests. A backlog that never fully clears because the team never gets a day without new inputs arriving faster than they can close the old ones.

This is the scaling pain every quality leader recognizes: headcount and complexity grow together, and the team runs out of hours before it runs out of backlog. Adding another auditor-facing checklist does not fix that. Removing the manual bottleneck does.

From sidekick to coworker

The distinction Christian draws is the useful one. A sidekick answers questions when asked. A coworker looks at the work as it happens, flags what needs attention, and can be handed a defined piece of the process to run, with a human checking the result.

"AI becomes a coworker of mine because this is the opportunity when I can give AI certain tasks like I would do to a coworker that will help me to reduce my workload on a daily basis," he said. Not writing the SOP. Reading the CAPAs, the deviations, the change requests as they are generated, and catching the pattern a person under deadline pressure will miss.

His favorite example is root cause. Ask most teams why a deviation happened and the first answer is often "human error," because it is the easiest one to reach for under time pressure. Christian described asking a coworker, human or AI, a few more questions before accepting that answer: has this come up before, did the last corrective action actually hold, is there a system cause underneath the individual one. That is not a faster way to fill out a form. It is a better root cause, arrived at because someone, or something, had the bandwidth to ask the next question.

This is the same principle behind bounded autonomy: an agent that can run a gap analysis, triage a CAPA, or draft a corrective action, with the human still the one who approves it before it becomes the record of truth. The team gets the second set of eyes it never had the bandwidth for. The audit trail still shows a person made the call.

Reactive by design, until now

Christian made a point about the entire category that is easy to miss because it sounds obvious once said out loud: quality management systems, as built, are backward looking. Something happens, you document it, you analyze it, and you use that analysis to do better next time. That is not a flaw in any one company's process. It is how the systems were designed to work, decades before there was a way to look at the data while it was still being generated.

"For the first time now that we have more power to what we can do," Christian said, "our view angle shifts from looking backward, what is happening right now." He pointed to something as simple as the rate of entry corrections on handwritten forms, a number that quietly tells you when a team is under strain, well before that strain shows up as a deviation. Catch the drift in that number three weeks before the finding, and the conversation with the team is "what happened, how can we help," not a corrective action after the fact.

That shift, from a record of what already happened to a signal on what is happening now, is the entire argument for a compliance system built to act continuously rather than one built to store artifacts after the fact. A system of record can tell you what went wrong. It was never built to tell you it is about to.

No need to reinvent the rulebook

One thing Christian pushed back on, gently but firmly: the instinct to write an entirely new regulatory framework for AI because it feels unfamiliar. His suggestion is more useful and considerably less work. Treat AI the way the industry already treats an analytical method or a new coworker. Qualify it. Give it an onboarding, a training plan, a way to check it understands what it is doing in its own words. Validate it against defined statistical expectations, the same way a lab validates an assay, and revalidate it on a schedule.

"No need to reinvent the wheel just because it is a new concept," he said. "Just apply the same concepts over it for the right level of control." That is the case for validated, regulatory grade AI: not AI that is impressive in a demo, but AI whose outputs hold up to the same qualification rigor the rest of the quality system already runs on.

What the team gets back

The payoff Christian described is not efficiency for its own sake. It is time. Time to stop surviving the backlog and start asking what the team should do next. "This needs this state of mind where you are relaxed, where you know, I am in control," he said. "Let's have a breakout session, a little brainstorming, grab a coffee because we have the time today."

He was careful to draw a line here that matters: AI does not replace the human in that picture, it makes room for the part of the job only a human can do. Judgment, creativity, the next idea nobody has had yet. The coworker handles the deviation review. The person gets the five minutes back to think.

That is the case for agentic compliance in one interview: not a better filing cabinet, but a system that works the backlog down in real time so the people running quality can do the part of the job that was never supposed to be reactive in the first place.

Want to see where your own team sits on that spectrum, from reactive backlog to continuous, proactive compliance? Get your quality score →

Prefer to hear it straight from Meg and Christian? Watch the full Accelerate session on demand →

The EU Expands Its "Well-Established Technologies" List Again

Meg Sinclair — Sat, 25 Jul 2026 00:26:00 GMT

The European Commission is continuing to widen the list of medical device technologies eligible for reduced clinical and conformity assessment requirements under the MDR, and manufacturers with devices in dental, orthopedic, cardiovascular, or surgical categories should check whether they now qualify.

What changed

On March 20, 2026, the Commission adopted two delegated regulations amending the MDR's treatment of "well-established technologies" (WET), devices with common, simple, stable designs and long-established safety and performance profiles:

C(2026) 1798 expands the list of implantable and Class III devices exempt from the obligation to perform a clinical investigation under Article 61(6)(b).

C(2026) 1809 expands the list of Class IIb implantable devices exempt from per-device technical documentation assessment under Article 52(4), allowing notified bodies to sample rather than review every technical file.

Together, the two regulations pushed the WET list from roughly a dozen device types to approximately 67, adding categories such as sutures, staples, dental fillings, braces and crowns, screws, wedges, catheters, feeding tubes, bone wax, bone fillers, bone substitutes, dental implants, spinal fixation devices, and cannulas. A further delegated regulation extending the Class IIb list, Delegated Regulation (EU) 2026/1359, published June 29, 2026, entering into force 20 days later, continues that expansion.

What it does not change

Exemption from a clinical investigation is not exemption from clinical evidence. Manufacturers of listed devices still must plan, conduct, and document a full clinical evaluation under Article 61, relying on existing clinical data rather than generating new investigational data. Implant card obligations under Article 18 are also unaffected. A newly listed implantable WET device still requires one.

Why this is worth tracking closely, not just once

Notice how this expansion arrived: not as a single MDR revision, but as a sequence of delegated acts landing across March and June 2026, with Article 52(5) giving the Commission standing authority to expand the list further at any time. A manufacturer who checked the WET list once, in early 2026, and built a clinical strategy around it, is already working from a list roughly five times shorter than the current one. That gap only grows as the Commission continues to use its delegated authority.

Checking a device's WET eligibility once is a compliance snapshot. Checking it continuously, as the Commission keeps adding categories, is what actually lets a manufacturer capture the reduced clinical burden before a competitor does.

Confirm whether any of your Class IIb, Class III, or implantable devices now fall under the expanded lists, and revisit your clinical evaluation plan accordingly rather than assuming your last classification review still holds.

For the regulatory source material, see the European Commission's own notice on the delegated acts, RAPS' coverage of the expanded WET list, and GMED's summary of the June 2026 extension.

For related grounding on MDR conformity routes, see Qualio's what you should know about the CE mark. If your team is tracking MDR updates like this one manually, see how continuous gap analysis surfaces regulatory changes like the WET list as they land.

MHRA's 2026 Devices Reform: What Changes and When

Sumatha Kondabolu — Wed, 22 Jul 2026 18:13:00 GMT

Great Britain's medical device framework has been running on the Medical Devices Regulations 2002 for over two decades, propped up by CE marking extensions and transitional patches while everyone waited for the real replacement. That wait moved a significant step closer to over on May 8, 2026, when the MHRA published the draft Medical Devices (Amendment) Regulations 2026, the standalone GB regulatory framework meant to finally replace the 2002 regime.

This is not a minor update. It is the main reform of the GB device framework, and it closely realigns GB requirements with the EU MDR and IVDR, adapted for the UK market, alongside the broader IMDRF framework.

The timeline, as it actually stands

The draft regulations were notified to the World Trade Organisation for international comment, with WTO members given until July 7, 2026 to respond. In parallel, the MHRA ran its own stakeholder impact survey, open until June 19, 2026, gathering evidence on the practical cost and implementation impact of the proposals to feed into the formal impact assessment.

From here, adoption is anticipated in December 2026, with the regulations expected to enter into force around June 2027, subject to UK Parliamentary review and approval. Manufacturers get transitional runway once that happens: three years for general medical devices, five years for in vitro diagnostics (IVDs). A separate international reliance pathway, allowing faster access for devices already approved in other major jurisdictions, is expected to follow roughly 18 months after the regulations are made, putting it in the 2028 window.

What the reform actually touches

The draft regulations introduce a broad package of pre-market requirements across general medical devices, active implantable devices, and IVDs placed on the GB market. Notable elements include updated UK Essential Requirements aligned with the EU's General Safety and Performance Requirements, mandatory UDI and implant card provisions, tighter technical documentation and post-market surveillance retention rules, a Predetermined Change Control Plan pathway for software (including cybersecurity considerations), and expanded use of electronic instructions for use.

One gap is worth flagging directly for software and AI/ML teams: provisions specific to software medical devices have not been updated in this draft, reportedly pending the findings of the National AI Commission expected in summer 2026. If your product is a SaMD or AI-enabled device, the core pre-market package here applies to you, but the AI-specific detail you are likely most interested in is still coming, not finalized in this release.

Why generic UK content will not cut it here

Existing MHRA or UKCA guidance that predates May 2026 was written for a framework that this reform is actively replacing. A manufacturer relying on general UKCA marking content from a year ago is working from a picture of GB regulation that this draft already supersedes in substance, even before it is formally adopted.

This is also a genuinely multi-track compliance problem, not a single deadline to diarize. GB is moving on its own timeline while the EU MDR and IVDR continue evolving in parallel, and the two are only "closely aligned," not identical. A team tracking GB requirements in one document and EU requirements in another, manually, is one missed cross-reference away from a technical file gap it will not find until a notified body or the MHRA finds it first. That is precisely the kind of drift that continuous, cross-framework gap analysis is built to catch as each side moves.

What to check now

If you place devices on the GB market, review your technical documentation against the draft's updated Essential Requirements now, rather than waiting for December 2026 adoption to start.

Confirm whether your device qualifies for the eventual international reliance pathway, since that could materially shorten your GB market access timeline once it takes effect.

If you have a software or AI/ML device, do not assume silence on software provisions means no obligations are coming. Watch for the National AI Commission's findings this summer, since that will likely shape the update this draft is missing.

For foundational context on the current UK regime, see Qualio's what you should know about UKCA marking and the ultimate guide to placing a medical device on the UK market. For the regulatory detail behind this reform, see Latham & Watkins' analysis of the draft amendment and the British Healthcare Trades Association's summary of the timeline.

If you are tracking GB and EU requirements in separate systems, see how continuous gap analysis keeps multi-framework technical files aligned as each regulator moves independently.

FDA's Risk-Based Inspection Shift: What It Actually Rewards

Meg Sinclair — Mon, 20 Jul 2026 13:31:00 GMT

For years, the safest way to prepare for an FDA pre-approval inspection was to assume it was coming and over-prepare accordingly. That assumption is getting more expensive to make. FDA has revised Compliance Program 7346.832, "Preapproval Inspections," reinforcing a risk-based approach to deciding whether a PAI happens at all, and the revised program takes effect August 10, 2026, replacing the version that had been in place since October 2022.

The device side of the business has already lived through a version of this shift. Since the Quality Management System Regulation (QMSR) became effective February 2, 2026, FDA replaced the old Quality System Inspection Technique (QSIT) with a new risk-based inspection approach under Compliance Program 7382.850, applied across preapproval, for-cause, and routine post-market device inspections. Under that model, Class I device manufacturers generally do not face routine inspection unless a for-cause trigger or health-hazard signal exists. The drug-side PAI revision extends the same underlying logic: inspection resources go where the risk assessment says they are needed, not everywhere by default.

What actually changed

The revised compliance program formalizes a holistic, risk-based determination process. When a marketing application comes in, an Integrated Quality Assessment (IQA) team assembles to evaluate the facilities named in it, weighing factors like inspection history, the specific risks tied to the product and its manufacturing process, and prior compliance signals, before deciding whether an onsite inspection is warranted at all.

Where FDA decides an onsite inspection is not necessary, the guide clarifies the alternative tools available:

Requesting existing inspection reports and other information from trusted foreign regulatory partners through Mutual Recognition Agreements and similar confidentiality agreements.

Conducting remote regulatory assessments, including direct record requests from the facility and remote interactive evaluations in place of a site visit.

The revised program also adds a flow diagram that lays out, step by step, how the risk-based determination gets made. That is a meaningful change in itself: it turns what used to feel like an opaque internal judgment call into a documented decision path manufacturers can actually prepare against.

Why this rewards continuous readiness over one-time prep

A risk-based model does not reward the facility that assembles a war room three weeks before a scheduled inspection. It rewards the facility whose inspection history, compliance signals, and documentation are already clean on the day FDA runs its risk assessment, because that assessment can happen with little warning and without an announced visit.

That is a hard model to serve with a manual, consultant-driven prep cycle. A spreadsheet-based readiness effort or a pre-inspection audit sprint can get a facility ready for a known date. It cannot keep that facility continuously ready for a risk score FDA calculates on its own schedule, using inspection history the facility does not fully control. Scaling that kind of standing readiness with headcount and outside consultants gets expensive fast, and it does not compound. Scaling it with a system that keeps documentation, CAPA history, and compliance signals continuously mapped and audit-ready does.

What to check now

Review your CAPA and complaint-handling history for the kind of gaps FDA's fiscal year inspection data continues to flag most often, since those remain the fastest way to trigger a for-cause look regardless of the risk model in place.

If you manufacture in multiple jurisdictions, confirm whether a Mutual Recognition Agreement between FDA and your local regulator could reduce your onsite inspection exposure, and make sure your documentation is ready to support a remote assessment if one is requested instead.

Treat "risk-based" as a standing requirement, not a pre-inspection sprint. The IQA team's assessment can happen before you know it is happening.

For background on how 21 CFR 820 violations turn into inspection findings and warning letters, see Qualio's 21 CFR Part 820: the complete overview and how to respond to FDA warning letters. For the QMSR-specific inspection shift, see what is the FDA QMSR. For the source material on this revision, see RAPS' coverage of the revised PAI compliance guide and FDA's Compliance Program 7346.832 itself.

If your inspection readiness still depends on a pre-audit scramble, see how continuous, audit-ready documentation removes that dependency.

ISO 14971 in the Age of AI: What ISO/TS 24971-2:2026 Adds

Sumatha Kondabolu — Thu, 16 Jul 2026 18:52:00 GMT

ISO 14971 was written for devices whose behavior does not change after they ship. A machine learning model breaks that assumption by design. It can retrain on new data, shift its parameters, and behave differently a year after launch than it did on the day of clearance, and none of that is covered by a risk file built around a fixed design.

ISO/TS 24971-2:2026, "Medical devices, guidance on the application of ISO 14971, Part 2: Machine learning in artificial intelligence," is the standard that closes that gap. It does not replace ISO 14971:2019 or alter its requirements. It sits alongside it, and alongside the existing ISO/TR 24971 guidance, as a companion document that tells manufacturers how to apply the same risk management process to machine learning-enabled medical devices (MLMD).

What the new specification actually covers

ISO/TS 24971-2:2026 focuses on the risks that are specific to machine learning rather than to software in general. That includes:

Data management and feature extraction, since a model is only as reliable as the training and test data behind it, and that data can be actual patient data or synthetic data built to simulate it.

Unwanted bias, with a dedicated annex explaining how bias enters a model and how to identify it before it reaches a patient population.

Information security, recognizing that a model's training pipeline is itself an attack surface.

Training, evaluation, and retraining, including the reality that an ML model can learn continuously from patient data and modify its own parameters over time, a behavior the standard refers to as "continuous learning" (sometimes called "adaptive" elsewhere).

One boundary is worth flagging clearly: ISO/TS 24971-2:2026 explicitly does not cover devices built on large language models or generative AI. If your product includes an LLM-based function, this standard is not your risk management answer for that function, and treating it as one would be a gap in itself.

Why a companion standard, not a QMS update, is the real fix

A risk file that was signed off once, at launch, cannot tell you that a retrained model has drifted from the bias profile it was cleared against. That is not a limitation of the paperwork. It is a limitation of treating risk management as a point-in-time event instead of a continuously monitored one, which is exactly the failure mode ISO/TS 24971-2:2026 is designed to prevent.

This is where the difference between a static QMS and a system built for continuous execution actually shows up. A document repository can hold your ISO 14971 risk file. It cannot tell you, on its own, that your MLMD retraining cadence has outpaced your last risk assessment, or that a new companion standard has just changed what "complete" looks like for that assessment. Continuous gap analysis across all your standards is what closes that loop, mapping your existing ISO 14971 risk management file against ISO/TS 24971-2:2026 as it lands, rather than waiting for the next scheduled review to notice the standard changed under you.

What to check now

Confirm whether your device qualifies as an MLMD under the new specification, and rule out LLM or generative AI components explicitly, since those sit outside its scope.

Review your existing ISO 14971 risk file for continuous learning behavior. If your model retrains post-market, your risk file needs a mechanism for catching that, not just a note that it happens.

Cross-check your bias evaluation approach against the annex guidance rather than treating "we tested for bias once" as sufficient.

Qualio's existing comprehensive guide to ISO 14971 is a solid foundation for teams building this out, and the ISO 14971 risk matrix guide is useful for teams standing up their first structured risk process. For the standard itself, see the ISO catalog listing for ISO/TS 24971-2, and for a practitioner-level walkthrough of what changed, this June 2026 standards roundup covers the specification alongside other recent medical device standard updates.

If your AI/ML risk documentation has not been checked against a live standard in the last quarter, that is worth fixing before your next audit does it for you. See how continuous gap analysis works across ISO standards.

What the FDA's AI Device Software Guidance Signals for Your Traceability

Sumatha Kondabolu — Mon, 13 Jul 2026 22:30:00 GMT

Every AI/ML SaMD team already knows the shape of the problem. The model that shipped in the 510(k) is not the model running in the field six months later. Training data gets refreshed. Thresholds get retuned. Performance drifts across patient subgroups in ways nobody notices until an audit or an adverse event forces the question: can you prove what changed, when, and why.

The FDA's draft guidance, "Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations," is the agency's clearest attempt yet to make that proof a submission requirement rather than a nice-to-have. FDA issued the draft on January 7, 2025 under Docket FDA-2024-D-4488, and the public comment period closed April 7, 2025. The guidance has not yet been finalized, but its expectations already describe the direction FDA review teams are working toward, and they are worth building against now rather than waiting for a final version to force the issue.

What the draft actually asks for

The guidance applies to AI-enabled device software functions, devices that implement one or more AI models as defined under the FD&C Act, and it frames its recommendations around the Total Product Lifecycle (TPLC): design, development, marketing submission, and post-market performance, treated as one continuous obligation rather than four separate milestones.

Three requirements stand out for quality and regulatory teams:

Dataset provenance and data management. Submissions should document where training and validation data came from, the quality assurance process applied to it, and how the data supports generalizability across the intended-use population. Development data and validation data need to be documented as distinct, disjoint sets, not variations on the same pool.

Transparency and bias mitigation across the TPLC. FDA wants evidence of algorithmic equity, not a one-time statement of it: performance broken out across demographic subgroups where relevant, and a clear account of how bias was identified and controlled for.

Real-world performance monitoring. Manufacturers should describe the data collection and analysis methods used to detect performance changes after the device is in use, alongside a functioning software lifecycle process for catching and addressing those changes.

None of this is entirely new. It builds on FDA's finalized Predetermined Change Control Plan guidance from December 2024 and the June 2023 guidance on premarket submission content for device software functions. What the AI-specific draft adds is a single, TPLC-wide expectation that dataset lineage and model change history are documented with the same rigor as a design history file.

Why this is a traceability problem, not a paperwork problem

A design history file built for a static device does not know how to track a model that gets retrained quarterly against a rotating dataset. A spreadsheet can log a training run once. It cannot flag when a new dataset version drifts from the demographic profile in your last submission, or surface that a validation set has started overlapping with production data. That is not a documentation gap. It is a monitoring gap, and it grows every time the model changes.

This is where continuous gap analysis across all your standards earns its place over a filing system: a QMS that only stores documents cannot tell you when your AI-specific risk file has fallen out of step with a draft guidance that has not even finalized yet. A system built to continuously map evidence against evolving frameworks can.

What to do while the guidance is still in draft

Do not wait for a final rule to start building the audit trail this guidance describes. Three things worth doing now:

Confirm your design history file separates development and validation datasets explicitly, with documented provenance for each.

Build a standing post-market monitoring plan for model performance, not just device performance, and make sure it produces evidence, not just a policy statement.

Map your current AI/ML documentation against the draft's TPLC structure so the gaps are visible before a reviewer finds them.

For a primer on how SaMD obligations interact with the rest of your quality system, Qualio's complete guide to software as a medical device is a useful starting point. For the FDA's own framing of its AI/ML strategy, see the FDA's AI in Software as a Medical Device resource page and the original Federal Register notice for the draft guidance.

See how Compliance Intelligence keeps AI-specific risk documentation mapped against emerging frameworks as they move, not just the ones already finalized.

From Algorithm to Aisle: What Naritas CEO Nora Keldy Teaches Us About Building AI-Native Life Sciences Companies

Meg Sinclair — Wed, 10 Jun 2026 19:35:00 GMT

In 2014, Nora Keldy sat down with a matrix. She was a mathematician and computer scientist who had spent years in drug discovery, and she had just moved into nutrition. What she found there looked less like an industry and more like a graveyard of century-old ingredients, reformulated and repackaged, but never fundamentally rethought. Consumers were changing. The ingredients were not.

So Nora built Naritas — a Dublin-based biotech that uses AI to discover peptide-based ingredients from natural sources and move them through clinical validation, regulatory approval, manufacturing scale-up, and into products sold on six continents. Today the company counts U2's Bono and The Edge among its investors, and its ingredients are inside food, beverage, and supplement products across every major global market.

The latest episode of Qualio's From Lab to Launch podcast covers Nora's journey in full. Three themes from that conversation apply directly to how life sciences companies think about AI, quality, and the infrastructure required to scale.

1. AI only works if you feed it — and feeding it is the hard part

Naritas built what Nora calls the Magnifier Discovery Platform: an AI system that evaluates peptide candidates not just for efficacy, but for oral bioavailability, heat stability, allergenicity, formulation stability, and cost of production. The platform does not advance a molecule into biological testing until it clears all those dimensions simultaneously.

This is a fundamentally different architecture from the traditional ingredient discovery model, where molecules were tested one-by-one in labs, mostly at random, at enormous cost and over decades.

But the architectural advantage only holds as long as the data keeps flowing. Nora made that point directly: during COVID, when everything was being cut, she faced pressure from shareholders to stop investing in the AI platform itself and redirect all resources to commercializing existing ingredients. She refused.

"AI, you constantly need to feed it for it to become better and better. And the feeding in our space is expensive. It's not like it's feeding off literature. You have to actually create the data yourself — biological data."

She cut headcount, closed projects, and deferred spend elsewhere. But she protected the AI investment. Looking back, she calls it one of the clearest decisions she made.

The lesson for life sciences leaders: an AI system that stops receiving validated, structured data degrades. The competitive advantage is not in deploying AI once. It is in building the operational infrastructure that keeps high-quality data flowing into it continuously.

2. Quality is not a gate at the end of innovation — it is a constraint baked into the discovery model

Naritas works with some of the largest consumer goods and ingredient companies in the world: BASF, Nestlé, Mars, Givaudan. Those companies do not enter co-development agreements unless a supplier's quality and safety standards are demonstrably at their level.

Nora was unambiguous about this in the conversation:

"You can find a molecule that does something incredible from a health perspective. But if that molecule is not producible, if it's not stable in formulation, if the quality isn't there — that would kill the project, no matter how great your molecule is."

This is a framing that many early-stage life sciences companies get wrong. Quality is treated as something to build once the science is validated. At Naritas, it is part of the validation. The AI platform screens for manufacturability and regulatory friendliness before a single wet lab experiment is run. The team that handles supply, manufacturing, and quality control was built in parallel with the science team, not after it.

The implication is direct: companies that delay building quality infrastructure until they have something to protect almost always discover the cost of that delay at the worst possible moment — during a clinical hold, a partnership diligence process, or an audit. The companies that build continuous compliance infrastructure early treat quality as a growth lever, not an overhead.

That is exactly the argument behind why compliance architecture determines clinical outcomes — and why teams that build it late find themselves doing heroics before IND rather than running confidently toward it.

3. Scaling is not a headcount problem — it is an architecture problem

When Naritas entered its commercial phase, the question was not how many people to hire. It was how to scale ingredients across markets, distribution channels, and product categories without the organization breaking down under the complexity.

Nora's answer was architecture: the right investor partners in the proof-of-concept phase, the right enterprise co-development partners in the validation phase, and the right distribution and brand partners in the commercial phase. Different stages required different partnerships. But across all of them, the underlying quality and regulatory infrastructure had to hold.

This maps directly onto what Qualio's team has been documenting across hundreds of growth-stage life sciences companies. The distinction between episodic readiness and continuous readiness is not a compliance philosophy question — it is a scaling question. Companies that rebuild their quality system from scratch before each audit do not scale. Companies that run compliance continuously do not have that problem.

Nora's experience reinforces a point that is easy to miss when you are raising your Series A and trying to survive COVID: the ceiling on your commercial velocity is often not your science, your funding, or your sales motion. It is whether your quality system was built for clinical demands or for the earlier phase you needed to survive.

The category Naritas created — and what it demands of operations

When Nora started Naritas in 2014, she noted that most people heard "AI" and thought it stood for artificial insemination. Peptides were largely unknown outside pharma. She was not entering a category. She was creating one.

April Dunford's positioning framework makes a useful distinction here: the category you choose to operate in sets the buyer's evaluation criteria, the competitive set, and the questions your evidence has to answer. Naritas chose a category that did not exist and built proof points — three double-blind, placebo-controlled clinical trials for PeptiStrong alone — before the market understood what it was buying.

That is a high-risk, high-return bet. And it requires that every other part of the operation be extremely reliable. When the science is novel and the category is undefined, investors, partners, and regulators scrutinize everything else harder. Regulatory affairs, quality documentation, clinical data integrity — these are not support functions in a company making a category-creation bet. They are the credibility infrastructure that makes the bet legible to the outside world.

What Nora would tell early-stage founders

When Meg asked for parting advice, Nora's answer was immediate: adaptability.

"Adaptation is the largest and biggest skill set anyone can have for success, especially as an entrepreneur."

She had pivoted focus during COVID, built a direct-to-consumer brand purely to generate investor proof points when the clinical CRO shut down, cut projects that were not going to generate return, and held the line on the one investment — the AI platform — that most others would have cut first.

That kind of adaptability is not possible without operational clarity. You cannot adapt fast if you do not know where you stand. You cannot redirect resources if you cannot see which compliance gaps will surface in the next 90 days. The companies that adapted well through COVID — and through every disruption before and after — were the ones that had built quality systems that gave them genuine visibility, not just the appearance of compliance.

Listen to the full episode

Nora covers the Naritas origin story, the decision to bet on peptides before the market understood them, what it was like to meet Bono and The Edge, the co-development partnerships with BASF and Givaudan, and what she sees coming in the peptide and AI-driven ingredient space over the next three years.

Listen to the From Lab to Launch episode with Nora Keldy here.

Qualio helps life sciences companies build compliance infrastructure that scales with their ambition. If you are a growth-stage biotech building your quality system, see how Qualio works.

Why the FSP Model Is Having Its Moment (and What It Means for Clinical Trial Operations)

Meg Sinclair — Mon, 08 Jun 2026 13:20:00 GMT

When I sat down to record the latest episode of From Lab to Launch, I expected a solid conversation about outsourcing. What I got instead was a masterclass in how the entire philosophy of clinical trial resourcing is being rewritten in real time.

My guest, Dr. Les Enterline, Senior Vice President and Global Head of Functional Service Partnerships at PPD, part of Thermo Fisher Scientific, has spent decades sitting on both sides of the sponsor-CRO relationship. That dual perspective shapes everything about how he talks about functional service provider (FSP) models, and it's what makes this conversation so worth unpacking.

First: What Actually Is an FSP Model?

Before we can talk about why FSPs are gaining traction, it helps to be clear on what they are and what they're not.

In a traditional full service outsourcing (FSO) model, a sponsor essentially hands a study to a CRO and says: run this. The CRO uses its own systems, its own processes, its own staff. The sponsor gets check-ins and oversight, but the operational control sits with the CRO.

In a functional service provider (FSP) model, the dynamic flips. The CRO's staff embeds within the sponsor's environment, follows the sponsor's SOPs, works inside the sponsor's systems, and takes direction from the sponsor. Rather than running the study independently, the CRO is providing people with deep subject matter expertise in a specific function.

As Les put it: "We're providing a service: people with subject matter expertise and knowledge in that specific function that the client is looking to reach for."

The pricing structures differ too: FSP can be unitized, partial FTE, or full FTE depending on the engagement model.

Why FSPs Are Winning Right Now

This is where it gets interesting, and where the April Dunford lens becomes useful.

If you've read Obviously Awesome (required reading, in my opinion, for anyone trying to communicate value in a crowded market), you'll recognize what's happening with FSPs. For years, sponsors facing resource gaps defaulted to one of two "competitive alternatives": hire internally, or hand the whole study to a CRO. Both come with real costs. Internal hiring is slow and creates fixed overhead during pipeline troughs. Full CRO handoffs mean sacrificing oversight and control.

The FSP model wins because it solves a problem neither alternative handles well: how do you flex specialized capacity without losing visibility?

Les identified several forces making that question more urgent than ever:

Pipeline volatility. Sponsor pipelines ebb and flow. Maintaining a full internal team for a peak that will inevitably ease off is expensive. FSP lets sponsors scale up and ramp down without the overhead whiplash.

Regulatory pressure. ICH E6(R3), the updated GCP guidelines, places greater emphasis on sponsor oversight. FSP models are architecturally well-suited to this because the sponsor retains direction-setting while the FSP provides execution.

New indication gaps. When a sponsor moves into a therapeutic area where they don't yet have internal expertise, they need more than bodies: they need subject matter knowledge. Some are using FSP to bring that expertise in-house temporarily, training up their own teams in the process.

Cost redirection, not just cost savings. This nuance from Les stuck with me: it's not always about spending less, it's about spending smarter. Technology is letting individuals stretch across more projects, which means freed-up dollars can go toward new programs or earlier go/no-go decisions.

The Hybrid Problem (and Why Les Doesn't Use That Word Anymore)

When I asked Les about the rise of "hybrid" FSP/FSO models, he pushed back on the framing immediately. "I've moved away from calling it hybrid because hybrid's kind of a generic term."

What he prefers: mixed model. And the distinction matters.

Hybrid implies a set combination: some of this, some of that. A mixed model implies intentionality and customization. Each sponsor pulls different levers depending on where their internal strengths are, where there are gaps, and what each program demands. As Les said: "There isn't like one book you're pulling off a shelf giving you a recipe that's going to fit every single sponsor's needs."

This is actually a core insight from the Dunford positioning framework applied to services: the value isn't in the category label. It's in understanding which specific problems your target customer is trying to solve, and being honest that those problems differ by organization, by program, and by moment in time.

The Silo Concern (and How to Actually Address It)

One of the most common objections I hear about FSP models is the cohesion question: won't embedded external staff create silos? Won't it be confusing for everyone to know who reports to whom?

Les's answer was direct. The goal is for stakeholders, internal or external, not to notice any difference at all. Everyone aligns around the sponsor's priorities and represents the sponsor with the same accountability as a direct employee. "It doesn't matter where someone's actually getting a paycheck from."

What makes that work in practice: strong communication, transparency, and what Les called "honesty and candor across the spectrum." If something goes wrong, you surface it immediately rather than containing it. The model doesn't protect you from challenges because clinical research guarantees you'll face them. What it can do is ensure you face them together.

This is also where quality management infrastructure matters. At Qualio, we think a lot about how quality systems support exactly this kind of distributed, collaborative execution: ensuring that wherever your team members sit, they're working from the same SOPs, capturing deviations consistently, and maintaining the audit trail that regulators will eventually want to see.

Busting the Talent Misconception

The perception that FSP roles attract less experienced talent is, according to Les, simply wrong and worth addressing head-on.

FSP roles are actually harder in important ways. You're dropped into a client environment, often with minimal hand-holding, and expected to deliver immediately. That demands self-direction, strong interpersonal skills, and the kind of adaptability that can't be manufactured. The 95% retention rates Les cited within PPD's FSP partnerships tell a revealing story: people who do this work often find it more engaging, not less, because of how close they are to the product.

There's a career development angle too. Spending time in FSP gives CRO professionals a window into how sponsors think, what drives their decisions, and what they really prioritize. That's experience that's genuinely hard to get otherwise without changing employers entirely.

Where This Goes Next

When I asked Les to look five to ten years out, he gave the most honest answer a forecaster can give: "The only constant is change."

He doesn't expect sponsors to go all-FSP across the board. He does expect continued evolution of the mixed model, with more nuance emerging around what to keep internal, what to hand off fully, and where FSP fills the gap. Technology will reshape how much any individual can do across multiple projects simultaneously, and that will shift the calculus again.

What feels durable: the principle that sponsor control and CRO expertise are not actually in tension. The best models find ways to deliver both.

Listen to the Full Episode

If you work in clinical operations, biopharma development, or anywhere along the CRO-sponsor relationship, this conversation is worth your full attention.

Listen to the episode here

You can also connect with Les directly on LinkedIn.

From Lab to Launch is Qualio's podcast for the life sciences community: stories from founders, quality leaders, investors, and scientists on the front lines of bringing products to market. Explore all episodes or apply to be a guest.

Why healthcare is the last industry to go digital -- and what's finally changing

Meg Sinclair — Wed, 03 Jun 2026 18:29:00 GMT

Marc Andreessen famously declared that "software is eating the world." Finance transformed. Retail transformed. Logistics transformed. Healthcare, somehow, kept saying no -- until now. In a recent episode of From Lab to Life, four-time entrepreneur Mariano Valenio, CEO of digital health company Xenia, laid out exactly why this industry has resisted -- and what's finally breaking the logjam.

The insights are deeply relevant to anyone building or selling software into life sciences. And they point to a fundamental shift that Qualio has built its entire platform around: the move from reactive compliance to continuous, proactive execution.

Healthcare was designed for a different disease

Valenio's diagnosis is precise. The modern healthcare system was designed in the 1940s and '50s -- NHS, the first US health plans, the whole architecture -- to fight acute diseases. Infections. Clear symptoms. Obvious paths to the doctor. And for decades, it worked remarkably well.

"We managed to gain like 30 years of life through that system. But the bad thing is that now we have time to develop other diseases -- and those are mostly chronic diseases." -- Mariano Valenio, CEO of Xenia

Chronic disease is an information problem, not just a medical one. It develops silently. It doesn't announce itself. Patients don't know they're drifting off course until they're deep enough in trouble to need expensive, acute intervention. The system built to catch the symptom can't catch the signal.

85% of healthcare spend comes from chronic disease

Healthcare costs are rising at 2.5x the rate of general inflation

An estimated 50% of total global healthcare spend is pure inefficiency

Healthcare is a $10 trillion industry -- the same size as all of tech or all of energy

The real problem: misaligned incentives everywhere

If the disease problem is bad, the incentive structure problem is worse. Valenio doesn't shy away from naming it directly -- not as a moral indictment, but as a systems observation that Michael Porter identified twenty years ago.

Hospitals make money when patients stay. Their processes naturally optimize for keeping patients in beds, not for preventing admission in the first place.

Doctors earn when patients are sick. A disease-free patient is revenue-free under most reimbursement models.

Health plans understand that obesity prevention saves money -- but over five to ten years. Their members will likely have switched plans by then. So why invest?

Brokers earn a percentage of the plan cost. Cheaper, healthier plans mean less commission. The incentive runs backwards.

The same structural problem applies in life sciences compliance. Traditional QMS tools were built to help teams pass audits -- not to prevent compliance failures before they happen. The incentive in legacy systems is reactive: respond to findings, patch gaps, survive the inspection. Qualio is built around a different belief: compliance that runs continuously in the background doesn't wait for the audit to tell you something is wrong.

See how continuous compliance works in practice. Explore how Qualio's Agentic Compliance Platform keeps life sciences teams audit-ready every day -- not just when an inspector is walking through the door. Explore the platform or request a demo.

What finally broke the logjam: data, AI, and continuous monitoring

Valenio is specific about the inflection point. It's not one technology -- it's the convergence of three: continuous health monitoring, large longitudinal data sets, and AI frameworks sophisticated enough to make sense of the patterns.

Xenia's early work on diabetes illustrated the opportunity starkly. Two-thirds of diabetes cost, Valenio found, isn't really a medical problem. It's an information problem. Someone is drifting off course, their body isn't telling them, and by the time they arrive at a doctor's office the drift has become a crisis. Add monitoring, add algorithmic pattern recognition, get the patient to a doctor before the crisis -- and outcomes change dramatically.

"We reduced the chances of a person having a heart attack by something like 15%, the chances of dying from diabetes by something like 20%. And it's very, very simple to do and very cheap." -- Mariano Valenio, CEO of Xenia

The mechanism isn't magic. It's the same principle that makes any proactive system outperform a reactive one: catching the signal is dramatically cheaper than treating the consequence.

The life sciences compliance parallel

For life sciences companies -- medical device makers, SaMD developers, pharma and biotech firms -- the structural problem Valenio describes maps precisely onto compliance and quality management.

Most QMS tools were built for the equivalent of acute disease: audits arrive, teams respond, gaps get patched. The system is designed for inspection readiness, not continuous readiness. And just like the healthcare system Valenio describes, the incentives reinforce the behavior: software vendors get renewed when audits are passed, not when quality is genuinely improving.

The regulatory environment is changing this calculus fast. FDA warning letters per 100 inspections are up 43% since 2019. Medical device warning letters alone rose 96% in FY2024. The inspection cadence is compressing. The penalty for reactive compliance is rising.

This is exactly the framework Qualio's Compliance Intelligence platform is built around. Not an episodic QMS that helps you pass audits -- an agentic compliance platform that continuously executes compliance, surfaces risks before they become findings, and gives leadership the real-time visibility to make decisions with accurate data.

From episodic to continuous compliance. See how life sciences teams are moving from audit-driven panic to always-on readiness -- and what that means for speed to market. Read customer stories.

Finding the right spot in the value chain

One of Valenio's most valuable insights is about where you sit in the value chain -- because the same product can fail or succeed depending on who pays for it and why.

Xenia tried selling to patients directly: too fragmented, too difficult. They tried health plans: plans understood the value but wouldn't invest in savings they'd never capture. They eventually found their answer with employers -- organizations with multi-year relationships with their workforce and a genuine incentive to invest in long-term health outcomes.

To make it work, they also had to change how brokers made money: from a percentage of plan cost to a percentage of savings. One structural change unlocked the whole model.

The lesson for health tech founders: finding clinically effective technology is less than half the problem. Finding the right spot in the value chain -- where someone both understands the value and has an aligned incentive to pay for it -- is the harder, more critical work. This is why Qualio positions around business outcomes (velocity, audit readiness, scalable compliance) rather than feature lists. The right buyer cares about the value, not the functionality.

Failing smarter, not faster

Valenio pushes back on one of startup culture's sacred tenets: "move fast and break things." In healthcare, that's not just bad strategy -- it's dangerous.

"You don't have the luxury of failing fast. If you break things, you're going to kill someone. And the other thing is you'll have to go all the way through registration again. So you have to find a way of failing smarter." -- Mariano Valenio, CEO of Xenia

This mirrors the compliance culture challenge Qualio addresses directly. The instinct in tech is to ship at 70-75%, find the bugs in production, and patch forward. In regulated life sciences environments, that standard simply isn't available. The right number of mistakes is zero, because the stakes involve human lives and regulatory records that can't easily be unwound.

Getting a team built on tech culture to genuinely internalize quality-first thinking is a change management challenge as much as a technical one. And it's part of why companies that reach for a QMS tool and get an eQMS checklist often end up in the same posture as before: reactive, gap-patching, inspection-dependent.

Qualio's eQMS is designed for this: ease of use that drives company-wide adoption, not just QA/RA compliance. When the entire organization -- developers, PMs, regulatory affairs -- engages with quality continuously, the culture shifts. Compliance becomes structural, not heroic.

What excites Valenio most -- and should excite all of us

At the end of the conversation, Valenio zooms out. Healthcare is a $10 trillion industry. Roughly half of that spend is pure inefficiency. If that inefficiency were eliminated, the savings could fund healthcare access for the entire world, not just the 50% currently covered.

That's the scope of the prize. And it's not theoretical. Xenia's largest client -- 20,000 lives -- saw a 40% reduction in costs for the highest-risk patients while simultaneously sending those patients to the doctor 7-8% more often. The intervention was earlier. The care was appropriate. The cost was a fraction.

For life sciences companies building the next generation of healthcare products -- SaMD, AI diagnostics, connected devices, drug discovery platforms -- the implication is direct. The tools you use to build those products, manage compliance, and move through regulatory pathways matter not just for your business. They matter for how fast breakthrough products reach patients.

Compliance shouldn't be the bottleneck on treatments and devices that could change lives. That's the belief behind the Qualio platform -- and it's exactly what Valenio is articulating for health tech at large.

Ready to move from reactive to continuous compliance? See how Qualio's Agentic Compliance Platform helps life sciences companies build faster, stay audit-ready, and scale without the compliance tax. Request a demo, explore the platform, or read customer stories.

Why Context Is the Real Competitive Advantage in Life Sciences

Meg Sinclair — Fri, 29 May 2026 15:50:00 GMT

Joe Luminello has spent 20-plus years in life sciences, moving from pharmaceutical sales leadership to a U.S. affiliate of Takeda, then into the startup world co-founding oncology companies, building a Midwest life sciences incubator, and eventually landing somewhere he didn't expect: competitive intelligence.

He founded RCG Intel in late 2023 with a colleague of 30 years. They'd always wanted to build something together. They did. Then his co-founder left to become the CEO of a publicly traded company. "Typical startup fashion," Joe laughed when we talked on the podcast. "You just go with the flow."

So Joe kept building, and it's turned into something he genuinely loves. I sat down with him on From Lab to Launch to talk about what competitive intelligence actually means in practice, how he thinks about AI, and what's making life so complicated for his clients right now.

What RCG Intel actually does

The easiest way Joe has heard the work described: imagine hiring an investigative reporter and sending them to peel back the onion on a specific question. Not to write a column, not to summarize a press release, but to keep digging until there's something you can actually make a decision with.

That's what RCG Intel does, either on a retainer basis or as one-off engagements. Their clients use the intelligence for strategic planning, pricing decisions, pipeline assumptions, supply decisions. Anywhere a knowledge gap could mean an expensive mistake.

Joe used a great scene from The Imitation Game to explain why context matters so much. The team at Bletchley Park had been staring at intercepted German messages forever, unable to crack the cipher. The breakthrough came in a pub, when someone casually mentioned that every single German message started the same way. That tiny human observation unlocked the entire puzzle. The data was always there. What was missing was someone asking the right question from the right angle.

"Data without context is just data," I said to him. He agreed immediately. That's the business.

Why they chose people over AI

One of the most interesting strategic choices Joe made early on was figuring out what not to do.

He pushed the team hard on AI, week after week, for months. What's our AI play? Do we need to build something? Do we need to buy something? Eventually they worked through it and came out the other side with a clear answer: they don't need to out-build Anthropic or OpenAI. They can't, and that's fine.

What RCG Intel has instead is relationships. With commercial scientists, MDs, business leaders across the industry. Those relationships let them take raw data and apply the kind of context you simply don't get from reading a conference abstract or running a query. The human interpretation, built on decades of lived experience, is the product.

So they hire accordingly. People with eight or more years of experience, ideally folks who've worked on the client side, because those are the people who can anticipate not just what the data says but what questions it's going to generate inside a boardroom.

For life science companies thinking about their own AI strategy, it's a useful model to think about. The tool matters a lot less than the judgment layer on top of it.

What's keeping clients up at night

I asked Joe what the biggest challenge facing his clients is right now, and he was direct: everything is happening at once, and it's happening fast.

Tariffs. Most-favored-nation pricing pressure. Supply chain uncertainty. AI adoption decisions that feel urgent but aren't always clear. The traditional planning rhythm, where you spend the summer building your strategy and finalize it in the fall for the following year, doesn't really fit the pace of change anymore. "Then February comes," Joe said, "and everything's upside down."

The result is a kind of market-wide inertia. Not panic, but paralysis. Leaders who know they need to move but aren't sure which direction. And in that environment, good intelligence isn't a nice-to-have. It's what helps you pick a direction with some confidence.

This challenge isn't unique to Joe's clients. For early-stage biotech and pharma companies especially, the ability to make well-informed strategic calls is often the difference between a runway that lasts and one that doesn't.

A nuanced take on AI adoption

Joe is not an AI skeptic. He wrote a book about it. But his message to leaders is: be deliberate. Don't react. Don't chase.

He recently reposted a headline urging companies to pump the brakes on AI, and it got more impressions than anything he'd ever published. "I think everyone wants permission to slow down," he said. "And it's okay. You're not going to miss the boat."

The deeper concern he has is one that doesn't get talked about enough: if companies start using AI to replace junior employees rather than training those employees to eventually become senior ones, they're quietly dismantling the very institutional knowledge that makes their AI outputs worth anything.

When your senior people leave, who's doing the quality check? And if the answer is nobody, what are you left with?

It connects to something Joe said about the nature of AI replacing work versus replacing occupations. "You're not moving from one job to another," he said. "You're removing that occupation from play entirely. And that's very different." It's worth sitting with, especially in an industry where the contextual expertise that makes someone genuinely useful takes a decade to build.

For biotech organizations navigating compliance and quality work, that same principle applies: the tools are only as good as the people interpreting and acting on them.

Advice for aspiring life science entrepreneurs

Joe's advice here was grounded and honest, which I appreciated.

If you have the pedigree, the network, and you're near the capital pools in Boston or the Bay Area, the development side of pharma is a high-risk, high-reward bet that can be worth taking. For everyone else, the services, devices, diagnostics, and AI-adjacent opportunities offer more accessible paths with less capital burn. (And if you're trying to figure out where to plant roots, the geography still matters a lot.)

"There's going to be plenty of things to do," he said. "Some AI will take out jobs, but some AI will generate more, at least in the short term."

The bigger point he kept coming back to: plan the work and work the plan. Build toward something. Don't just react to the next shiny thing or the next headline. The sun comes up tomorrow no matter what dropped on Twitter this morning.

Where to find Joe

Joe is active on LinkedIn and posts regularly on competitive intelligence, AI strategy, and life sciences leadership. His book walks through RCG Intel's own AI decision-making process alongside broader examples from Netflix to how Huntsville, Alabama became America's rocket capital. It's on Amazon.

You can learn more about what they do at rcgintel.com.

Listen to this episode and every past episode of From Lab to Launch at qualio.com/from-lab-to-launch-podcast. If you enjoy the show, a review on Apple Podcasts or Spotify goes a long way in helping more people in the life sciences community find us.

Championing Women in STEM: What Noreen Hong's 28-Year Career at Thermo Fisher Teaches Us About Growth, Leadership, and the Future of Life Sciences

Meg Sinclair — Wed, 27 May 2026 16:39:00 GMT

Even in 2026, women remain underrepresented across STEM fields, and the life sciences are no exception. For Women's History Month, the From Lab to Launch podcast sat down with someone who has spent nearly three decades proving what's possible when talent meets opportunity, mentorship, and the courage to be uncomfortable.

Noreen Hong is the VP and General Manager of Thermo Fisher Scientific's Growth Protection and Separation Business. With degrees in both biomedical engineering and business administration, she sits at a rare intersection of scientific expertise and commercial acumen. Over 28 years (punctuated by a brief stint at a quality and regulatory consultancy before returning), she has grown from account and product management into senior leadership at one of the world's most influential life science companies.

Her conversation with us covered everything from sustainable lab practices to the AI revolution, but one theme ran through all of it: thoughtful leadership, championing underrepresented talent, and the transformative power of leaning into discomfort. Here's what stood out.

Staying for the Right Reasons

When I asked Noreen why she had spent so much of her career at one company, her answer was more nuanced than loyalty.

"What's kept me here is the passion of our colleagues. The passion they have for the mission, for helping our customers make the world healthier, safer, and cleaner," she told me. "It's just not something that we say. It's really embedded into how we work every day."

The other factor? A genuine investment in people. Noreen credits Thermo Fisher's focus on developing talent as foundational to her own trajectory, and it's also what drives her to pay it forward. "That's been a meaningful impact for me, and why I want to give back to others," she said.

It's a reminder that company culture isn't just a hiring talking point. For someone like Noreen, who could have gone anywhere, it was the reason she stayed, left, and came back.

What Companies Need to Actually Do for Women in STEM

This is where Noreen didn't mince words. I asked her whether the underrepresentation of women in life sciences is a cultural problem or something bigger. Her answer: both.

"Organizations need to be open-minded in how they evaluate candidates and a little bit more flexible about the requirements they put into job descriptions," she said. "Sometimes we unintentionally narrow the pool by expecting someone to check every single box, when in reality, great leaders and innovators often grow into roles."

But she had an equally direct message for women themselves: stop waiting until you hit 100%.

"If you meet 60 or 70% of the requirements and you're really excited about the opportunity, you should really go for it," she said. "When companies value potential and diverse perspectives, and when people feel confident raising their hand for opportunities, that's when you really start to see more women and other groups thrive."

It's an insight backed up by years of research, and yet the habit of over-qualifying before applying remains stubbornly common among women. Noreen's message is simple: the disqualification shouldn't always come from you.

On Challenging the Status Quo and Why It's Worth It

One of the most vivid moments of our conversation came when Noreen described watching a leader on her team break an industry norm entirely.

"Instead of following the traditional model, she stepped back, questioned the status quo, and built a new solution that better aligned with how our customers actually work today," Noreen told me. "It wasn't the easiest path, and it meant breaking a few old norms, but the result was an innovative approach that strengthened our customer relationships and helped us protect and grow the business."

Her takeaway for women in the field: "Be willing to think differently, take smart risks, and create solutions that move science and our customers forward."

Progress, she reminded me, rarely looks tidy from the inside. It looks like risk, uncertainty, and a decision to do it anyway.

The Advice She Gives Her Kids and Her Younger Self

I asked Noreen what she'd tell her younger self just starting out in life sciences. She didn't hesitate: trust your instincts.

"Earlier in my career, I constantly second-guessed myself, and even still today, sometimes I do," she admitted. "But what I've learned over time is that experience builds confidence, but your perspective and judgment have value much earlier than you actually think."

The moments that accelerated her career most were the uncomfortable ones. The opportunities that felt a little too big, a little too soon. "If it feels scary and it makes you nervous, that's probably also excitement," she said. "If you're always comfortable, you're probably just doing something you've done before."

As a mother passing this on to her own kids, she speaks from lived experience, not theory. And as someone who interviews life science leaders for a living, I can tell you: that kind of honest self-reflection is rarer than it should be.

Tough Decisions, Done with Grace

Leadership is easy to romanticize. Noreen doesn't.

When I asked about a genuinely hard decision from her career, she pointed not to a strategic pivot or a market bet, but to talent decisions. Specifically, knowing when someone isn't the right fit and acting on it.

"Those situations are never easy, and honestly, that doesn't get easier no matter how many years you've been managing people," she said. "I always try to invest the time first: coaching, giving feedback, making sure the person has the support to improve. But sometimes it becomes clear that it's just not the right fit."

What she's learned is that honesty, handled well, is actually an act of care. "When you are transparent and have honest conversations, when you actually ask someone who might not be doing well, 'Are you really having fun?' they'll often say no," she told me. "And then you can say, 'Okay, what do you enjoy? Let's help you find something you're passionate about.'"

It's a model of leadership that prioritizes the human alongside the business outcome. And it's the kind of thing that doesn't get talked about enough.

Sustainability in the Lab: Where to Start

As a quality professional myself, this was the part of our conversation I was most personally curious about. How do labs actually transition to more sustainable operations without compromising the science?

Noreen's advice was refreshingly practical. "Start by looking at the equipment you already have and ask yourself how old it is and how old the technology behind it is," she said. "Many newer instruments are designed to be more energy efficient, so upgrading older equipment can actually lower your operational costs while also supporting sustainability."

She pointed to a recent Thermo Fisher product launch, a new centrifugation line that uses non-fluorinated natural gas, as an example of sustainability being built into the design from the start rather than added as an afterthought. "It's a more sustainable option that also delivers improved performance," she said.

Data and traceability are the other piece. "The ability to use data to monitor equipment, anticipate maintenance, and improve efficiency helps labs make better decisions, reduce downtime, and run more efficiently overall," she said. "Investing in equipment that supports that kind of visibility can really help future-proof your lab without compromising quality."

The message for lab leaders: sustainability and performance aren't in tension. The right technology choices serve both.

What Excites Her Most About the Future

When I asked Noreen what excites her most about where life sciences is headed, she pointed to velocity.

"The future of science is just so fast," she said. "Technology is changing the way we work and discover. Robotics and automation have made so many processes faster and more efficient. And now we're entering another big shift with AI."

She was candid about her own journey with AI tools. "If you asked me even six months ago whether I'd really be using ChatGPT, I'd have said no, not at all. But the fact that it can do images, help with research so much faster, digest information, it's pretty powerful."

Looking ahead, she's most excited about how these technologies, AI, automation, and connectivity, will come together inside the lab. "The potential to help scientists move faster and analyze data in new ways, and ultimately accelerate discoveries, is incredibly powerful," she said. "I think we're right at the tip of it."

Faster discoveries mean treatments and solutions in the hands of patients sooner. That's not abstract. That's the mission.

Five Years from Now

Noreen's five-year vision for Thermo Fisher is anchored in two things: continued innovation and sustainability leadership. She sees the industry moving toward more energy-efficient product design, reduced use of hazardous chemicals, recyclable and biodegradable packaging, and greater transparency from suppliers around environmental goals.

Personally, her ambition is people-focused. "I'd love to continue supporting and developing the next generation of leaders, especially encouraging more women to pursue and grow their careers in science and technology," she said. "Making sure we're building diverse and strong teams will be an important part of shaping the future."

A Final Note

If you want to follow Noreen's journey or reach out to connect, she's active on LinkedIn and open to conversations, especially for anyone looking to grow or navigate a career in life sciences.

You can listen to the full episode of From Lab to Launch, including Noreen's love of mystery novels and her habit of solving the ending before it happens, on Buzzsprout here.

Her story is a reminder that a long career and a growing career are not the same thing. Noreen has made sure hers is both.

If Compliance Is Slowing You Down, Your Regulations Are Not the Problem. Your Model Is.

Lola Furlong — Fri, 22 May 2026 16:11:00 GMT

Why Does Medical Device Compliance Feel So Slow?

In MedTech, slow development cycles, late submissions, and missed launch dates rarely get blamed on the real culprit. Instead, teams point at the regulations:

FDA 21 CFR Part 820 stretches development.

EU MDR Technical File requirements delay submissions.

ISO 13485 demands too much rigor to move fast.

Over time, the industry accepted a default assumption: you can move fast, or you can be compliant. Pick one.

But that assumption is wrong — and the most competitive MedTech companies are proving it.

The regulations are not the problem. The compliance model used to meet them is.

What Is the Real Source of Compliance Friction?

Before an FDA inspection, a QMSR alignment review, a Notified Body audit, or an EU MDR submission, something predictable happens inside most growth-stage medical device companies:

Engineering velocity drops. QA shifts fully into documentation review. Regulatory Affairs runs cross-functional traceability checks. Design History Files (DHFs) get stress-tested. CAPA records get reconciled against ISO 14971 risk management files. Verification and validation reports get rechecked from scratch.

Innovation pauses. The organization stops building to reconstruct regulatory evidence.

This is not a competence problem. Most QA and RA leaders deeply understand FDA compliance, ISO 14971 risk management, IEC 62304 software lifecycles, and EU MDR post-market surveillance. The issue is structural.

The issue is fragmentation.

How Do Medical Device Companies Currently Handle Compliance? (And Why Each Approach Has Limits)

Most MedTech organizations manage compliance through one — or a combination — of these approaches. Each one persists for a reason. Each one hits a ceiling.

Manual Ops: Spreadsheets, shared drives, paper-based workflows. These approaches work until they don't scale. Every update requires human coordination. Every audit requires reconstruction.

Fragmented Reactive Systems: Traditional QMS, PLM, or RIM tools manage compliance point-in-time. They were built for document storage and episodic audits — not for continuous lifecycle traceability. Teams slow down so compliance can catch up.

General Purpose AI: Using ChatGPT or similar tools to accelerate documentation is fast but not validated. Outputs aren't connected to a system of record. They don't hold up under regulatory scrutiny.

Headcount and Consultants: The default band-aid layered on top of everything else. Adding QA headcount scales cost. It does not solve architectural friction. It does not change the speed limit.

The real competition in medical device compliance is rarely a single tool or vendor. It is this combination of approaches — manual ops propped up by headcount, or fragmented systems patched ahead of each audit.

Why Is Lifecycle Traceability So Difficult to Maintain?

Medical device compliance depends on lifecycle traceability. Regulators expect a clear, auditable line from:

User need → Design input

Design output → Verification testing

Risk control → Post-market surveillance

This traceability must live inside a Quality Management System (QMS) and hold up during audits and regulatory submissions. But in most organizations, that "clear line" is scattered across disconnected systems:

Design controls in PLM systems

Risk management in ISO 14971 spreadsheets

CAPA inside a legacy QMS

Training records in HR platforms

Post-market surveillance in complaint management systems

Each tool works. None models the full medical device lifecycle. When systems don't communicate, traceability must be manually reconstructed — before every FDA inspection, every EU MDR Technical File review, every major design change, every 510(k) submission.

Manual stitching quietly becomes your speed limit.

What Does Compliance Fragmentation Actually Cost?

When compliance architecture is fragmented, the costs compound across every dimension that matters to leadership:

Regulatory submissions slow because EU MDR documentation expands through redundant cross-referencing. Change control becomes risky because no single system holds complete traceability. Audit readiness becomes episodic — a sprint before every inspection rather than a standing capability. Variability increases. Predictability declines.

And predictability is what leadership teams care about most. Every board meeting, every investor update, every product launch plan is built on schedule assumptions that fragmented compliance quietly undermines.

Have Modern Medical Devices Outgrown Legacy Compliance Models?

Today's medical devices are not static hardware. They include embedded software, firmware updates, cloud connectivity, cybersecurity controls, and AI-enabled features. Under IEC 62304, FDA Software as a Medical Device (SaMD) guidance, ISO 14971, and EU MDR, risk is continuous, design evolves continuously, and post-market data flows continuously.

A document-centric QMS built for static artifacts cannot represent this dynamic reality.

Adding QA headcount does not solve architectural friction. Adding more disconnected tools increases sprawl. Manual reconciliation does not scale to software-driven product complexity.

Modern products require a compliance architecture that mirrors product complexity.

What Is Continuous Compliance — and How Does It Change the Model?

The forward-looking MedTech companies are not loosening regulatory rigor. They are modernizing compliance infrastructure.

Continuous compliance embeds lifecycle traceability directly into the operating model rather than reconstructing it before each audit. It unifies design controls, risk management, CAPA, training, and post-market surveillance within a single compliance architecture — so that the system reflects reality at all times, not just during inspection preparation.

In this model:

Design changes automatically reflect in risk analysis

Field complaints link directly to the DHF

Audit readiness reflects system state, not heroic effort

Regulatory submissions become more predictable

FDA inspection readiness becomes structural — not reactive

EU MDR documentation becomes reusable — not rebuilt from scratch each cycle

Compliance begins to support speed instead of interrupting it.

What Should MedTech Leaders Look for in a Modern QMS?

If the compliance model — not the regulations, not the team — is determining your speed limit, the strategic question changes.

The question is not: "Which QMS should we buy?"

The question is: "Does our compliance architecture eliminate the structural fragmentation that makes compliance slow, expensive, and unpredictable?"

A modern QMS for medical devices should be evaluated against different criteria than legacy tools:

Legacy QMS Criteria

Modern Compliance Architecture Criteria

Does it manage documents?

Does it unify the product lifecycle with quality and regulatory?

Does it pass audits?

Does it maintain continuous audit readiness?

Does it track CAPA?

Does it autonomously triage and remediate?

Is it validated?

Is it AI-native with regulatory-grade validation?

Does it integrate?

Does it work where teams already work?

How Qualio Addresses Compliance Fragmentation

Qualio is the Agentic Compliance Platform for Life Sciences — a unified product lifecycle, quality, and regulatory platform that continuously executes compliance, not just manages records.

Unlike traditional QMS tools built for document storage and episodic audits, Qualio is designed so compliance runs in parallel with product development. Teams stay in their tools. Design controls and risk management stay connected. Audit readiness is structural.

Qualio's platform is built on four value themes that matter to MedTech leaders:

Increase Product Development Velocity. Compliance runs in parallel, not in sequence. Teams stay in their development tools — including Jira integrations — while Qualio keeps the compliance record current.

Fast Compliance and Regulatory Outcomes. Always-on audit readiness replaces episodic panic. Multi-standard gap analysis, CAPA triage, and 510(k) and CE Mark technical file assembly happen continuously.

Scale Without Compliance Overhead. Grow product lines, sites, and regulatory complexity without proportional cost growth. Pre-built QMS content, compliance frameworks for ISO 13485, ISO 14971, MDSAP, and more — with value in under 60 days.

Risk Visibility to Run the Business. Real-time compliance intelligence for leadership — so decisions get made on accurate data, not assumptions reconstructed before audits.

The Strategic Question for MedTech Leaders

FDA oversight. ISO 13485. QMSR alignment. EU MDR documentation. These frameworks are not the source of delay. They are essential guardrails for patient safety, device efficacy, and risk management.

Fragmentation is the real constraint. When regulatory evidence is scattered across systems that were never designed to function as a cohesive medical device compliance architecture, speed suffers — not because teams aren't working hard enough, but because the model sets the speed limit.

When compliance architecture aligns with product reality, speed and compliance reinforce each other. When it doesn't, the model determines the ceiling — regardless of how capable the team is.

The question is not whether your QA and RA teams are strong enough. The question is whether your Quality Management System was designed for modern device complexity and continuous lifecycle traceability.

See how Qualio helps MedTech teams build compliance that runs in parallel with product development →

Why Hiring More QA Staff Won't Solve Your Biotech Compliance Capacity Problem

Meg Sinclair — Wed, 20 May 2026 16:21:00 GMT

Life sciences has evolved over the last decade. Software and AI are now embedded in most biotech pipelines. Regulatory enforcement is rising — FDA warning letters per 100 inspections are up 43% since 2019. The 2030 patent cliff is compressing R&D timelines and forcing parallel market entry strategies.

Compliance hasn't kept pace. And the gap is costing biotech organizations more than they realize.

The default response to growing compliance obligations is predictable: add headcount. Hire another quality engineer. Bring on a regulatory affairs specialist. Stack consultants on top when things get urgent. It's understandable. But it treats a systems design problem like a staffing problem — and that distinction determines whether your compliance function scales with your program or becomes its ceiling.

How Biotech Organizations Are Managing Compliance Today (And Why Each Approach Has a Ceiling)

Before diagnosing the problem, it helps to be honest about the alternatives most growth-stage biotech organizations are actually using:

Manual ops and spreadsheets. Works at early stage. Adds friction to every workflow as programs grow. Requires constant human coordination to maintain traceability — and that coordination cost compounds with every new connection between systems, CDMOs, and regulatory domains.

Fragmented reactive systems. Traditional QMS or point tools are built for passing audits, not keeping pace with development. Compliance becomes a point-in-time activity — assessed and patched ahead of regulatory interactions, then left to drift until the next cycle. Teams slow down for compliance instead of running alongside it.

General-purpose AI. Increasingly common, not yet sufficient. Fast outputs, but not validated, not connected to a system of record, and not defensible in front of a regulator. The output variance alone is disqualifying for regulated workflows.

Headcount and consultants. The default band-aid layered on top of everything else. Scales cost, not capability. And the talent pool is finite: qualified quality and regulatory professionals are scarce, onboarding takes months, and institutional knowledge — which systems hold which evidence, how they connect, what a regulator will look for — is lost every time someone leaves.

The real competition for Qualio is rarely a single vendor. It is this combination: manual ops propped up by headcount, fragmented systems patched with consultants, and a team running at full capacity regardless of how many people have been hired.

Related reading: Your Compliance Model: Effective Now, Vulnerable Later — when and why manual compliance models hit their hidden load limit.

The Structural Problem These Approaches Share

Compliance obligations in biotech do not scale linearly with program size. They scale with complexity.

A single program moving from research into clinical development doesn't just add more work to each function. It multiplies the number of connections between functions that must be maintained and verified. Laboratory data must connect to manufacturing records. Quality events must trace to investigations and corrective actions. Clinical documentation must align with regulatory submissions. Manufacturing validation must reflect process changes as they happen.

Each new product, additional manufacturing site, or regulatory jurisdiction doesn't create a proportional increase in compliance work. It multiplies the surface area of connections that need to be managed — and the cost of managing those connections manually grows faster than any team can absorb.

What most compliance professionals actually spend their hours on isn't regulatory strategy or quality oversight. It is coordination and reconciliation — assembling evidence from systems that don't communicate, verifying that records in one platform align with records in another, building the documentation chains that connect laboratory data to quality events to regulatory submissions.

This work is necessary. It is also repetitive, time-consuming, and entirely dependent on the underlying compliance architecture. When evidence lives in disconnected systems, reconciliation is unavoidable — and it consumes the hours of your most experienced people.

The same quality leader who should be interpreting regulatory strategy and preparing for evolving frameworks spends weeks before each inspection doing work the systems should have already handled.

That is not a performance problem. It is an infrastructure design problem.

Related reading: Audit-Ready vs. Scale-Ready: Why Passing Is Not Proof — the difference between surviving an audit and building an operating model that scales.

What the "Perfect World" Actually Looks Like

If compliance is genuinely important to the business — and in biotech, it determines whether and when products reach patients — it needs to be designed differently. Not as a function that reacts to regulatory milestones, but as one that runs in parallel with product development.

A continuous compliance execution model has four characteristics:

Integrated system. Product lifecycle, quality management, and regulatory compliance unified in one architecture — not reconciled across disconnected platforms.

Easy collaboration. Teams stay in their tools. Compliance happens alongside development, not as a handoff that creates bottlenecks.

Real-time visibility. Leadership has an accurate compliance posture at any point in the program cycle — not just during audit prep sprints.

AI-native execution. Agents that handle gap analysis, CAPA triage, audit preparation, and guided remediation — bounded, validated, and defensible in front of a regulator.

When this architecture is in place, inspection preparation that currently takes weeks takes days. Submission evidence that requires cross-functional assembly is already connected. Quality investigations begin with relevant records already surfaced, not manually retrieved.

The experienced professionals who were doing that manual work don't become redundant. They become available for the judgment-intensive work that actually requires their expertise: regulatory intelligence, manufacturing quality strategy, framework interpretation, inspection response.

Related reading: Continuous Readiness Is Becoming the New Operating Standard — how leading organizations are shifting from episodic audit preparation to a structural compliance posture.

The Question Worth Asking Before the Next Hire

Before approving the next compliance headcount request, ask one question: Is this hire addressing a genuine capacity need, or compensating for an architectural gap?

If the work driving the hire is primarily reconciliation, coordination, and evidence assembly across disconnected systems — that is an architectural problem. Headcount will absorb it, but it won't solve it. The same work returns next year, at greater complexity, requiring the same response.

If the work is judgment-intensive — regulatory strategy, quality system oversight, inspection response — that is a genuine capacity need. Those roles deliver value no architecture can replace.

The most expensive path forward is treating an architectural problem like a staffing problem, indefinitely.

Related reading: 5 Ways to Make the FDA Audit Process Easier — practical steps toward structural audit readiness.

What Organizations That Scale Compliance Well Have in Common

Organizations that manage compliance effectively as they grow are not doing so by maintaining unusually large quality teams relative to program size. They have built architectures that keep compliance effort stable even as program complexity increases.

The results are measurable. eClinical Solutions managed 50+ annual customer audits without adding headcount and eliminated three planned FTEs from their quality budget. InVivo Bionics eliminated one FTE of quality headcount while achieving 100% company-wide QMS engagement. Sentec reduced audit preparation time by 80% — from one week to one day.

These outcomes are not the result of exceptional people working harder. They are the result of infrastructure design that changed what those people had to do.

Frequently Asked Questions

What is biotech compliance capacity and why does it become a problem at scale? Compliance capacity is the human bandwidth available to execute quality and regulatory work. It becomes a structural problem at scale because compliance complexity in biotech grows faster than headcount can absorb — each new program, site, or regulatory jurisdiction multiplies the number of evidence connections that must be maintained, not just the volume of tasks.

Why can't hiring more QA staff solve a biotech compliance capacity problem? When the root cause is architectural — disconnected systems that require manual reconciliation — additional headcount absorbs the symptoms without addressing the cause. The same coordination and evidence-assembly work returns each cycle, at greater scale. Headcount scales cost; it doesn't change what the work consists of.

What is an agentic compliance platform and how is it different from a traditional QMS? A traditional quality management system manages compliance records and supports audit preparation. An agentic compliance platform continuously executes compliance — maintaining evidence alignment in real time, running autonomous gap analysis, triaging CAPAs, and preparing audit documentation as a system condition rather than a project. The shift is from passing audits to running compliance in parallel with product development.

What is continuous compliance execution in biotech? Continuous compliance execution is an operating model in which quality evidence is maintained and aligned as work progresses — laboratory data connecting to quality records as it is generated, manufacturing deviations linking to investigation workflows automatically, traceability between systems structural rather than manually assembled. Audit readiness becomes a confirmation rather than a reconstruction.

When should a biotech organization invest in compliance infrastructure instead of hiring? When the work driving a headcount request is primarily evidence reconciliation, documentation assembly, or cross-system coordination — that is an infrastructure problem best solved architecturally. When the work is regulatory strategy, manufacturing quality oversight, or inspection response — that is a genuine capacity need. See also: regulatory compliance software for biopharma.

The Strategic Investment Most Biotech Organizations Are Deferring

Biotech organizations are investing at the frontier of medicine. The science is extraordinary. The compliance infrastructure supporting that science in many organizations reflects an earlier era — one where programs were simpler, evidence volumes were lower, and manual coordination was a workable model.

That model doesn't fail dramatically. It fails gradually: timelines that take longer than expected, inspections that require more preparation than planned, quality functions that run at capacity regardless of how many people have been hired.

Resolving it requires treating compliance architecture as a strategic investment — not a background operational concern. The capacity constraint in most biotech compliance functions is not primarily a people problem.

It is a systems design problem. When solved, it unlocks lasting capacity, lowers risk, and enables the focus that genuine innovation demands.

Qualio is the Agentic Compliance Platform for Life Sciences. Qualio's AI Agents and software accelerate product development and run compliance in parallel — enabling biotech organizations to bring safe products to market quickly, without compliance becoming the bottleneck.

See how Qualio works for biotech →

6 Signs You're Going to Break at IND: And Don't Know It Yet

Lola Furlong — Mon, 18 May 2026 17:28:00 GMT

Life sciences has changed dramatically over the last decade. Faster development cycles, software and AI embedded in R&D, more regulatory frameworks running in parallel.

Compliance hasn't kept pace.

And nowhere does that gap become more visible, and more costly, at IND.

Most growth-stage biotech companies don't fail at IND because they were unprepared. They fail because they thought they were ready. A clean GLP audit creates confidence. It signals control. It suggests your quality system is working. And after months of running lean and making it work, that signal feels like validation.

But IND doesn't test whether your system worked in preclinical. It tests whether your system can handle what comes next.

Filing triggers 21 CFR Part 312 requirements. ICH E6 GCP obligations layer in. CDMO oversight becomes a real accountability structure. CRO execution introduces new coordination demands across sites and functions. And often, a new VP of Quality or Head of RA steps in and inherits a system built for a much simpler operating model.

At that moment, a gap appears.

The gap between what your system can support and what clinical-stage compliance demands is filled by one thing: human effort. Late nights, manual reconciliation, fragile workarounds.

We call this the Heroics Gap: the extra manual effort required to stretch a research-focused system into clinical-stage compliance. Heroics don't eliminate risk. They postpone when that risk becomes visible, and compound the cost when it does.

Here are six signs your system is running on heroics, not infrastructure.

Sign 1: Your Audit Prep Is Measured in Weeks, Not Days

If preparing for a regulatory touchpoint requires 80 to 160 hours of QA time pulling documents, reconciling records, and chasing evidence across systems, your readiness is episodic.

You're reconstructing compliance, not maintaining it.

Today, most growth-stage biotech teams manage this through one of two approaches: manual ops (spreadsheets, shared drives, email) or fragmented reactive systems built for passing audits, not maintaining continuous readiness. Both approaches work in preclinical. At IND, the frequency of regulatory touchpoints increases, the documentation demands multiply, and the window to respond to any request shrinks.

Audit readiness shouldn't be an event. It should be a state. If yours isn't, that's your first sign.

Related: Audit-Ready vs Scale-Ready: Why Passing Is Not Proof →

Sign 2: Your CDMO Oversight Lives Outside Your Quality System

If vendor qualification records, manufacturing data, and CMC documentation live in spreadsheets, shared drives, or email threads, you don't have CDMO oversight. You have partial visibility, on a good day.

Partial visibility can feel sufficient when things are running smoothly. The real competition at this stage isn't a competing QMS vendor. It's the combination of manual ops, headcount, and fragmented tools that let you keep going without a unified system of record. That combination works until one deviation, one unannounced audit, or one key personnel change exposes how thin the coverage actually is.

When that happens, you're looking at a multi-week remediation cycle triggered at exactly the moment you can least afford it: during IND preparation, during CMC review, or during a diligence process.

CDMO oversight isn't a best practice. At IND, it's a structural requirement. If it's not embedded in your quality system, it's a liability you're carrying without knowing it.

Related: Your Compliance Model: Effective Now, Vulnerable Later →

Sign 3: Your SOPs Get Updated Before Inspections, Not Continuously

If your SOPs are reviewed and revised in the weeks leading up to a regulatory event, that's not a quality system. That's a documentation sprint.

Regulators notice. Investors notice. Your own team notices, because they're the ones pulled away from execution to participate in the sprint.

The issue isn't that your SOPs are wrong. It's that periodic, milestone-driven updates don't reflect how your organization actually operates day to day. In clinical, the gap between documented process and actual practice is exactly what inspectors are trained to find.

Continuous document control isn't a resource question. It's an architecture question. If your system doesn't make continuous updates easier than periodic sprints, the sprint will always win, until it can't.

Sign 4: CRO Change Control Runs Through Email

Clinical execution oversight isn't a best practice. It's a requirement.

Protocol changes, investigator updates, site qualifications, protocol deviations: these need to exist in a structured, traceable system. When they're managed through email threads with no connection to your quality system, every update creates undocumented risk.

In the moment, it feels manageable. Email is fast. It's familiar. Everyone's already in it. But email is change communication, not change control. Those are not the same thing.

When you need to trace a decision during an audit, during a deviation investigation, or during a regulatory inquiry, the email chain becomes unexplainable. You have a record that something happened. You don't have a record that satisfies the standard for how decisions are made and approved in a clinical-stage organization.

Related: Continuous Readiness Is Becoming the New Operating Standard →

Sign 5: Your Risk Register Isn't Connected to Your Clinical Reality

If your risk register is a standalone document, updated manually before major milestones, it isn't risk management. It's risk documentation.

The distinction matters because regulators aren't looking only for evidence that you identified risks. They're looking for evidence that your risk management informs your decisions. There needs to be a traceable connection between what you anticipated and how you responded.

When a clinical deviation needs to be connected to a prior risk assessment and no system-level link exists, that gap doesn't stay hidden. It surfaces under exactly the conditions where you need the most credibility: inspection, deviation review, escalation.

A risk register that lives in a document lives outside your quality system. At IND, that's not a minor gap. It's a structural vulnerability.

Sign 6: Too Much of Your System Lives in One Person's Head

If a new VP of Quality or Head of RA needs weeks to understand how your quality processes actually work, your system isn't operationalized. It's person-dependent.

Person-dependent systems feel stable when the person is there. They can look perfectly functional from the outside. But they create fragility at the exact moments you need reliability: IND submission, first regulatory interactions, Series B diligence.

Leadership transitions at clinical-stage companies happen regularly. If your quality system doesn't transfer cleanly, if onboarding a new leader requires tribal knowledge, undocumented conventions, and weeks of shadow work, the system doesn't scale.

A system that doesn't scale beyond a single individual isn't infrastructure. It's a single point of failure.

The Pattern Behind All Six Signs

Every one of these signs reflects a quality system still built for research, not clinical complexity.

None of these gaps are visible in preclinical. The operating model in preclinical is simpler. Regulatory exposure is narrower. Coordination demands are lower. A system built for that environment can look perfectly functional, until the environment changes.

IND is where they compound, simultaneously.

The Heroics Gap is what keeps these systems running longer than they should. Smart, capable people work harder to compensate for structural gaps. The system doesn't fail. It just requires more human effort to keep functioning. And that effort hides the risk until the risk becomes unavoidable.

What It Actually Costs

These gaps don't show up first as inspection findings. They show up as operational problems:

A 30 to 60 day IND delay caused by documentation gaps identified late in the review process. A CDMO remediation cycle triggered mid-IND preparation, pulling key resources away from filing work. A diligence issue that slows or reshapes a Series B because an investor's quality review surfaced what your internal review missed.

IND isn't just a regulatory milestone. It's the point where operational gaps become business risks, and the cost of fixing them increases significantly.

The Reality Most Teams Miss

Phase I doesn't create these problems.

IND removes your ability to hide them.

Once you're in it, fixes take longer, cost more, and happen under higher visibility. What could have been addressed structurally, with time and optionality, becomes reactive work under pressure.

The window to close these gaps on your terms is the 6 to 9 months before IND. Not during. Not after. Before.

Before IND Becomes the Stress Test

If you're within 6 to 9 months of IND, this isn't theoretical. The signs are already present, or they're not. But the only way to know is to look clearly, before the filing date forces the answer.

The IND Stress Test is a short diagnostic built for exactly this moment. It maps where your quality system is structurally ready for clinical-stage demands, and where it isn't, before IND exposes the gaps under the worst possible conditions.

It takes less time than one documentation sprint. And it gives you the one thing you can't recover once IND starts: lead time.

Qualio is the Agentic Compliance Platform for Life Sciences, built so growth-stage biotech companies can run compliance in parallel with product development, without the heroics. Learn more about how Qualio supports biotech compliance →