Build the Plan for a Moving Regulator

FDA Commissioner Marty Makary resigned on May 12 with most of the agency’s senior career staff already turned over across the prior twelve months. On April 1 the FDA denied Harrison.ai’s petition to exempt radiology AI software from premarket review and pointed petitioners toward predetermined change control plans and the Q-Submission program as the alternative pathway. Aligned Medical Solutions, Medical Action Industries, and American Contract Systems all issued urgent recalls of convenience kits containing a single Medline Namic angiographic syringe component, with four serious injuries reported by mid-March. Three signals across six weeks, all telling founders building medical devices, diagnostics, AI-enabled SaMD platforms, and any regulated hardware that the operating environment around the FDA pathway is moving on a quarterly cadence. Founders who finish in regulated hardware do not treat the regulatory environment as a static assumption locked in at the seed-stage operating plan. They design the technical architecture, the pathway plan, the post-market quality system, and the operating cadence against the regulatory environment as the moving variable it now is.

If You Are Building a Company in This Environment

The default first-time medical device, diagnostics, or AI SaMD founder treats the FDA pathway as a process the business will run through at a specific milestone, with the timeline assumption set at the seed-stage operating model and held constant against whatever the agency does between the model and the submission. The build-phase logic is that the technical capability is the thing the agency will price the submission against, that the regulatory consultant will translate the technical work into the submission package when the time comes, and that the post-market quality system is a function the company will build out at commercial launch. The three signals across the past six weeks reframe the logic. The Makary resignation widens the timeline error bar on every active submission, because the senior career staff have already turned over and the commissioner-level transition compounds with the lower-visibility staffing question that determines how a specific file gets reviewed. The April 1 Harrison.ai denial confirms that the AI device pathway will keep running through the full evaluation framework with PCCP and Q-Sub embedded as load-bearing tools, and the agency rejected the prior-clearance-as-competency-proxy argument in a way that prices the pathway design more carefully than the sponsor base had been modeling. The Medline recall cascade shows that the post-market exposure travels through the supplier-customer graph faster than the pre-market evidence does, and the four-injury count and four-kit-manufacturer footprint price the operating cost into whichever quarter the recall lands in.

Founders who finish in regulated hardware run the regulatory environment as an operating variable that updates on a quarterly cadence. They embed the regulatory team in the operating rhythm rather than treating it as a service the company buys at the submission moment, hold the submission timeline assumption against the actual reviewer continuity inside CDRH rather than against the publicly stated review-clock window, design the pathway plan to price the predetermined change control plan and the Q-Submission cadence as load-bearing operating tools, and build the post-market quality and notification architecture for the supplier-customer cascade exposure the current environment is producing. They run the supplier-side quality agreement and the downstream notification cadence on a regular review rhythm, with the specific question of whether the operating plan can absorb a recall-cascade event without rewiring the gross margin trajectory the financing was sized against. They resource the regulatory operating system as a Day-1 capital line that compounds across the build phase into the participation profile the agency, the investor, and the strategic acquirer all read at the moment the operating plan needs the regulatory assumption to be true.

The version of the regulatory-plan decision that breaks first-time medical device and AI SaMD founders is the one that begins after the technical milestones are in hand and the regulatory consultant is brought in to translate the work into a submission package. The founder discovers in the pre-submission feedback or in the substantive review cycle that the timeline assumption has slipped past the financing window, that the AI pathway requires PCCP and Q-Sub work the capital plan did not budget for, or that a component supplier inside a kitted product has triggered a recall cascade the post-market quality system is not architected to absorb. The cost shows up at the commercial window, when the operating plan needs the clearance or the post-market resilience to be true, and the regulatory environment has moved against the assumptions the operating plan was built on.

What the Three Signals Tell You About the Regulatory Operating Plan You Need

The three signals across the past six weeks describe what the regulatory operating plan inside a finishing medical device, diagnostics, or AI SaMD business actually has to deliver. The Makary resignation tells you the timeline error bar around an FDA submission is wider than the publicly stated review clock suggests, and the operating plan has to price the additional uncertainty into the financing trajectory and the launch sequencing. The April 1 Harrison.ai denial tells you the AI device pathway is going to keep running through the full 510(k) or De Novo evaluation with PCCP and Q-Sub as load-bearing tools, and the technical and clinical evidence base has to be sized for the longer pathway cycle that the agency just confirmed. The Medline recall cascade tells you the post-market exposure travels through the supplier-customer graph at a cadence the operating plan has to be sized against, and the supplier-side quality architecture and the downstream notification cadence have to absorb the recall risk without rewiring the gross margin trajectory.

The architectural work that separates the regulated-hardware companies that finish from the ones that stall in this environment is the regulatory operating plan that runs against the moving environment rather than against the static seed-stage assumption. The companies that finish embed the regulatory team in the operating cadence, run the pathway plan with PCCP and Q-Sub as load-bearing tools, build the post-market quality and notification architecture for the supplier-customer cascade exposure, and update the operating plan on a quarterly review rhythm against the most recent agency signal. The companies that stall buy regulatory work as a service at the submission moment, model the pathway against an exemption or a shortcut the agency has not granted, and build a post-market quality system sized for a prior decade of supplier-customer dynamics. The first set of companies absorbs the Makary-class transition or the AI-pathway hardening or the recall-cascade exposure inside the operating cadence the business already runs. The second set does not, and the cost arrives at the moment the operating plan needs the regulatory assumption to be true.

What Regulatory Operating Discipline Looks Like at Scale

The companies that win on the regulatory operating plan in medical devices, diagnostics, and AI SaMD do specific architectural and operating work that is easy to defer and expensive to skip. They embed a regulatory operating function inside the company with senior regulatory and quality operators who have run comparable platforms through the relevant CDRH division, with the operating cadence to read the agency’s signals in something close to real time and update the pathway plan when a signal moves a load-bearing assumption. They run the submission timeline against the actual reviewer continuity inside the assigned review team rather than against the publicly stated review-clock window, with the specific question of whether the operating plan can absorb a leadership transition or a reviewer-team change without rewiring the financing window. They design the technical and clinical evidence base to support the full pathway evaluation with PCCP and Q-Sub embedded as load-bearing tools rather than as fallback options, and they build the predetermined change control plan into the product architecture from initial design rather than retrofitting it after a denial like the April 1 Harrison.ai letter. They build the post-market quality and notification architecture for the supplier-customer cascade exposure the current environment is producing, with supplier-side quality agreements that price recall risk into the operating cost and downstream notification cadences that absorb the cascade without rewiring the gross margin trajectory.

At the operating level, the discipline shows up as a quarterly regulatory review that runs alongside the engineering, clinical, and commercial cadence with the same operating intensity. The review covers the submission timeline against actual reviewer continuity, the pathway plan against the most recent agency signal on PCCP and Q-Sub, the post-market quality architecture against the supplier-customer cascade exposure the current environment is producing, the operating cadence with the regulatory team and the agency, and the specific operating metrics the agency, the investor, and the strategic acquirer read against the participation profile the business is being engineered to land in. The three signals across the past six weeks show what it looks like when the regulatory operating plan has to keep up with the regulatory environment, and the founder operating plan that finishes well in regulated hardware in 2026 runs the regulatory operating work with the same operating discipline the rest of the company runs against.

The Five Questions for the Regulatory Operating Decision

The five-question framework in Founders Who Finish reframes what a credible regulatory operating plan actually requires the team to deliver in a medical device, diagnostics, or AI SaMD environment where the commissioner has just resigned, the AI device pathway has just been hardened in public, and the post-market exposure now travels through the supplier-customer graph faster than the pre-market evidence does.