Which QMS do I need for my digital health startup?

At every event I attend, digital health founders ask me what compliance standards they need to get. They always know about privacy and security, but quality management is usually not on their radar.

QMS systems aren’t sexy, but they are essential for digital health companies (and mandatory for medical devices). So, choosing the right QMS is important for digital health companies.

The starting point is to define the primary purpose for your MVP and choose your launch market. With that information, the right quality management system follows suit.

In this guide I walk you through that decision, the standards that sit behind it, and the order in which a startup should build things, so you don't burn runway on paperwork too early or rewrite your design history too late.

TL;DR: which QMS does a digital health startup need?

• Is your software a medical device? This will determine whether you need a full QMS or not. If it’s just a fitness/wellness app, then no QMS is required by law.
• Is your medical device software being sold in the EU? You need a QMS under MDR Article 10(9). In practice that means ISO 13485:2016, supported by IEC 62304 (software lifecycle), ISO 14971 (risk management) and IEC 62366-1 (usability). From class IIa upwards it must be audited by a notified body.
• Are you selling Software as a Medical Device (SAMD) in the US? The FDA's Quality Management System Regulation (QMSR) took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. One QMS can serve both markets, with a few FDA-specific additions.
• Are you aiming for reimbursement as a DTx (e.g. DiGA in Germany)? You need a CE-marked software (ISO 13485 QMS), ISO 27001 ISMS and, in Germany, a BSI TR-03161 data security certificate.
• Does your device use AI? The AI Act's high-risk rules, including its own QMS requirement, apply to medical devices from 2 August 2028. Build them into the same QMS.
• Timing matters: start a lean QMS the day you decide to become a medical device, ideally before you write regulated code.

‍

What is a QMS, and when does a digital health startup need one?

A quality management system (QMS) is the documented set of processes that proves your product is designed, built, released and monitored in a controlled way. For a medical device, it covers design controls, risk management, document control, supplier management, corrective and preventive actions (CAPA) and post-market surveillance.

You need a QMS for the same reason your car manufacturer has one. You wouldn’t buy a car that had poor quality parts, bad safety, or where the manufacturer has to recall every single vehicle because they couldn’t trace one potential faulty part. Auto manufacturers have complex quality management systems that help ensure their cars are safe and reliable. Digital health software should be the same.

A QMS is not just a software tool. An eQMS platform is where your QMS lives, but the system is what matters. Buying a tool does not make you compliant, in the same way that buying a gym membership does not make you fit.

The trigger is your intended purpose, not your company size

Under the EU Medical Device Regulation (MDR), every manufacturer of a medical device must have a QMS, including class I. Whether your software is a medical device depends on both what it actually does and what you claim it does.

Under MDR classification Rule 11, software that provides information used to take diagnostic or therapeutic decisions is generally class IIa or higher. Software for other medical purposes is typically class I. Pure wellness software is not a medical device at all.

Two examples make the difference concrete:

• A meditation app that helps users relax: wellness app, so no QMS required.
• An app that analyses symptoms and recommends a treatment path: medical device software, so a QMS is mandatory and a notified body will audit it.

The same codebase can fall on either side depending on the claims in your marketing, your instructions for use and your investor deck. So decide your intended purpose explicitly, write it down, and make sure your marketing and pitch decks don’t go against this decision.

QMS vs ISMS: the confusion I often see

Many founders and CEOs think ISO 27001 doubles as a QMS. But the two standards answer different questions for different buyers.

You will usually need both. The good news: they share a common backbone (document control, internal audit, management review, supplier control), so you can run them as one integrated management system.

Which QMS do you need? A decision tree in four questions

Four questions decide your QMS: is it a medical device, which class, which markets, and does it use AI. Answer them in this order and you know exactly what to build.

1. Is your product a medical device? If not, you don't need a QMS by law. Focus on GDPR, a solid DPIA if you run studies or work B2B, and ISO 27001 once B2B customers start asking. Run a light quality process anyway: it makes any later switch to becoming a medical device cheaper and is good business practice generally.

2. Which risk class? Class I software can self-declare conformity, but you still need a valid QMS and technical documentation. Class IIa and above means a notified body audits your ISO 13485 QMS before you get a CE mark.

3. Which markets?

• EU: MDR plus ISO 13485:2016.
• US: the FDA's QMSR (21 CFR Part 820) now builds on ISO 13485:2016. An ISO 13485 certificate does not automatically mean QMSR compliance: the FDA keeps its own inspections and a few extra requirements. But you no longer need two separate systems.
• Germany (DiGA): a CE-marked device in class I, IIa or IIb, plus an ISO 27001 (or IT-Grundschutz) ISMS certificate and, since 1 January 2025, a BSI TR-03161 data security certificate.
• UK: plan for UKCA or CEN E recognition on the device side, and NHS DTAC and DSPT on the security side, where ISO 27001 helps a lot.

4. Does your device use AI? AI-enabled medical devices remain high-risk under the EU AI Act. After the Digital Omnibus (Regulation (EU) 2026/1744), those obligations apply from 2 August 2028. They include a QMS requirement of their own, plus data governance, so extend your ISO 13485 QMS rather than building a parallel one.

The standards stack: what each one does

ISO 13485 is the core, but it never travels alone. Here is the stack a typical software medical device startup works with, and when each piece applies.

One change to watch: IEC 62304 Edition 2 is in drafting. It widens the scope from "medical device software" to all "health software" and replaces the three safety classes with process rigour levels. Sources disagree on the publication date, so build to the current edition today and keep your software procedures modular enough to update.

Also keep an eye on the MDR revision the European Commission proposed on 16 December 2025. It could lower some software classes and simplify certificates, but it is still going through Parliament and Council. Until it is adopted, today's MDR rules apply in full.

When to build your QMS: a staged roadmap

The right moment to start a QMS is the day you commit to being a medical device, not the day you raise your Series A. Here is how I advise founders to stage it.

Stage 0 · Discovery and product-market fit. Define your intended purpose and regulatory strategy. Get GDPR basics right, and prepare a DPIA if you run a pilot or clinical study. No QMS yet, unless you already know you are a device.

Stage 1 · You decide to become a medical device. Set up a lean QMS: document control, design controls, risk management, an IEC 62304 software process, supplier control and CAPA. Pick an eQMS tool and appoint your person responsible for regulatory compliance (PRRC), which small companies can outsource.

Stage 2 · Build and clinical evaluation. Develop under the QMS so your design history file writes itself. Add usability, cybersecurity and clinical evaluation. If you sell B2B, this is usually when ISO 27001 enters the picture.

Stage 3 · Certification and market entry. Notified body audit for class IIa and above, then the CE mark. For DiGA, add the BSI TR-03161 certificate. For the US, prepare for FDA submission and QMSR inspection.

Stage 4 · Post-market and scale. Run post-market surveillance, vigilance, internal audits and management reviews. Merge QMS and ISMS into one integrated system, and add AI Act controls before 2 August 2028 if your device uses AI.

6 QMS mistakes I see digital health startups make

Most QMS pain comes from timing and from treating quality as paperwork. These are the patterns I see again and again.

1. Building it before you know what you are. A full ISO 13485 system before you have validated product-market fit is money spent on a product that may pivot. Decide your intended purpose first.
2. Building it too late. The opposite mistake is more expensive. Notified bodies want evidence that your software was developed under controlled processes. Reconstructing design history after the fact costs months.
3. Buying templates and calling it a QMS. Quality is about proper, detailed implementation. Auditors spot copy-paste procedures that nobody follows within the first hour.
4. Running two separate systems. A QMS and an ISMS with two document control processes, two internal audit cycles and two management reviews doubles the overhead for your CTO. Integrate them.
5. Confusing the tool with the system. An eQMS gives you control. It doesn't give you accountability. You still need someone who knows what good looks like.
6. Leaving data protection out of design. GDPR, DPIAs and, for AI, training-data governance belong in your design inputs and risk file, not in a separate legal folder.

What drives the cost

The most expensive part of any QMS is not the certificate. It's your own team's time at the beginning, and later the effort of keeping it aligned as you grow. So choose an approach that reduces your team's workload, keeps one system for all your frameworks, and gives you predictable costs. For ISO 27001, the price range is wide: from around €5,000 if you do most of the work yourself to €50,000 with a premium consultant and certification body.

The bottom line

The right QMS for your digital health startup follows from your intended purpose and your markets. Medical device in the EU or US: ISO 13485, with IEC 62304 and ISO 14971 behind it. Wellness selling B2B: ISO 27001 and GDPR first. DiGA: all of the above, plus BSI TR-03161.

Whatever your path, build one integrated system, at the right moment, and treat compliance as a tool for your business strategy rather than a box to tick.

Not sure which path is right? At Chino.io we have helped 200+ companies since 2018 pass audits and get reimbursed in Germany, the UK and France. Our platform and expert team cover GDPR, ISO 27001, NIS2, HIPAA and the AI Act, and we work alongside your QMS so data protection and security fit into one system. Book a free call with our team and we'll build your roadmap together.

‍