Getting your medical device approved shouldn’t take years of trial and error

I help early-stage MedTech founders get a clear EU MDR, UKCA and/or FDA regulatory strategy in just 30 days so they can move forward with confidence, reduce delays and get to market faster

The problem:
Many founders are unsure which pathway applies, what documents are required or how to avoid months of regulatory back-and-forth. Without a clear plan, they risk burning runway, missing opportunities and losing investor confidence

How I help:

- Map the exact regulatory pathway (CE, UKCA, 510(k), De Novo, PMA)
- Define intended use & classification to align with regulators
- Build a step-by-step submission readiness plan
- Provide hands-on support for technical documentation, QMS & audits
- Guide devices including SaMD, AI/ML, hardware and IVDs through IEC 62304, IEC 82304, applicable ISO standards and emerging AI frameworks

Full capabilities:

Regulatory consulting: CE marking under MDR/IVDR, UKCA certification, FDA pathways (510(k), De Novo, PMA). PRRC & UKRP services. Gap assessments, submission support & strategic planning

Quality assurance: Implement & remediate QMS to ISO 13485 & MDSAP. Lead audits, manage CAPAs & complaints, support risk management (ISO 14971), process validation (IQ, OQ, PQ) & sterilisation (ISO 11607). Certified ISO 13485 Lead Auditor (CQI/IRCA)

Digital health / SaMD: Compliance with IEC 62304, IEC 82304 & AI/ML frameworks. Software validation & CSV for regulatory alignment

eQMS platforms: Implement Greenlight Guru, Qualio, MasterControl, JIRA & Confluence, with CSV to ensure audit readiness

Due diligence: Regulatory & QMS assessments for investors, accelerators & M&A. Identify red flags in technical documentation & submissions before they become costly

Training & microconsulting: For teams & founders building internal capability. CQI/IRCA-registered tutor for MDR, IVDR, ISO 13485, ISO 14971 & MDSAP

I’m a startup advisor and competition judge for MedTech Innovator, Springboard Enterprises and MassChallenge. As a trainer and host of The MedTech Podcast, I work with founders, investors and accelerators worldwide to deliver regulatory clarity and practical strategies

I combine regulatory expertise with a practical, execution-focused mindset. Clients value my ability to cut through complexity, reduce time to market, pass audits and scale confidently, whether launching a first product or expanding internationally

If you’re navigating regulatory uncertainty or preparing for growth, let’s connect

🎙️ The MedTech Podcast | 📺 YouTube: @KarandeepBadwal

Karandeep Badwal

KHERA CONSULTANTS LIMITED

Chairman

With over 25 years of experience in research and development, I have successfully led development teams while contributing to the architecture, design, and implementation of Medical Devices and Systems, including Digital Health and Software as a Medical Device (SaMD).

Throughout my career, I have gained comprehensive knowledge of the entire product development lifecycle, from initial concept to mass production. I am well-versed in various regulatory standards, such as IEC 82304, IEC 62304, ISO 14971, IEC 62366, IEC/TR 80002-1:2009, IEC 60730, AAMI TIR45, AAMI TIR57, UL 2900-1, UL 2900-2-1, AAMI/UL 2800-1, AAMI/UL 2800-1-1, AAMI/UL 2800-1-2, AAMI/UL 2800-1-3, IEEE Standard Part 40101, IEEE Standard Part 40102, MDCG 2019-11, IMDRF - "Software as a Medical Device," MHRA guidance document "Medical device stand-alone software including apps", ETSI EN 303 645, and ISO/IEC 27001.

I have honed my expertise in the following areas:

- Full-cycle development of Medical Devices and Systems, including software and hardware, from ideation to Regulatory Submission and approval.

- Risk Management for Medical Devices and Systems.

- Cybersecurity for Medical Devices and Systems, including Consumer Product Cybersecurity.

- Software Risk Management for Medical Devices and Systems.

- Effective management, leadership, and mentorship of engineers.

My research interests encompass Image Recognition, Digital Signal Processing, Computer Graphics, and Neural Networks (NN).

I am a skilled communicator, both verbally and in written form, and I possess a natural aptitude for learning new skills. I am eager to expand my knowledge and willingly share my expertise with others.

Qserve Group

Regulatory Standards: IEC 62304, ISO 14971, IEC/TR 80002-1:2009, AAMI TIR57, AAMI TIR97, UL 2900-1, UL 2900-2-1, MDCG 2019-11, IEC TR 60601-4-5, IEC 81001-5-1, AAMI/UL 2800-1, AAMI/UL 2800-1-1, AAMI/UL 2800-1-2, AAMI/UL 2800-1-3.

Working on a connected medical device with the primary focus on Cybersecurity and Interoperability. The activities included training on cybersecurity and interoperability, threat modelling,  threat scoring, and mitigations.

A plan and a final report were produced for  Cybersecurity Risk Management activities which follow the process described in TIR57. In addition, post-market activities were defined, which follow the process described in TIR97, as well as monitoring databases for new vulnerability discoveries. Finally, interoperability requirements as per FDA guidance and the UL2800 standards were considered and acted upon resulting in appropriate implementation and documentation.

Other activities undertaken were:
- Risk Management
- Software Risk Management

FDA 510(k) approval was granted.

Senior Consultant

Genentech

Regulatory Standards: IEC 82304, IEC 62304, AAMI TIR57, AAMI TIR97, UL 2900-1, UL 2900-2-1, IEEE 11073-40102, IEEE 11073-40101, MDCG 2019-11, IMDRF - “Software as a Medical Device", MHRA guidance document “Medical device stand-alone software including apps”, ISO/IEC 27001.

Personalised Healthcare.

ISO27001 Certification including internal and external audits.
FDA Master Files for Devices (MAFs).
UK – Privacy Requirements for Medical Devices and Systems.
EU – Privacy Requirements for Medical Devices and Systems.

Analysis of new and DRAFT standards/regulatory guidances  including:

1.	FDA “ DRAFT Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions”.
2.	FDA/Mitre “Rubric for Applying CVSS to Medical Devices” which is used to score the severity of medical device vulnerabilities. 
3.	UK - MHRA new and DRAFT guidances since Brexit.
4.	International Requirements for Cybersecurity.

Product developments for which the following activities were undertaken:

- Sub-contractor management (contract negotiation, audit, etc.)
- Cybersecurity – end-to-end solution consisting of an embedded device, Mobile App, Roche Cloud, and Third-Party Cloud
- Software Risk Management
- Regulatory
- Development processes
- Hardware including a custom NFC tag
- Software 
- Production
….

F. Hoffmann-La Roche Ltd

Regulatory Standards: IEC 82304, IEC 62304, AAMI TIR57, AAMI TIR97, UL 2900-1, UL 2900-2-1, IEEE 11073-40102, IEEE 11073-40101, MDCG 2019-11, IMDRF - “Software as a Medical Device", MHRA guidance document “Medical device stand-alone software including apps”.

Smart Devices.
Medical Device Classification and Medical Software Classification.
Sustainability.
Life Cycle Assessment (LCA).

Cybersecurity for Medical Devices: 
 1. SOP for Cybersecurity.
 2. Threat Modelling.
 3.  Threat Scoring.

DIS - CREADIS Engineering Solutions & Consulting

Cybersecurity for Medical Devices- end client Sivantos Group.

•	Gap Analysis by considering the following regulatory standards: IEC 62304, AAMI TIR57, TIR97, UL 2900-1, UL 2900-2-1, IEEE 11073-40102, IEEE 11073-40101, MDCG 2019-11, Australia- Medical device cyber security guidance for industry, Brazil- Cybersecurity principles and practices in medical devices Guide No. 38/2020, Canada- Pre‐market Requirements for Medical Device Cybersecurity, China- Medical device cybersecurity technical review guidelines, Japan- Guidance on ensuring cybersecurity for medical devices.

•	Cybersecurity Risk Analysis and Management process definition for satisfying the identified markets.
•	Threat Modelling process definition.
•	Reviewing and recommending Threat Scoring method for satisfying identified markets.
•	Applying Threat Modelling and scoring with the internal team to an actual project.
•	Training internal team on Cybersecurity for Medical Devices.

Cambridge Design Partnership

Keywords: Medical Device, Risk Management, Cybersecurity Management
Regulatory Standards: IEC 62304, ISO 14971, AAMI TIR57, AAMI TIR36, UL 2900-1, UL2900-2-1

•	Risk Analysis and Management.
•	Cybersecurity Risk Analysis and Management.

Produced Standard Operating Procedures, Work Instructions and Templates for Medical Devices including:
•	Software Development
•	Cybersecurity
•	Software Configuration Management Plan Template
•	Security Risk Assessment Report Template
•	Software Defect Management
•	Validation of software for regulated processes
….

BrightInsight

Keywords: Digital Health, SaMD, Risk Management, Cybersecurity, Platform, Mobile Apps.
Regulatory Standards: IEC 82304, IEC 62304, ISO 14971, AAMI TIR45, AAMI TIR57, IEC 62366, UL 2900-1, UL 2900-2-1, ISO 13485

BrightInsight provides a regulated IoT Platform that enables companies to accelerate their entry into the fast-growing Digital Health market. Working on Multiple SaMD Projects with system-level responsibility for end-to-end IoT solution including embedded devices(sensors, drug delivery devices), wireless comms, the cloud services built on top of the IoT Platform, and mobile applications. 

Activities performed include:
•	System Risk Analysis and Management.
•	Cybersecurity Risk Analysis and Management.

Technical Lead

Team Consulting Limited

Keywords: Software:  C, stm32f7xx(Cortex-M7), IEC 62304, AAMI TIR45, ISO 14971, IEC/TR 80002-1:2009,  IEC 60730, Cybersecurity, Secure Access Module(SAM), Encryption/Decryption, Digital Signing,
SHA-256, Bootloader, Firmware Upgrade (OTA and USB).
Packages: ThreadX, IAR Workbench, Jira, Git.

Technical Lead for a novel wireless networked medical device(which will meet stringent FDA cybersecurity requirements)  with the primary responsibility of managing the technical aspects of firmware development. 

Specific duties include setting up the required teams, defining the architecture, providing technical expertise and working closely with the firmware development team to ensure that the developed product meets contractual and regulatory requirements. 

In addition, hardware-related issues fall within the remit of the job as well as liaising with the client and sub-contractors.

The first batch of the final approved device has been shipped.

Completed IEC62304 activities include:

1.	Software Risk Analysis and Management (ISO 14971, IEC/TR 80002-1:2009)

2.	SOUP Evaluations.

3.	Review of System-Level Risk Analysis and Management (ISO 14971) including identifying additional risks and mitigations.

4.	Review of Hardware Risk Analysis and Management (ISO 14971).

5.	System Architecture Documentation.

6. Software Requirements Specification.

Keywords: Software: C, stm32f7xx(Cortex-M7), IEC 62304, ISO 14971, IEC/TR 80002-1:2009, IEC 60730, Cybersecurity, Secure Access Module(SAM), Encryption/Decryption, Digital Signing,
  SHA-256, Bootloader, Firmware Upgrade (OTA and USB).
Packages: ThreadX, IAR Workbench, Jira, Git.

Working on a novel wireless networked medical device which will meet stringent cyber security requirements.

The following activities or tasks have been carried out:

1.	Analyse the PRS and write the SRS with consideration of all aspects of medical device security with emphasis on:

a.	FDA cybersecurity guidance.

b.	UL 2900-1 Outline of Investigation for Software Cybersecurity for Network-Connectable Products, Part 1: General Requirements.

c.	UL 2900-2-1 Outline of Investigation for Software Cybersecurity for Network-Connectable Products, Part 2-1: Particular Requirements for Network Connectable Components of Healthcare Systems.

2.	Analyse and write the specification for a secure - firmware upgrade, bootloader and filesystem.

3.	Design and implementation of the network threads including message encoding/decoding, authentication, processing and device drivers.

4. Analysis and design of the inter-task messages. 

5. Designed and implemented the control thread for the device which allowed the meeting of a milestone.

6. NFC Security analysis and evaluation for satisfying UL-2900

7. NFC and Firmware Upgrade security using a SAM.

University of Bradford

Electronics and Electrical Engineering.

Research in Image Recognition, Digital Signal Processing, Computer Graphics and Neural Networks (NN). 

Deep Learning is a subset of NN and generally refers to an implementation which has more than 3 layers in the NN. So called Machine Learning (ML) is a superset of NN and in turn is a subset of Artificial Intelligence (AI).

Lecturer

With over 25 years of experience in research and development, I have successfully led development teams while contributing to the architecture, design, and implementation of Medical Devices and Systems, including Digital Health and Software as a Medical Device (SaMD).

Throughout my career, I have gained comprehensive knowledge of the entire product development lifecycle, from initial concept to mass production. I am well-versed in various regulatory standards, such as IEC 82304, IEC 62304, ISO 14971, IEC 62366, IEC/TR 80002-1:2009, IEC 60730, AAMI TIR45, ANSI/AAMI SW96, AAMI TIR57, AAMI TIR97, UL 2900-1, UL 2900-2-1, AAMI/UL 2800-1, AAMI/UL 2800-1-1, AAMI/UL 2800-1-2, AAMI/UL 2800-1-3, IEC 81001-5-1, IEEE Standard Part 40101, IEEE Standard Part 40102, MDCG 2019-11, IMDRF - "Software as a Medical Device," MHRA guidance document "Medical device stand-alone software including apps", ETSI EN 303 645, and ISO/IEC 27001.

I have honed my expertise in the following areas:

- Full-cycle development of Medical Devices and Systems, including software and hardware, from ideation to Regulatory Submission and approval.

- Risk Management for Medical Devices and Systems.

- Cybersecurity for Medical Devices and Systems, including Consumer Product Cybersecurity.

- Software Risk Management for Medical Devices and Systems.

- Effective management, leadership, and mentorship of engineers.

My research interests encompass Image Recognition, Digital Signal Processing, Computer Graphics, and Neural Networks (NN).

I am a skilled communicator, both verbally and in written form, and I possess a natural aptitude for learning new skills. I am eager to expand my knowledge and willingly share my expertise with others.

taplio

The Battle

Karandeep Badwal

Dr. Bulla Singh

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?