For many research organisations, hospitals, and medtech startups, the regulatory landscape can feel like a maze of acronyms – ISO 9001, ISO 15189, ISO 13485, GLP, GCP, and more.
Everyone knows compliance is important, yet few teams feel confident about what they actually need at their current stage of development.
The result?
Organisations either over-engineer systems they don’t need, burning time and grant money, or, far more commonly — under-prepare, only realising too late that critical requirements were missed.
Regulatory readiness isn’t just about meeting a standard.
It’s about understanding which standard applies, when, and why. And building a practical roadmap to get there.
Demystifying the Standards: Which One, When?
Different teams have different regulatory obligations depending on the type of work they do, the maturity of their product, and how close they are to clinical or commercial deployment.
Here’s a simplified overview:
ISO 9001 – Quality Management (General)
Best for:
- Early-stage medtech startups
- Clinical labs building foundational systems
- Any organisation needing structured processes before committing to a sector-specific standard
ISO 9001 provides a broad, organisation-wide quality framework. It doesn’t dictate technical specifics, which is why it’s often the starting point for teams building foundational quality systems.
Think of it as the scaffolding for more specialised standards.
ISO 15189 – Medical Laboratories
Best for:
- Hospital pathology and diagnostic labs
- Clinical labs generating data used for patient care or regulatory submissions
- Diagnostic R&D groups moving toward accreditation
ISO 15189 emphasises medical laboratory competence, validation, traceability, and quality control. Clinical researchers often underestimate how early they need to align to these requirements, particularly when their data is feeding into a device submission or a clinical trial.
ISO 13485 – Medical Devices
Best for:
- Medtech startups
- Digital health companies
- Combination product developers
- Any team building a device that may be regulated
ISO 13485 is more prescriptive than ISO 9001 and demands rigorous documentation, risk management, design controls, supplier oversight, and post-market processes. If you’re building anything that could one day be a regulated device. Start aligning early, even if formal certification is still years away.
GLP – Good Laboratory Practice
Best for:
- Preclinical studies supporting a device or therapeutic submission
- Contract research organisations
- Any lab generating data intended for regulatory review
GLP ensures study integrity, traceability, and reproducibility. ISO and GLP are not mutually exclusive — they serve different purposes.
ISO = organisational quality
GLP = study quality
Understanding the distinction prevents wasted effort and misaligned expectations.
The Regulatory Pathway: Earlier Than You Think
Many startups think about the regulatory pathway, for example, the Therapeutic Goods Administration (TGA) only when their product is “ready.”
In reality, readiness starts far earlier — and the cost of starting late is significant.
A scenario that plays out more often than it should:
A medtech startup developing a Class IIa diagnostic device spends two years in product development. The team is technically strong, the device performs well in internal testing, and they’re ready to push toward an ARTG application. Then the regulatory review begins.
It turns out there’s no documented design history file. Risk management was never formally structured to ISO 14971. The clinical evidence assembled doesn’t meet TGA’s Essential Principles requirements. The software hasn’t been assessed against TGA’s SaMD guidance.
The result: 12 to 18 months of remediation work, recreating documentation that should have been generated during development, re-running validation activities, and commissioning a clinical evaluation that could have been planned from the start.
The TGA expects evidence of:
- Clear design and development processes
- Risk management (ISO 14971)
- Verification and validation
- Clinical evidence mapped to the Essential Principles
- Manufacturing controls
- Post-market obligations
None of these are things you can retrofit easily. A staged roadmap avoids this trap
Staged Adoption: Build Quality Without Overwhelm
Trying to become “fully compliant” overnight almost always fails.
The smarter approach is progressive adoption, matching quality maturity to organisational maturity.
Stage 1. Foundations
- Basic documentation
- Version control
- SOPs for critical processes
- Training records
- Internal accountability
This aligns with early ISO 9001 principles and lays the groundwork for later specialised requirements.
What this looks like in practice: A two-person medtech startup at TRL 3, still refining their proof-of-concept — doesn’t need a full ISO 13485-certified QMS yet. But they should already have a document register, version-controlled design files, a basic risk log, and a record of key decisions made during development. These aren’t bureaucratic overhead; they’re the evidence base that regulators will eventually ask for. Starting here costs almost nothing and saves considerable pain later.
Stage 2. Fit-for-Purpose Processes
- Risk management
- Change control
- Internal audits
- Clear roles and responsibilities
- Defined workflows
Ideal for startups approaching first-in-human use, clinical lab expansion, or pre-submission engagement with the regulators.
Stage 3. Regulatory Alignment
Depending on your sector:
- ISO 15189 validation pathways
- ISO 13485 design controls
- GLP compliance
- TGA pre-submission readiness
At this stage, quality becomes an enabler of commercial success, not a burden.
Common Pitfalls (and How to Avoid Them)
1. Not Knowing Which Standard Applies
Many organisations attempt to comply with the wrong standard or over-invest in areas irrelevant to their work.
Solution: Map regulatory obligations to your actual workflow, customers, and market pathway.
2. Starting Too Late
The reality for a lot of clinical and medtech innovation is that they delay quality system thinking and regulatory activity until they’re approaching a submission, a clinical study, or a partnership due diligence process. By then, the gaps are expensive to close.
A quality system built progressively alongside product development is far less costly than one built retrospectively under deadline pressure. Investors, hospital procurement teams, and regulatory bodies can all tell the difference.
Solution: Treat quality and regulatory as a development activity, not a submission activity.
3. Under-educating Staff
A system is only as strong as the people using it.
Solution: Provide practical, scenario-based training so staff understand why quality matters, not just what to do.
4. Ignoring Customer and Partner Expectations
Patinets, users, industry partners, and investors each expect different compliance levels.
Solution: Identify external stakeholder expectations early, and align accordingly.
Regulatory Readiness Begins With Understanding Your Journey
Compliance isn’t binary. It’s a continuing journey
Teams that thrive are not the ones who’s in it for the certifications but the ones that understand:
- Where they are now
- Where they are heading
- Which requirements matter
- What level of compliance their partners, customers, and investors expect
A well-planned quality roadmap protects funding, accelerates translation, enhances reproducibility, and builds trust with regulators and collaborators.
How ZTQ Helps
If any of this sounds familiar, the uncertainty about where to start, the creeping sense that your documentation isn’t where it needs to be, the question of which standard actually applies to you — that’s exactly what Zero to Quality is built to address. At ZTQ, we help medtech startups and clinical labs:
- Understand which standards apply to them at their current stage
- Build staged, right-sized quality systems
- Educate staff in practical, accessible ways
- Prepare for ISO and TGA requirements without over-engineering
- Turn ad hoc processes into structured, reliable, auditable systems
Final thought
Regulatory readiness isn’t about fear, paperwork, or checklists.
It’s about clarity, confidence, and capability. And ultimately, it’s about helping your science, and your organisation, reach its full potential.
