Start Here: Tell Us the story we should understand

• In one short paragraph, describe your product concept and the clinical problem it’s meant to solve.
• Which stage best describes where your project sits today? Options: Concept / idea, Prototype / lab demo, Alpha prototype, Beta / pilot, Clinical validation completed, FDA-submitted or cleared
• Who is the primary end user or patient population for this device? Options: Patients (home), Clinicians, Hospital / acute care, Wearable consumer, Clinical researchers, Other
• What evidence do you already have that this concept produces meaningful clinical or usability outcomes? Please list studies, sample sizes, and key signals.
• What is the single biggest business outcome you’re aiming for in the next 12–18 months? Options: Regulatory clearance, Manufacturability/scale, Clinical adoption, Raise funding, Partner for commercialization, Other

What’s the unspoken risk nobody at your table is willing to name?

• If you had to pick one thing that could derail the program, what is it and why?
• Have you attempted similar device projects before—did anything unexpectedly force a restart or scope creep? Options: Yes, one project, Yes, multiple projects, No, this is new territory, Not sure / mixed
• Who currently owns design control and quality artifacts, and how confident are you that those artifacts would survive a 510(k) or De Novo review? Options: We own and are confident, We own but have gaps, Partner owns them, No one owns them yet
• Tell us about a past surprise (technical, regulatory, or manufacturing) that changed timelines or budget—what happened and what did you learn?

Who really holds the keys — and who can say no?

• Which stakeholders will make or veto the final go/no-go at program milestones? List roles and their decision authority.
• Which functions must be aligned for a successful project (select all that apply)? Options: VP R&D, CTO, VP Engineering, Director Product, Head of Regulatory, Head of QA, CIO, Procurement, CEO, Other
• How do you prioritize competing decision criteria (safety/regulatory first, speed to market, cost, IP ownership, long-term scalability)? Rank or describe your tradeoff philosophy.
• When do you need a commercially viable product (timeline to market or milestone dates)? Options: <3 months, 3-6 months, 6-12 months, 12-18 months, >18 months
• What budget range have you provisioned (or are you expecting to allocate) for this phase? Options: <$250k, $250k-$1M, $1M-$5M, >$5M, TBD

If connectivity failed, what breaks first—and who notices?

• Which wireless or networking technologies are in your product vision or prototype? Options: Bluetooth Low Energy (BLE), Wi‑Fi, Cellular (LTE/5G), Proprietary RF, LoRaWAN, Other
• Where will the device need to reliably connect (home, clinic, hospital, rural clinics) and are there known RF challenges in those environments?
• What connectivity performance targets matter to you (select the most important)? Options: Uptime / availability %, Pairing success rate, Latency (ms), Throughput (kbps), Packet loss %, Other
• Do you require offline operation or buffered data upload? If so, for how long and under what constraints? Options: No offline needed, Buffer for minutes, Buffer for hours, Buffer for days, Other
• Have you had prior connectivity failures in studies or pilots? Describe what happened and any temporary workarounds you used.

What would a regulator never forgive in your submission?

• Which regulatory pathway do you expect to pursue? Options: 510(k), De Novo, PMA, CE (MDR), Not sure / need help
• Do you have a predicate device or identified comparable device? If yes, name it or explain gaps.
• Which standards and regulations are must-haves for you (select all that apply)? Options: 21 CFR Part 820 (QSR), ISO 13485, ISO 14971 (risk), IEC 62304 (software), IEC 60601, IEC 62366 (usability), HIPAA, Other
• What level of clinical evidence will the regulator and your customers expect (bench only, bench + usability, prospective clinical study)? Options: Bench only, Bench + usability, Retrospective clinical data, Prospective clinical study, Other
• Who will own regulatory submissions and post-market obligations—your team, ours, or a shared model? Options: Client owns submissions, Host (we) prepare and submit, Joint ownership, TBD

How safe does ‘secure’ need to feel to your customers (and to you at night)?

• Which cybersecurity frameworks or baselines do you expect to meet? Options: NIST CSF, NIST SP 800-53, IEC 62443, FDA cybersecurity guidance, OWASP, HITRUST, Other
• Have you completed a threat model or security risk assessment to date? Describe scope, findings, and remaining gaps.
• Are there technical requirements for encryption, PKI, or data residency we should know about? Options: AES-128/256, TLS 1.2+/mutual TLS, Hardware root of trust, Specific country data residency, No specific requirement, Other
• Who will be the incident response owner and what SLAs do you expect for detection and remediation?
• How tolerant are you of security tradeoffs vs time-to-market (select one)? Options: Security-first (no tradeoffs), Balanced, Speed-first (accept risk mitigations later)

Show me the success signals we’ll celebrate together

• What are the top 3 measurable outcomes that would make this program a success for your team?
• Which single metric is the non-negotiable primary KPI for launch? Options: Clinical endpoint result, 510(k)/De Novo clearance, Manufacturing yield, Connectivity SLA, User engagement / retention, Other
• What acceptance criteria should be documented for each deliverable (examples: pass/fail thresholds, sample sizes, test environments)?
• Who in your organization will sign off on verification, validation, and final acceptance? Options: Head of QA/RA, VP R&D/Engineering, Clinical lead, Product director, Procurement, Other
• How will you measure success in the market post-launch (select all that apply)? Options: Clinical adoption rates, User retention, Regulatory compliance without recalls, Low incident rate / field issues, Revenue / bookings, Other

Who needs to do the heavy lifting — and what are you expecting us to own?

• Which modules do you expect us to deliver or lead? Options: Hardware, Firmware, Wireless integration, Mobile app, Cloud backend, Verification & validation, Regulatory submission, Design history file, Manufacturing transfer
• Which capabilities will you retain in-house (select all that apply)? Options: System architecture, Clinical study execution, Regulatory sign-off, Manufacturing operations, Customer support, None — we need full support, Other
• Which collaboration model fits you best right now? Options: Full turnkey (we deliver end-to-end), Co-development (shared responsibilities), Staff augmentation, Advisory only, Other
• What are your expectations for IP ownership, licensing, and background IP? Options: Client retains all IP, Shared IP, Host retains background IP, client gets license, Negotiable
• Describe your expectations for manufacturing transfer—validation support, supplier qualifications, and handoff timeline. Options: We need full transfer and validation, We will handle transfer, Joint transfer plan, Not defined yet

If we had to start tomorrow, what would keep you awake at night?

• Select the top technical and program risks you feel are most likely to surface. Options: Firmware stability, Wireless reliability in clinical settings, Battery life, Sensor accuracy/drift, Cloud integration, Cybersecurity vulnerabilities, Manufacturability, Regulatory acceptance, Other
• What contingency or mitigation strategies do you already have or are willing to consider? Options: Budget reserve, Technical spike / prototype, Clinical bridging study, Alternate supplier, Extended verification window, Other
• How much schedule slack or budget contingency do you have for unforeseen issues? Options: None, Small (≤10%), Moderate (10–25%), Significant (>25%), TBD
• What internal blockers would prevent you from starting immediately (e.g., procurement, legal, executive signoff)? Options: Unclear regulatory pathway, Incomplete clinical data, Missing internal resources, Budget constraints, Manufacturing readiness, Connectivity reliability, Cybersecurity concerns, Other
• If a single quick win would reduce risk meaningfully, what would that win be?

What would make you choose us — and how will you know we delivered?

• What evaluation criteria will be most influential when you compare potential partners? Options: Design control rigor, Connectivity expertise, Regulatory track record, Cybersecurity capability, Manufacturing transfer experience, Cost, Speed, Cultural fit, Other
• Which proofs or artifacts would we need to present to build your confidence (select all that apply)? Options: Case studies, Regulatory submissions example (redacted), Reference customers, Technical deep-dive, Prototype/demo, Security assessment report, Other
• What kind of initial engagement would you prefer as a next step? Options: Technical kickoff workshop, RFP/RFQ, Statement of Work draft, Pilot engagement, Reference calls, Not ready yet
• Who should be on the invite list for a two-hour discovery workshop to align scope, risks, and next steps?
• What is the single most important outcome you want from our next meeting?

Quick Snapshot: Sum Up the Program in One Breath

• In one sentence, how would you describe the device, the clinical goal, and the top problem you want solved?
• Which stage best describes where you are today? Options: Concept / idea, Prototype (breadboard / alpha), Preclinical validation, Clinical data collected, Verification in progress, Submission ready
• Which regulatory pathway do you anticipate pursuing for market entry? Options: 510(k), De Novo, PMA, CE / MDR, Other / Unsure
• What is your target timeline to first commercial release? Options: < 6 months, 6–12 months, 12–18 months, 18–24 months, > 24 months
• Who are the core internal decision-makers we should plan to engage (names or roles)? Options: VP R&D, CTO, Head of Quality/Regulatory, Director Product, Head of Manufacturing, Other / multiple
• How confident do you feel about your current documentation and artifacts supporting a regulatory submission? Options: Very confident, Somewhat confident, Neutral, Somewhat unconfident, Not confident at all

If We Could Flip the Script, What's Broken Right Now?

• What is the single technical or process assumption you hope is false but worry may be true?
• Which of these surprise issues would most derail your timeline? Options: Untraceable design-control gaps, Unreliable connectivity in target environments, Undisclosed IP encumbrances, Firmware instability, Cybersecurity vulnerability, Supply chain or supplier failure
• When the team talks about ‘risks’, which one causes the most heated debate or finger-pointing? Options: Regulatory sufficiency, Clinical evidence gaps, Manufacturing feasibility, Cloud integration complexity, Firmware update safety, Other
• How long have you been tolerating this friction before deciding to seek outside help? Options: A few weeks, 1–3 months, 3–6 months, 6–12 months, >12 months
• Tell us about a recent technical surprise that cost time or money—what happened and how did it feel to the team?

Where Your IP, Clinical Data, and Artifacts Actually Live

• How are your design files, test data, and clinical datasets organized today? Options: Centralized DMS with version control, Multiple shared drives, Local engineer machines, LIMS / validated systems, Mixed / unsure
• If an auditor asked for the full trace from requirement to verification for a key feature, how quickly could you deliver it? Options: Within 24 hours, Within a week, Within a month, Would require reconstruction, Cannot deliver
• Which artifacts do you already have documented and current? Options: Requirements, Design outputs, Verification plans/results, Risk management (ISO 14971), Clinical reports, Supplier quality agreements
• Where are your clinical datasets stored and who controls access? Options: Secure cloud (controlled access), On-premise servers, Third-party CRO, Local files, Unsure
• Are there any IP, data use, or licensing constraints that would limit what we can access or reuse? Please describe.

The Technical Wildcards That Could Break It

• Which technical failure would cause you to stop the program today if it became real? Options: Wireless link fails in target setting, Firmware causes patient risk, Cybersecurity breach, Sensor performance drift, Manufacturing yield collapse, Data integration failure
• Which connectivity technologies are you planning to use or already have in prototypes? Options: Bluetooth Low Energy, Wi‑Fi, Cellular (NB‑IoT/LTE), Proprietary RF, Near‑field, Wired
• How mature is your firmware development process (unit tests, CI, OTA strategy)? Options: Mature (CI + tests + secure OTA), Moderate (some CI, limited OTA), Early (ad hoc builds), None / unstructured
• Have you performed adversarial cybersecurity testing or risk scoring? If yes, summarize results and open items. Options: Yes, pentest completed, Yes, gap assessment only, Planned but not started, No cybersecurity work yet
• Who owns mitigation for these top technical risks today (internal role or external partner)?

Design Control: Audit-Ready Story or Patchwork?

• If a regulator asked for your Design History File and risk file tomorrow, what would they find? Options: Complete and organized, Mostly there with gaps, Fragmented and incomplete, We are reconstructing
• Which design-control elements do you currently maintain with formal change control? Options: Design inputs/outputs, Design reviews, Verification/validation, Supplier controls, Master records/DHF, None
• How do you link clinical evidence to requirements and verification activities? Options: Requirement traceability matrix, Manual cross-references, Not linked, Planning to link
• Do you have a formal risk management file with identified mitigations and residual risk assessments? Options: Yes, up to date, Yes, needs update, In progress, No
• Describe any recent design changes that required re-verification and how they were handled.

Connectivity & Cybersecurity: Can Users Trust the Device?

• Which single connectivity failure mode worries clinicians or patients most in your use case? Options: Intermittent disconnects, Data loss during transfer, Unauthorized access, Bricked devices after OTA, Latency in clinical workflows
• How are device identities, authentication, and encryption currently implemented? Options: Strong PKI + mutual auth, Token-based auth, Pre-shared keys, Minimal/no auth, Unsure
• Do you have an OTA (over-the-air) firmware update mechanism that is secure and failsafe? Options: Yes, validated, Yes, prototype, Planned, No
• What telemetry or logging do you collect for post-market security monitoring and incident response? Options: Full audit logs, Limited telemetry, None, Planned
• Share any past security incidents or red-team results and the remediation actions taken.

Manufacturing Reality Check: From Bench to Line

• What is the biggest manufacturing unknown that keeps you from committing to a launch date?
• Which manufacturing model are you planning for first launch? Options: In-house production, CM/contract manufacturer, Hybrid, Pilot with CM then scale
• Do you have validated suppliers for critical components (sensors, radios, SoMs)? Options: All qualified, Some qualified, None qualified, Sourcing in progress
• How complete are your DFx/DFM reviews, assembly work instructions, and test fixturing plans? Options: Complete and verified, Drafted, Not started, Partially complete
• What acceptable first-article yield and unit cost targets have you set for commercialization?

Who Decides and Who Fixes It When Things Go Wrong?

• If a critical verification test fails one week before planned submission, who has final authority to delay, and who must fix it?
• Which responsibilities are already assigned to internal teams vs. external partners (engineering, firmware, cybersecurity, regulatory, manufacturing)? Options: All internal, Mostly internal, Mixed, Mostly external
• Do you have a documented RACI or escalation path for cross-functional decisions during development and submission? Options: Yes, clear RACI, Partial RACI, Informal/escalation list, None
• What budget and contingency have you allocated for unexpected rework during verification or supplier qualification? Options: >20% of project budget, 10–20%, 5–10%, <5%, None allocated
• How do you prefer to receive progress and risk reports—cadence and format (e.g., weekly dashboard, monthly review, ad hoc)? Options: Weekly dashboard, Biweekly review, Monthly steering, Ad hoc on major events

What Outcomes Are Non-Negotiable?

• Which single metric failing would make this project a difficult 'no' for leadership? Options: Clinical endpoint not met, Connectivity reliability below threshold, Manufacturing cost too high, Security posture unacceptable, Regulatory non-approvable
• List the measurable success signals you will use at verification, clinical, and launch milestones.
• Are there regulatory or market constraints (privacy laws, interoperability mandates) that are absolute non-negotiables? Options: HIPAA/PHI constraints, GDPR, Specific interoperability standard, Local regulatory requirement, None
• What user experience or clinical workflow requirement cannot be compromised even if it increases cost?
• How will you measure post‑market connectivity and security performance once deployed? Options: SLA uptime metrics, Security incident rate, Telemetry dashboards, Customer feedback, Not defined

One Small Experiment That Could De-Risk Everything

• If you could green-light one quick test or deliverable in the next 4 weeks that would either prove feasibility or surface deal-killers, what would it be?
• Would you be willing to provide access to prototypes, data, or a test environment to run that experiment? Options: Yes, full access, Yes, limited access, Needs approval, No
• What decision window (who decides and by when) would this experiment feed into? Options: Immediate (2 weeks), Near term (1 month), Quarterly review, On submission
• What would success look like from that experiment—specific pass/fail criteria we should target?
• Are there legal, IP, or compliance constraints we should clear before we start (NDAs, data agreements, export controls)? Options: NDA needed, Data sharing agreement, Supplier releases, Export/import controls, None

Quick Snapshot — Where We Stand Right Now

• In one sentence, what is the primary objective you need this deployment to prove (e.g., clinical pilot enrollment, factory pilot yield, full production release)? Options: Clinical pilot, Factory pilot, Limited market release, Full production release, Other
• Which milestone date are you targeting for the first live deployment or pilot? Options: Within 30 days, 30–90 days, 3–6 months, 6–12 months, TBD
• Who is the single point of contact we should coordinate with for deployment readiness (name and role)?
• What are the top three outcomes you need to validate in this deployment (please list in order of priority)?
• How confident do you feel about meeting the planned go/no‑go milestone today? Options: Very confident, Somewhat confident, Unsure, Not confident

If We Shipped Tomorrow, What Breaks First?

• If this product were released tomorrow, what would you expect to fail first and why?
• Which test environments do you currently have available to mimic production? Options: Bench lab / unit test rigs, System integration lab, Staging cloud environment, Clinical site environment, Manufacturing test line / pilot line, No dedicated test environment, Other
• For each environment you selected, how closely does it reproduce production conditions (network load, RF environment, edge cases)? Give specific gaps.
• What monitoring, alerting, and automated telemetry (if any) will run during early deployments? Options: Comprehensive telemetry with automated alerts, Basic logging with manual review, Ad‑hoc/manual checks, None yet
• Who will be on-call during pilots and what is your expected response SLA for critical incidents? Options: Internal engineering on-call, Dedicated deployment ops team, Third‑party support provider, No on-call plan yet

Design History File: Battle‑Ready or Paper‑Deep?

• Which DHF artifacts are complete and review‑ready today? Options: Design inputs, Design outputs, Risk management file (ISO 14971), Verification protocols & reports, Validation plans & reports, Traceability matrix, Supplier qualifications, Change control records, None/Not started
• Which specific verification or validation reports are missing or in draft and why?
• Have any substantive design changes occurred since the last verification cycle, and how were they recorded and risk‑assessed? Options: No substantive changes, Minor changes with records, Major changes requiring re‑verification, Changes not fully documented
• Roughly what percentage of your DHF is in a review‑ready state versus draft or missing? Options: <25%, 25–50%, 51–75%, 76–99%, 100%
• Are there open CAPAs, nonconformances, or supplier issues that could block deployment? Describe ownership and timelines.

Are Our Cyber Defenses Stopping a Real Attack — or Just Passing a Checklist?

• What completed cybersecurity activities give you confidence this product can be safely deployed? Options: Threat modeling, Architecture security review, Static code analysis, Dynamic analysis / pen testing, SBOM & vulnerability scans, Operational incident response plan, None yet
• Do you maintain an SBOM and what is the cadence/process for updating it? Options: Yes — automated updates, Yes — manual updates, Planned but not implemented, No SBOM
• Which authentication, encryption, or hardware security baselines must we meet for regulatory or customer acceptance? Options: TLS 1.2+ / HTTPS, FIPS / certified crypto, Hardware root of trust / secure element, OWASP mobile/web controls, Customer‑specific requirements, Unsure / need guidance
• What is your current incident response and vulnerability disclosure process (timelines for triage, patch, and communication)?
• How comfortable are you with your target remediation timeframes for a critical post‑deployment vulnerability? Options: <24 hours, 24–72 hours, Within a week, Longer / undefined

Who Will Run the Tests — and Do They Have Bandwidth?

• Do you have clearly assigned owners for verification, validation, cybersecurity testing, and factory acceptance with time allotted? Options: Owners with capacity, Owners assigned but limited capacity, Owners are external vendors, No owners assigned
• Which external labs, test houses, or CROs will you rely on for verification or clinical/field validation?
• What training or certification will factory and test‑line staff require before pilot runs?
• How will you measure that the testing team is ready (example acceptance criteria for personnel readiness)?
• Are there hiring, contracting, or vendor onboarding dependencies that could delay your schedule? Options: Yes — significant, Yes — minor, No, Unsure

Are Our Verification Plans Proving Outcomes — or Just Checking Boxes?

• Do your verification protocols exercise realistic environmental, electrical, and interoperability scenarios reflective of intended use? Options: Fully realistic, Partially realistic, Minimal realism, Not covered
• Which connectivity and interoperability scenarios must be validated (select all that apply)? Options: Bluetooth Low Energy, Wi‑Fi, Cellular (LTE/5G), Proprietary RF / gateways, Interoperability with specific EHRs or platforms, Other
• How will you validate connectivity reliability in noisy clinical settings (e.g., hospitals, ICUs) — lab emulation, field trials, or both? Options: Lab emulation, Field trials at clinical sites, Both, Not planned
• What are the pass/fail acceptance criteria for each core verification test (signal metrics, uptime targets, error thresholds)?
• Is contingency budgeted for rework if verification uncovers design deficiencies? Options: Yes — sufficient contingency, Yes — limited, No contingency budgeted, Unsure

Is the Factory Prepared to Accept Our Design Without Rework?

• Which factory prerequisites are already in place for a pilot transfer? Options: Qualified suppliers, Production test fixtures, Process work instructions, Calibration & metrology, Quality plan & FAI, None of the above
• Are there long‑lead or single‑source components that could bottleneck the pilot run? List them and estimated lead times.
• What is your expected first‑pass yield and the maximum acceptable scrap rate during pilot production?
• How will first article inspection (FAI) results be fed back into the DHF and change control process?
• Who owns manufacturing transfer and what prior similar transfers have they led?

If Regulators Asked for Proof Today, Could You Deliver It?

• What regulatory pathway are you pursuing for market entry? Options: 510(k), De Novo, PMA, CE / MDR, Other / multiple regions, Unsure
• Which submission documents are finalized and which still need work (select all that apply)? Options: Device description & labeling, Clinical evidence / study reports, Risk management file, Software documentation & SRS, Cybersecurity documentation, Manufacturing information, None finalized
• Are any regulatory approvals contingent on data that will be produced during this deployment (and if so, which datasets)? Options: Yes — deployment data required, No, Partially, Unsure
• Who will be the regulatory point of contact for submissions and agency interactions? Options: Internal RA/QA lead, External regulatory consultant, Combined internal & external, Not assigned
• If deployment data is required, what statistical or performance thresholds must be met for acceptance?

What's the Single Biggest Risk That Keeps You Up at Night?

• Name the one deployment risk that, if realized, would have the largest business or patient‑safety impact.
• On a scale of 1–5, how severe would the impact be if that risk occurred? Options: 1 — Minimal, 2, 3 — Moderate, 4, 5 — Catastrophic
• What specific mitigation steps are in place right now to reduce the likelihood or impact of that risk?
• What is your rollback, containment, or emergency stop plan if pilot testing uncovers a critical failure?
• Who has the authority to halt deployment and what is the escalation path? Options: VP/Head of Engineering, Head of QA/RA, Cross‑functional governance board, Other

When Do We Call It Ready — And What Happens Next?

• If we miss the upcoming go/no‑go, what is the worst‑case business consequence (revenue, regulatory, clinical timelines)?
• What are the unmovable external dependencies (customers, trials, regulatory windows, supplier lead times) that set an absolute latest date?
• What specific, measurable criteria will you use to declare the deployment a success and proceed to design transfer or submission?
• Who will own the decision to accept results and sign off on design transfer, and how will that governance be documented?
• What immediate next steps and owners should we commit to after this discovery (5 key actions with owners and target dates)?

Start Here: A Simple Snapshot of Your Program

• In one sentence, how would you describe the product you’re developing and the problem it solves?
• What is your current program stage? Options: Concept / feasibility, Prototype / bench testing, Pilot / clinical validation, Pre-submission / regulatory prep, Design freeze / transfer to manufacturing
• Who in your organization is the primary champion for this program (title/role)? Options: VP R&D, Director Product Development, CTO, Head of Regulatory, Head of Manufacturing, Other
• Roughly, what target launch window are you aiming for? Options: <6 months, 6–12 months, 12–18 months, 18–24 months, >24 months
• What budget range have you allocated (or expect to allocate) for full development through submission and transfer? Options: <$500k, $500k–$1M, $1M–$3M, $3M–$7M, >$7M, Undecided

If This Keeps Going the Same, What Breaks First?

• What single failure — regulatory, technical, or commercial — would be most damaging if nothing changes? Options: 510(k)/De Novo rejection, Major cybersecurity finding, Unreliable connectivity in clinical settings, Manufacturing transfer failure, Clinical endpoint not met, Other
• How likely do you think that failure is on your current path? Options: Very likely, Somewhat likely, Uncertain, Unlikely, Very unlikely
• When that risk shows up, how does it typically impact the team—timeline slips, budget overruns, loss of confidence, or something else? Options: Timeline slips, Budget overruns, Loss of stakeholder confidence, Technical debt accumulation, Other
• Tell us about a recent near-miss or setback that felt like a warning sign—what happened and why did it matter?
• Who on your team currently feels the most pressure about these risks (role or persona)? Options: VP R&D, Product Manager, Firmware Lead, Regulatory Lead, Quality/RA, Head of Ops, Other

Who Holds the Keys — And Who’s Not in the Room?

• If we had to escalate a single decision this week, who would make the final call and why? Options: VP R&D, CTO, CEO, Head of Regulatory, Cross-functional committee
• Which stakeholders must be aligned before you can commit to a supplier or roadmap? Options: Engineering, Quality/RA, Clinical, Operations/Manufacturing, Procurement, Legal/Contracts
• How do you typically resolve conflicts between engineering speed and regulatory completeness? Options: Engineering leads with mitigation plan, Regulatory sets minimums, Balanced governance committee, We haven’t solved this yet, Other
• Who is responsible for maintaining the Design History File (DHF) in your current org? Options: Engineering, Quality/RA, Dedicated DHF manager, Combination / shared, Not assigned
• Is there anyone crucial to approval or sign-off who isn’t engaged yet? If so, who and what would it take to bring them in?

What’s Already Solid — And What’s Alarmingly Thin?

• Which element of your technical dossier would an FDA reviewer or notified body likely praise—and which would they scrutinize first?
• Which of the following artifacts do you have in a near-complete state today? Options: Risk management file (ISO 14971), Design verification plan & reports, Clinical evidence package, Cybersecurity plan and threat model, Firmware baseline & source control, Manufacturing process documentation
• How complete is your clinical evidence relative to the claims you want to make? Options: Well beyond what's needed, Sufficient for narrow claims, Insufficient—more data needed, No clinical data yet
• Describe any IP or third‑party components with licensing or export constraints that could affect timelines.
• Which top technical risks do you believe are highest priority to resolve now? Options: Wireless reliability in clinical environments, Firmware stability/OTA safety, Battery/life concerns, Signal quality/sensor accuracy, Cloud integration and data schema, Cybersecurity vulnerabilities

What’s Getting in the Way of Your Ideal Outcome?

• What hidden assumptions are you making about clinical workflows, connectivity, or regulatory acceptance that could be wrong?
• How often do integration problems between hardware, app, and cloud cause rework in your sprints? Options: Almost every sprint, Often, Occasionally, Rarely, Never
• When a cross-domain problem appears (e.g., firmware + cloud), what is your go-to fix and how well has it worked?
• How confident are you that current cybersecurity controls will pass a pre-market assessment or audit? Options: Very confident, Somewhat confident, Unsure, Not confident
• What keeps your team from baking manufacturability into design earlier—time pressure, expertise, cost, or something else? Options: Time pressure, Lack of manufacturing expertise, Budget constraints, Underestimating complexity, Other

If Launch Felt Like a Win, What Would People Be Saying?

• Imagine launch day praise from clinicians, regulators, and manufacturing—what measurable outcomes are they celebrating?
• Which of these metrics would you use to prove product-market fit in the first 6 months? Options: Clinical adoption rate, Device uptime/connectivity %, Reduction in clinical workflow time, Patient adherence/engagement, Regulatory clearance without major conditions
• What clinical endpoints or performance thresholds are non-negotiable for your claims?
• What level of wireless reliability (e.g., packet loss, reconnection time) do you require in your target clinical settings? Options: >99.9% uptime, 99%–99.9%, 95%–99%, <95%, Unknown / need guidance
• Which post-market support expectations do you want to commit to at launch (SLA, updates cadence, incident response)? Options: 24/7 incident response, Business hours support, Quarterly updates, Ad-hoc patches, Not decided

Where Integration Actually Breaks Down (Tell the Story)

• What recurring integration failure steals time—data mismatch, auth/session bugs, API version drift, or something else? Options: Data schema mismatches, Authentication/session failures, API version incompatibility, Timing/latency issues, OTA update conflicts, Other
• Who owns end-to-end verification from device sensor to cloud analytics in your organization? Options: Firmware team, Cloud team, Systems engineering, Verification & Validation (V&V), No single owner
• How often do you simulate real clinical environments (Wi‑Fi, interference, multi-patient load) during verification? Options: Regularly (planned tests), Occasionally, Rarely, Never
• Describe a time when an integration defect reached clinical validation—what was the root cause and consequence?
• Which integration checkpoints would you be willing to add now to avoid late-stage surprises? Options: Early end-to-end smoke tests, Incremental cloud mocks, HIL (hardware-in-loop) testing, Clinical environment pilots, Automated regression on CI

Regulatory & Cybersecurity: What Keeps You Up at Night?

• If an auditor arrived tomorrow, which document or control would you be most worried is insufficient? Options: Design history file completeness, Risk management evidence, Cybersecurity threat model, Verification traceability matrix, Supplier quality agreements
• Which regulatory pathway are you pursuing or expecting to pursue? Options: 510(k), De Novo, PMA, EU MDR, CE via equivalence, Undecided / need guidance
• Have you had formal pre-submission interactions with FDA or a notified body? If yes, summarize outcomes. Options: Yes—positive alignment, Yes—open questions remain, No interactions yet
• What cybersecurity evidence do you already have (select all that apply)? Options: Threat model, Penetration test reports, Software bill of materials (SBOM), Secure development lifecycle docs, None
• How would you feel about an independent red‑team assessment before submission—helpful, risky, or neutral? Options: Very helpful, Somewhat helpful, Unsure, Risky / not ready

When It’s Time to Hand Off to Manufacturing, What Will Break?

• What’s the most likely reason a factory pilot would fail for your product? Options: Unstable BOM or parts shortages, Unclear test fixtures/acceptance criteria, Assembly complexity, Firmware-installation issues, Labeling/packaging non-compliance
• How mature is your Bill of Materials (BOM) and have you validated alternate suppliers? Options: Mature with alternates, Mature but single-source, Partial BOM, BOM immature
• Do you have manufacturing acceptance tests defined (ICT/functional/clinical release criteria)? Options: Fully defined and approved, Partially defined, Drafts exist, None defined
• What constraints (packaging, sterilization, cold chain) will the factory need to solve that are unusual?
• How comfortable are you with transferring regulatory submission ownership to a contract manufacturer or partner? Options: Comfortable, Willing with oversight, Prefer to retain ownership, Undecided

Trade‑Offs We Might Need to Make (Decide What Matters)

• What single trade-off would you accept to hit your target date (e.g., narrower claims, reduced feature set, extended post-market study)?
• Rank these priorities for the program right now. Options: Time-to-market, Regulatory robustness, Cost efficiency, Feature completeness, Cybersecurity maturity, Manufacturability
• Which features are absolutely non-negotiable for initial release?
• If delays occur, where are you willing to accept phased delivery (e.g., core device first, advanced cloud analytics later)? Options: Yes—phased delivery OK, Prefer all-at-once, Depends on feature
• How will success or failure on this trade-off affect future funding or leadership support?

If We Could De‑Risk the Next 30 Days, What Would That Look Like?

• If you could pick two concrete actions for the next 30 days that would most reduce program risk, what would they be?
• How ready are you to commit to a governance cadence (weekly sprint reviews, monthly steering committee)? Options: Ready now, Need internal alignment, Prefer ad-hoc, Unsure
• Which deliverables would you want from a partner in the first 30 days (audit of artifacts, threat model, verification plan, manufacturing checklist)? Options: Artifact audit, Threat model & mitigation plan, Verification & validation plan, Manufacturing readiness checklist, Regulatory gap analysis
• Who should be on the immediate cross-functional team we’d engage with (names and roles)?
• What would success look like at the 30-day check-in—specific outcomes we can objectively evaluate?