The medtech industry is undergoing a structural shift. As hardware categories mature and face increasing price pressure, software is emerging as a critical avenue for differentiation, growth, and patient impact.
This shift is already visible in multiple forms. Software enables new recurring revenue models, from premium analytics layers to subscription-based services. It is embedding devices within broader clinical workflows, increasing customer stickiness, and improving outcomes. It is also unlocking new care models—such as remote monitoring and data-driven decision support—that extend value beyond the point of care.
At the same time, advances in AI are significantly improving software productivity.1 Across industries, organizations are seeing 30 to 70 percent gains in development efficiency. For medtech, this creates both an opportunity and an imperative to harness these gains while maintaining the highest standards of quality, safety, and regulatory compliance.
Importantly, value is not created by software alone but by integrating regulated software, including software as a medical device (SaMD), into broader digital ecosystems that support workflow integration, data aggregation, and recurring revenue models. In these models, SaMD provides the core clinical differentiation. For example, Medtronic’s GI Genius module uses real-time AI to improve polyp detection during colonoscopies.2 In surgery, Johnson & Johnson MedTech is pairing robotics and instrumentation with its Polyphonic digital ecosystem, which integrates surgical video, telepresence, workflow management, and AI-enabled insights across the operating room.3
Below, we dig into how companies can develop, deploy, and continuously improve high-quality software by rethinking their operating model—with a specific focus on their approach to quality assurance—and harnessing agentic AI to support scaling. Doing so has improved development efficiency and increased developer team capacity by 10 to 15 percent by reducing low-value work.
Why medtech organizations may struggle to develop SaMD
While software ambition is accelerating, the ability to deliver it—particularly regulated software—has not kept pace.
Unlike other industries, where agile operating models have transformed product development, software development in life sciences remains heavily anchored in phased approaches due to the established regulatory and quality standards required for product launches and updates. For any given software release, teams must navigate multiple quality phases requiring extensive testing, verification, and documentation. These processes can extend timelines by 20 to 30 percent, increase development costs, and erode business cases.
But the consequences of rushing quality checks are significant. Late-stage validation drives rework, delays, and inefficiencies. And the cost of errors is high, ranging from delayed launches to regulatory penalties and, most critically, risks to patient safety. Our experience suggests that, on average, organizations spend 7 to 10 percent of sales on quality-related activities.
Meanwhile, cybersecurity is becoming an increasingly important dimension of software quality. As connected devices, digital ecosystems, and AI-enabled capabilities expand where attacks can occur, medtech organizations must address cybersecurity requirements throughout the development life cycle—both to meet evolving regulatory expectations and to protect patient safety and maintain trust. Recent advances in AI-driven vulnerability discovery have further compressed the time between vulnerability identification and exploitation, increasing pressure on organizations to identify, remediate, and continuously monitor software risks.
While integrating SaMD with hardware enables more-frequent and faster product innovation and release cycles compared with hardware-driven innovation, it is also a major challenge for these organizations because product development timelines and development frameworks differ for software and hardware.
As software becomes central to value creation, the ability to deliver SaMD at speed—without compromising regulatory-grade quality—and successfully integrating it with hardware has become the defining capability gap in medtech.
At the same time, the medtech industry is facing a structural challenge in attracting and retaining digital, technology, and analytics talent. Compared with adjacent industries, medtech organizations are often perceived as less attractive, with a lower employee value proposition and a more limited availability of key technical skills, particularly in areas such as application development.
Modernizing the software development function can play a critical role in addressing this challenge. By improving engineering practices, reducing regulatory burden through better process design and automation, and implementing more-efficient ways of working, organizations can create an environment that enables engineers to focus on higher-value activities. Strengthening these core elements of the engineering experience will be essential to improving the industry’s ability to attract and retain the talent required for future growth.
An operating model for high-performing SaMD organizations
Leading medtech organizations are not addressing this challenge through isolated improvements. Instead, they are redesigning their operating models end to end to enable high-quality, rapid software delivery.
Across leading organizations, a consistent set of capabilities is emerging:
- Product and value orientation. Best-in-class teams define a clear product value proposition, often anchored in a structured product-strategy document that aligns stakeholders on the vision, value, and initial features of the product. They adopt a customer-first mindset; use rapid, iterative research to inform road maps; and task product owners with implementing and leading structured intake and prioritization processes.
- Agile delivery at scale. Leading organizations adopt incremental delivery models, with regular releases supported by comprehensive testing. Cross-functional “one team” models bring together commercial, marketing, R&D, IT, and quality teams, allowing them to make unified decisions. Adaptive planning allows teams to respond dynamically to evolving requirements while maintaining overall objectives.
- Enterprise integration and scalability. Leading organizations ensure company portfolio teams operate in a way that enables agile delivery. For example, they integrate software delivery with broader business functions through comprehensive launch planning and ensure the operating model, talent, supply chain, and operations are aligned.
- Continuous business case review. Unlike traditional medtech product development cycles, which may require several years of investment before commercial impact can be assessed, software enables more-frequent releases and shorter innovation cycles. High-performing organizations use these release cycles to continuously evaluate product performance, customer adoption, and business value, creating a tighter link among strategy decisions, financial planning, and R&D investment. Rather than committing funding years in advance, organizations are increasingly treating software development as a dynamic investment portfolio and allocating resources based on business case performance, customer feedback, and expected return on investment.
- Embedded quality and regulatory integration. Among these capabilities, this one stands out as the biggest differentiator because it’s critical—but very hard to get right. High-performing organizations embed regulatory design control requirements directly into agile development. Rather than treating quality as a downstream activity, they integrate it into day-to-day workflows, supported by tools and metrics that enable continuous delivery while maintaining compliance.
- AI-enabled development and quality. Leading organizations are beginning to embed AI across the development life cycle, augmenting teams with capabilities that accelerate documentation, testing, traceability, and risk analysis. These tools not only improve productivity but also enable a more consistent and scalable application of quality and regulatory requirements.
In the next two sections, we explore these final two capabilities in depth.
The key to transforming: Embedding quality assurance into software development earlier
At the heart of this operating model transformation is a fundamental shift in how quality is approached.
Traditionally, medtech development has relied on phase-based design control frameworks in which quality activities—such as verification, validation, and documentation—are concentrated in later stages of the life cycle. While effective for ensuring compliance, this approach is inherently misaligned with the iterative nature of software development.
Leading organizations are instead embedding quality, regulatory, and risk management activities into the earliest stages of the development life cycle. In practice, this means integrating quality into product definition, design, and development, with cross-functional teams bringing together design, quality, and engineering capabilities from the outset. These organizations embed quality requirements into agile constructs and link user stories to requirements with built-in traceability.
This shift is taking shape through a set of concrete, repeatable practices that integrate quality, regulatory, and cybersecurity requirements directly into development, including the following:
- embedding design controls into backlog refinement, ensuring regulatory and risk requirements are defined alongside functional requirements
- embedding cybersecurity reviews and threat modeling into backlog refinement and sprint execution, ensuring vulnerabilities are identified, prioritized, and remediated continuously rather than periodically through security reviews
- conducting continuous risk assessments within sprints rather than as separate, end-stage activities
- generating and updating documentation in parallel with development, reducing documentation burden at the end of the cycle
- automating traceability across requirements, risks, and test cases, enabling real-time visibility into gaps
- integrating quality reviews into sprint ceremonies, allowing issues to be identified and resolved earlier
- embedding self-validation and verification mechanisms within SaMD to manage quality dynamically across the product life cycle by, for example, defining clear rules for when software must be revalidated as its operating environment changes (such as updates to hardware, operating systems, or integrations) and establishing approaches to manage adaptive and self-learning SaMD, including partitioning systems into regulated (medical) and nonregulated components
This shift reduces rework, improves auditability, and aligns agile development with regulatory expectations. Organizations adopting this approach are seeing meaningful impact, including up to 50 percent reductions in low-value documentation effort, 10 to 15 percent increases in development capacity, and significant improvements in quality that is right the first time.
For example, a large medtech company accelerated technical quality inputs through a product operating model and high-performing teams. The R&D regulatory product portfolio piloted an approach to enhance how the quality organization and product squads interacted. The team identified five strategic shifts: streamlining testing procedures, reducing administrative tasks, removing redundant work, emphasizing automation and technology enablement of workflows, and investing in targeted upskilling. This transformation took place in a broader shift toward agile and a product-centric operating model, in which cross-functional teams own products end to end—from the definition of the road map to delivery and continuous improvement. As a result, the organization enhanced and implemented quality guidelines, reducing testing time by 50 percent; reduced redundant administrative tasks in the release process by 70 percent through new chart and workflow updates that are responsible, accountable, consulted, and informed; and automated steps in the change control process, cutting cycle time by 70 percent. This enabled quality specialists and delivery teams to focus more on strategic initiatives, including incorporating customer feedback, prioritizing product impact, and refining road maps.
In another example, a midsize medtech company deployed a comprehensive approach across people, processes, and tools to balance iterative development with strict requirements for patient safety, risk management, design control, certification, validation, and documentation. Product teams integrated design, quality, testing, and technology into a unified operating model. This operating model featured a core team—including a product owner, designers, design controls, and software developers and system engineers—that collaborated with commercial teams; they gathered frequently for demos and aligned on milestones and goals through quarterly business reviews. The organization adopted an incremental approach to agile across squads with defined phases for product release and document approvals and introduced an end-to-end sprint calendar, enhancing efficiency and compliance and improving productivity across teams.
In both cases, the organizations accelerated development by embedding quality earlier and more deeply into the development life cycle.
However, as software complexity increases and portfolios scale, embedding quality across every stage of development remains resource-intensive, creating the need for new approaches to scale.
Scaling new approaches to quality assurance with agentic AI
Even with the above approaches, many quality activities—such as traceability, documentation, and risk assessment—remain manual, time-consuming, and difficult to scale. But emerging agentic AI systems are beginning to reshape the equation.
Organizations should consider embedding an agile quality engine: a multi-agent system spanning the software development life cycle that augments product teams by automating repeatable, compliance-heavy tasks while preserving human oversight for critical decisions.
Each agent represents a distinct role aligned to core quality activities. For example, organizations might launch the following agents:
- A requirements translator agent converts user needs and product concepts into structured user stories and requirements, incorporating regulatory, risk, and design control considerations from the outset and supporting the product owner in defining a robust, implementation-ready backlog.
- A quality engineer agent generates the first drafts of technical and design documents based on code and requirements, supporting software engineers and design leads by significantly reducing documentation effort.
- A risk assessor agent identifies potential failure modes and patient safety risks based on user stories and specifications, supporting systems engineers in conducting cross-functional risk assessments.
- A traceability specialist agent maintains end-to-end links across requirements, risks, and test cases, enabling systems and quality engineers to proactively identify gaps and ensure continuous audit readiness.
Humans remain an essential part of the process. Automation provides scale and efficiency, and human experts ensure compliance, quality, and clinical safety. In this way, an agile quality engine enables organizations to embed quality assurance activities earlier at scale. When combined with thoughtful change management, this approach makes continuous, high-quality SaMD delivery achievable (see sidebar, “Supporting SaMD transformation through effective change management”).
To get started on their SaMD transformation, organizations should first get clarity on their growth and profit perspective as it relates to SaMD and define the scale and capabilities needed to be successful. From there, they can assess the maturity of their processes, capabilities, and tools to identify weaknesses. They can then select a pilot with high ROI to address these weaknesses, learning and refining the new processes before fully scaling. Last, they should establish a strategy for talent and geography, asking questions such as “What talent do we need?,” “Should we develop or acquire this talent?,” and “Where should we build?”
Organizations that move early will be best positioned to lead in a future where high-quality software, delivered at speed, defines the next generation of medtech innovation.
