I shipped a health app without knowing it was regulated. Here are the tools I used to fix it

CT_NOOO — Fri, 24 Apr 2026 16:36:34 +0000

TL;DR: Most developers building health apps don't realise they might be building a regulated medical device. Here's how to check, and the tools that can help if you are.

A question worth asking early

I'm a former CTO of a medtech startup. The question that blindsided us - and that I see catch developers out constantly - is this:

"Is what we're building actually a medical device?"

Most developers assume the answer is no. Often they're wrong.

How to tell if your software is regulated

The category is called SaMD, Software as a Medical Device. It covers standalone software that performs a medical function without being part of a physical device.
The line is blurrier than you'd expect:

Is a mental health app a medical device? A mood journal or meditation app - probably not. An app that screens for depression, tracks symptoms to inform clinical decisions, or recommends treatment, almost certainly yes.
Is a fitness tracker a medical device? General step counting, no. Detecting arrhythmia or monitoring blood oxygen for clinical purposes, yes.
Is a symptom checker a medical device? Usually yes. If it influences what a user does next about their health, regulators treat that as a medical function.
Is a mental health chatbot a medical device? If it's therapeutic or diagnostic in intent, likely yes.
Is a hospital management app a medical device? Administrative software, no. Clinical decision support that affects patient care, the line blurs fast.

The rule of thumb: if your software influences a clinical decision, monitors a health condition, or assists in diagnosis or treatment: assume you're regulated until confirmed otherwise. This applies whether you're building for the EU, the US, or elsewhere.

Tools that actually help

The ecosystem has improved a lot. Here's what's worth knowing across the different compliance layers:

Getting started / qualification

OpenRegulatory's classification wizard — walks you through the EU MDR classification logic and produces a risk class. Free to use.
Greenlight Guru's EU MDR gap assessment — a free tool for teams who already know they're building a medical device and want to assess their compliance posture against EU MDR requirements.
QualiHQ's Is My App a Medical Device? — a free five-question checker that gives you a preliminary answer based on your software's intended use.

HIPAA compliance (US)
If you're handling protected health information, HIPAA is a parallel concern.

Google Workspace: Google signs a Business Associate Agreement, meaning there's a legitimate pathway to using Google Workspace as part of a HIPAA-compliant setup if configured correctly.
Compliancy Group (The Guard) — dedicated HIPAA compliance platform covering policy management, risk assessments, staff training, and incident management.

QMS platforms

Formwork (OpenRegulatory) — QMS with strong template coverage, AI Assistant in Paid Tiers. Relatively cheap but best for teams that already understand the regulatory framework.
Qualio — full-featured, built for teams with a dedicated QA function and budget to match. Strong if you have a regulatory/QA hire.
QualiHQ — Built for small-medium SaaS teams, free to start, no credit card required. AI generates documentation drafts based on your product, onboarding teaches the framework as you go, scoped to software compliance only.

Most regulated health app founders find out late, usually when they're close to launch or talking to their first healthcare customer (but definitely not afterwards ;)). Finding out early is cheaper in every sense.

If you're not sure whether your app is regulated, start with the classification wizard or the free checker above. If you are regulated, the tools listed here are what I'd reach for first. no three-month detour, no valuable consultant (read: expensive).

I'm sure there are other tools in this space I haven't covered. If you've been through this process and found something useful, drop it in the comments, would love to build out the list.

DEV Community: CT_NOOO

I shipped a health app without knowing it was regulated. Here are the tools I used to fix it

A question worth asking early

How to tell if your software is regulated

Tools that actually help