MEDTECH
Engineering a medical device with compliance built in, not bolted on
MedTech — Wearable Drug-Delivery Devices. Product definition & architecture advisory, telemetry-driven engineering, medical device compliance readiness (ISO 13485 / IEC 62304 / ISO 14971), application security & VAPT, and IoT platform enablement.
BUSINESS REQUIREMENT
What the client needed
Our client — a medtech innovator developing a body-worn drug-delivery device for chronic therapy — faced the challenge every hardware startup in this space eventually hits: building a device that works is only half the problem. Building one that can enter in-human clinical trials means design controls, risk files, firmware lifecycle discipline, electrical safety and EMC certification, biocompatibility evidence, and security assurance — a regulatory architecture most young engineering teams encounter for the first time when it's already too late to design for it.
WHAT WE FOUND
Findings on the ground
- Working device ≠ clinical-trial device: Building a device that works is only half the problem. Entering in-human clinical trials means design controls, risk files, firmware lifecycle discipline, electrical safety and EMC certification, biocompatibility evidence, and security assurance.
- Regulatory architecture arrived too late: Most young engineering teams encounter this regulatory architecture for the first time when it's already too late to design for it.
- Prototype-then-restart failure mode: The typical failure mode is well known: prototype fast, then discover that nothing built so far is traceable, verifiable, or admissible as clinical evidence — and start over.
WHAT WE DID
The engineering response
Mekosha Technologies' role in this multi-partner engagement went beyond engineering execution. We brought the medical-device playbook: product-definition discipline and compliance knowledge accumulated from the medical devices industry, applied from the very first architecture review — so that compliance readiness was a design input on day one, not a retrofit at the end.
- Product definition before product build: Structured data mapping, protocol definition, and architecture reviews established what the device must prove before deciding what it would contain. Component selection was driven empirically — candidate components instrumented with telemetry pipelines, their real performance data validating or eliminating them — replacing datasheet optimism with measured evidence. Every component decision doubles as future verification evidence.
- Compliance as a day-one workstream, not a phase: The engineering plan was structured around the standards landscape a clinical-trial device must satisfy: quality-system design controls with a traceable design history (ISO 13485), risk management from the first hazard analysis (ISO 14971), a safety-partitioned firmware lifecycle (IEC 62304, Class C), and the electrical safety, EMC, home-use, and infusion-specific requirements of the IEC 60601 family. Sequencing knowledge — accredited lab testing needs a design-frozen unit and books weeks ahead — arrived at kickoff, when it could still save months.
- Safety architecture as a product principle: The system was defined so that dose actuation lives solely in the body-worn module with independent safety logic — phone and handheld controllers set the dose, but can never be the thing that delivers it. Interlocks, watchdogs, dose caps, and fail-safe behavior on communication loss were identified and defined as part of product definition, then verified as the design matured.
- Security and software assurance for a connected medical product: Mekosha Technologies leads the InfoSec and software-compliance track across the device firmware, web, and mobile surfaces: VAPT aligned with CERT-In expectations, third-party component vulnerability assessment, open-source licence compliance review, static analysis, and the software toolchain standards for development, testing, and code review.
- The data backbone: Mekosha Technologies configured the IoT platform layer — device properties, shadows, and datapoint definitions, with pre-GTM dashboards — giving the engineering team live visibility into device telemetry throughout development and a data dictionary that anchors the product's evidence chain.
OUTCOMES
What changed
A clinical-trial-grade roadmap from a startup-speed programme: a defined path from breadboard to design-frozen, DFM-complete device with units built under design controls for in-human trials
with the design history file accumulating from week one.
Component choices backed by telemetry, not brochures
measured performance data driving selection, and the same data serving as verification evidence downstream.
The regulatory critical path made visible early: external test-house dependencies, sterile-path sourcing decisions, and design-freeze discipline surfaced at kickoff
when they could still be managed rather than suffered.
Safety-critical actuation isolated by architecture
Safety-critical actuation isolated by architecture, with fail-safe behavior and dose-limiting logic defined as product requirements rather than discovered as bug fixes.
Security evidence for a regulated launch
Security evidence for a regulated launch: VAPT, third-party vulnerability and licence compliance, and static analysis producing the assurance record a medical software product needs.
RELATED STORIES
From paper logs to a connected factory
Four SMT lines on a unified Industrial IoT platform — live OEE, QR lot-to-board traceability, station interlocks, and SAP integration.
Read the case study →AI Safety & PPE Compliance
Modular edge safety stack for elevated worksites — AI vision, smart fall-arrest harnesses, and UWB RTLS that intervene before the fall.
Read the case study →Bring us a line, a fleet, or an audit finding. We'll bring the architecture.
A discovery workshop with our solutions engineers — your assets on a whiteboard, no generic pitch deck.