Thinking. ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­    ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­  
View in browser
Johner Institute

Medical Device Briefings

Issue 20/26

Secret Ingredient: Thinking

Dear there,

I’ve noticed that over the past few weeks I’ve increasingly written about topics that have nothing to do with AI directly — but where AI sparked the underlying thought process. This week is no exception.

That said, I’ll allow myself a small pattern interrupt elsewhere: There will be no journal next week. I’m actually taking a vacation for once (sic(k)!). A borderline experience.

Regulatory Updates

a. Europe

i) EUDAMED

In its latest release notes, the EU explicitly states:

“Please note that with this Release, the Market Surveillance module is available in EUDAMED.”

It also writes:

“As of today, 28 May 2026, the first 4 (four) modules of EUDAMED are mandatory to use (Actors, UDI/Devices, Notified Bodies & Certificates and Market Surveillance).”

Please ensure that you comply with these requirements. Unsure what exactly needs to be done? No problem — just get in touch.

 

 

 

ii) Breakthrough Devices

Until now, I had overlooked the EMA’s (European Medicines Agency) announcement regarding breakthrough devices.

What I find remarkable is that:

  • the EMA is taking the lead here. Are these the early signs of a future European medical device authority?
  • Article 52a MDR is cited as the legal basis — even though, according to the EU website, the MDR does not yet contain this article. Apparently, the EMA is already anticipating the upcoming MDR revision.

I welcome every opportunity to bring urgently needed medical devices and IVDs to market more quickly.

 

iii) AI Act

The EU continues refining the rules for qualification and classification under the AI Act. Evidence of this can be seen in the new draft guidances addressing when products are to be classified as high-risk.

For medical device and IVD manufacturers, however, the practical added value remains limited: the documents elaborate extensively on the recitals but provide very few examples involving critical borderline cases — especially those relevant to our industry.

If you are uncertain about your classification, once again: just reach out. 

 

b. USA / FDA

Technically, there is still time before transitioning to the new ISO 10993…

On May 25, 2026, the FDA partially recognized ISO 10993-1:2025 and fully recognized ISO 10993-12:2021+A1:2025 (source).

The reason for the partial recognition of ISO 10993-1:2025 appears to be an identified compatibility issue with the FDA’s own guidance (“Use of International Standard ISO 10993-1”) and the recognized version of ISO 14971:2019. Most likely, an update to the guidance — already in preparation — will address this issue.

Also interesting is the transition period: ISO 10993-1:2018 will still be accepted for premarket submissions until July 1, 2029.

 

… however

Our Biological Safety Experts point out that, within the context of biological risk assessments conducted according to ISO 10993-1:2018, the FDA has already, in individual cases, required concepts from the current state of the art (ISO 10993-1:2025), including daily contact and reasonably foreseeable misuse.

 

My recommendation: If you are marketing (or planning to market) products in the United States that fall within the scope of the ISO 10993 family, it is best to coordinate with our team in advance. You can reach them through our usual communication channels.

 

Executive Corner: “Solve your Problem in the Model” 

Early success with AI comes quickly. Reliable results do not. The reason is usually the same: people throw thoughts into a prompt, close their eyes, and hope. If the result is poor — try again. And again.

That is not a strategy. Not an AI problem. But a thinking problem.

Interestingly, it is the same thinking (or rather thinking-avoidance) problem I have been observing in product development for years.

 

Iterating Instead of Thinking — an Expensive Habit

Ask people in your company why they work “agile.” A common answer is:
“Because requirements constantly change.”

I have my doubts — at least in our industry.

Intended purpose, stakeholder requirements, regulatory frameworks, patient safety: these do not fluctuate from sprint to sprint. In many cases, iteration is therefore not compensating for changing requirements. It is compensating for insufficient problem analysis.

One symptom of this is the widespread use of user stories. The template “As a [role], I want [function], so that [benefit]” mixes concepts that actually require entirely different types of thinking:

  • Intended purpose: the [benefit]
  • Stakeholder requirement: the [role] and its need
  • Product specification: the [function]

Three distinct levels — blended into a single sentence. That is not precision. It is conceptual soup. And it is the perfect breeding ground for the endless iterations that are later glorified as “agility.”

And when version n + 1 “improves” something that could already have been done correctly in version n, people celebrate it as progress.

It is not. It is a documented failure.

[I hope this does not trigger too much of a shitstorm. Better take it as an invitation to think.]

 

What I Had to Learn Myself

When I was a junior developer, my boss appreciated me because I often delivered a first solution within hours. What he did not see: the architectural chaos in my backend code.

Then I took over a large-scale project, and the implementation partner (IBM) made one thing clear: “If we see you coding at the start of the project, we’re out.”

And then came the sentence that changed everything: “Christian, solve your problem in the model.”

So we modeled the architecture. For months. My boss became impatient — no quick visible results.

But once the model was stable, we were able to generate several hundred thousand lines of code. The architecture remained robust for many years.

Those months of thinking were not wasted time. They were the actual value creation.

 

Frontloading ≠ Waterfall

Do not worry — this is not an argument for a waterfall process. Because frontloading does not mean predicting everything upfront.

It means: think as deeply as possible before you start building.

And that thinking matters equally at every level:

  • Intended purpose: What business or medical problem are we actually solving — and for whom?
  • Stakeholder requirements: What do users truly need?
    By the way: Customer Requirement ≠ User Requirement!
  • Product requirements: What must the product accomplish as a black box?
  • Architecture/specification: How do we design the internal structure so that the system actually holds together?

Anyone who mixes or skips these levels creates exactly the ambiguity that later causes endless iterations.

Does this mean you should never iterate? Of course not. But iterations should be targeted experiments designed to answer a concrete question:

  • Does this UI specification satisfy the user requirements?
  • Does this architecture achieve the required performance goals?

Those are good reasons to iterate. Iterating across the entire development process because the initial problem analysis was skipped is not.

 

What this means for you

  • Do not celebrate the number of sprints. Celebrate the quality of the problem analysis. For every “improvement,” ask: Could we have known this earlier?
  • Demand clear mental models. For example: Can your teams reliably distinguish between intended purpose, stakeholder requirements, and product specifications? If not: invest there — not in yet another Scrum training.
  • Apply the same principle to AI. Before writing the prompt, ask: What exactly is my goal? What are the acceptance criteria? What knowledge does the model need in order to understand my problem?
    Those who master this often need one attempt instead of ten.

In a world overflowing with tools, the most valuable skill remains the oldest one: thinking.

Practical Tips

a. Ensuring Ownership Rights (& Avoiding Misunderstandings)

During the final preparations for Catch the Train, I realized something important:

When using LLMs, we should not only pay attention to data protection and IP protection (and distinguish clearly between the two). When it comes to IP protection, there are at least two separate questions that need to be addressed:

    • Does the provider explicitly state that your data will not be used for training?
    • Does the provider grant you full and exclusive rights to the model output?

If this assurance is missing, the provider could potentially claim rights to the generated output.

My recommendation: Review your providers’ terms of service with these aspects in mind as well.

 

b. Deriving Compliance Review Rules

Anyone asking AI to assess the compliance of technical documentation against a law or standard usually fails. There are many reasons for this. One of them is that regulations such as the MDR and IVDR do not actually contain precise, machine-verifiable review rules.

My recommendation: You therefore need to derive these binary, objectively decidable criteria top-down — starting from the regulation itself.

From-Law-to-Schema-smaller

Much of the work remains your responsibility. Because only you can create a checklist of binary review criteria tailored specifically to your company and your products.
Some time ago, I followed exactly this approach for the context of software, usability, and quality management in our audit guideline.

As promised, I will explain this entire process live at the Medical Device Days — from the regulation itself all the way down to my JSON schema files.

For the first time, this means you will not only be able to clarify all your individual regulatory questions with our top experts within just two days, but also experience the future of AI-driven regulatory work firsthand. (Registration link here.) 

With kind regards,

Christian

Founder Johner Institute

Upcoming Seminars

FDA’s Quality Management System Regulation 

June 17-18, 2026 

As a US manufacturer, you are familiar with the FDA requirements in 21 CFR Part 820. But do you know what the new QMSR requires? What does harmonization with ISO 13485 mean? How much additional effort will you have to put in? 

There is a great deal of uncertainty: you fear additional requirements, complex implementations, and high costs. There is no time to read up on it, but the FDA does not tolerate deviations. In the worst case, your products could be banned from the market.

Learn how to solve this problem in two half-day sessions.

 

Sign up here 

 

IT Security for Medical Devices and IEC 81001-5-1 

July 14-15, 2026 

In this seminar, as a manufacturer of medical devices, you will learn about the regulatory requirements for IT security and data protection for medical devices and how to implement them professionally in your company. 

 

Sign up here 

 

AI Power for the Development and Approval of Medical Devices

July 29-30, 2026

Learn in just two (half) days how to use large language models (LLMs) specifically in developing medical devices – from the initial idea to post-market surveillance. This practical workshop with product expert Mario Klessascheck and regulatory and AI expert Christian Johner will teach you specific methods that will enable you to drastically reduce the time needed to develop and document your medical devices while remaining compliant with the law.

 

Sign up here

 

FDA’s Quality Management System Regulation

September 15-16, 2026

As a US manufacturer, you are familiar with the FDA requirements in 21 CFR Part 820. But do you know what the new QMSR requires? What does harmonization with ISO 13485 mean? How much additional effort will you have to put in?

There is a great deal of uncertainty: you fear additional requirements, complex implementations, and high costs. There is no time to read up on it, but the FDA does not tolerate deviations. In the worst case, your products could be banned from the market.

Learn how to solve this problem in two half-day sessions.

 

Sign up here

Support from the Johner Institute

The Johner Institute's Product & Service Portfolio

 

The Johner Institute supports the medical device ecosystem (manufacturers, authorities, notified bodies, operators) in all regulatory challenges.

  • Strategic Consulting
    e.g., regulatory and clinical strategies for global device approval, quality systems, technical documentation, artificial intelligence
  • Business Process Outsourcing
    e.g., regulatory monitoring, post-market surveillance, clinical evaluation
  • Software (Enterprise SaaS)
    e.g., for regulatory monitoring, post-market surveillance
  • Product Testing
    e.g., clinical investigations, usability tests, pentesting, biocompatibility tests
  • Training
    e.g., seminars and e-learning
  • Taking on Regulatory Roles
    e.g., QM representative, legal manufacturer, in-country representation

Prof. Dr. Christian Johner

 

Johner Institut GmbH

Reichenaustr. 39a

78467 Konstanz

 

 

+49 (0) 7531 94500 20 
info@johner-institute.com
www.johner-institute.com

Privacy Policy   |   Subscription Settings

Johner Institut GmbH, Reichenaustr. 39a, Konstanz, Baden-Württemberg 78467, Deutschland

Manage preferences