Danny Chadha.

I help medical device startups deploy practical, integrated compliance systems — right-sized for the stage they’re actually in, not the company they hope to become someday. Two decades of work in quality management, regulatory affairs, information security, and AI governance, almost all of it spent with small and growing teams who need senior judgment without enterprise overhead.

The practice

Vital Compliance exists because most medical device startups face the same expensive problem: they need quality, regulatory, information security, and increasingly AI governance work done well — but they can’t afford four separate consultants and a full-time compliance team to coordinate them.

My approach is to integrate these disciplines into a single coherent framework — what I call a Minimum Viable Integrated Management System (MV-IMS). It unifies the QMS, ISMS, regulatory work, and AI governance controls into one way of working, so product teams have one consistent operating model across safety, cybersecurity, privacy, and machine learning lifecycle management. Done well, this means a reviewer-ready 510(k) on file, FDA-acceptable secure-by-design practices in place, and hospital and payor security intake cleared — without the founder having to manage four parallel work streams.

Practically, this looks like: ISO 13485 / FDA QMSR-aligned QMS stood up in weeks rather than months; ISO 27001 / SOC 2 / HIPAA-aligned ISMS layered in shortly after; NIST AI RMF-based AI governance controls integrated where applicable; pragmatic tools (Greenlight Guru, Thoropass, and similar) selected to fit the stage rather than impose enterprise complexity. I right-size processes and records, streamline testing and traceability, and decline to install infrastructure that creates future debt without paying off in the near term.

The work

Across two decades in medical device compliance, I’ve led successful 510(k) and EU MDR submissions for Software as a Medical Device (SaMD), in-vitro diagnostics, and electro-mechanical products. I’ve facilitated FDA Pre-Submission discussions on classification, human factors, reliability, cybersecurity, and now AI/ML transparency and robustness questions — the kind of conversations that resolve issues before they become submission delays.

I’ve directed global teams in establishing QMSs compliant with ISO 13485, 21 CFR Part 820, EU MDR, and EU IVDR; built ISMSs aligned with ISO 27001, HIPAA, NIST, and GDPR; managed CMO screening, qualification, and design transfer; deployed e-QMS and e-ISMS platforms; conducted Data Protection Impact Assessments for SaMD platforms; and performed threat modeling using Attack Trees, STRIDE, and FMEA approaches.

Before founding Vital Compliance, I held senior quality, regulatory, and compliance leadership roles at VistaPath Biosystems (Cambridge), LumiraDx (Waltham), Aptus Health (Reading), and Premier Research (Quincy). Each of these stops shaped the practice: VistaPath taught me how fast a competent team can move when the QMS is right-sized; LumiraDx grounded me in the realities of in-vitro diagnostics and connectivity solutions; Aptus Health forced clarity around integrated systems spanning multiple regulatory frameworks; Premier Research exposed me to a wide variety of audit hosting and CAPA cycles across geographies. The accumulated lesson across all of them: compliance done well is compliance done at the right scale for the business it serves.

Credentials

My focus on integrated practice is reflected in a credential set that spans the four pillars I work across.

A trusted network

No single practitioner can credibly cover every specialization a medical device startup needs. Over two decades, I’ve built durable working relationships with trusted specialists across the areas I don’t personally cover — electrical safety and EMC testing, biocompatibility, human factors evaluation, third-party penetration testing, e-QMS implementation partners, and others. When a project needs expertise beyond my own, my clients aren’t left to source it cold; they get warm introductions to people I’ve worked with and vouch for.

Practice principles

Medical technology should reduce human suffering, not redirect it. My practice serves that purpose directly.

If your work shares this orientation, we’ll likely be a good fit.