Regulatory Due Diligence for Mergers & Acquisitions
We understand the high stakes in merger and acquisition processes.
What is regulatory due diligence in a medical device acquisition?
What is regulatory due diligence in a medical device acquisition?
Regulatory due diligence in a medical device acquisition is an independent review of whether a target company’s products can lawfully be sold in the markets the deal assumes. It tests market authorizations, technical documentation, clinical evidence, the quality system, and post-market history, and it tells the buyer what remediation will cost and how long it will take.
Ongoing changes to FDA requirements and the transition to the EU MDR and IVDR now influence deal structures and valuations across MedTech. A review that stops at contracts and financial statements can leave regulatory risk undiscovered until it becomes a costly liability after closing.
Why does regulatory risk change the value of a MedTech deal?
Regulatory risk changes deal value because a medical device earns revenue only where its certificate or clearance is valid and its quality system withstands inspection. A lapsed certificate, an unsupported claim, or an open inspection finding can remove revenue, force remediation spending, or delay the markets a valuation assumes.
In the EU, devices certified under the old directives may stay on the market only while the manufacturer meets the conditions of the extended transition, and the end dates depend on risk class. Under the MDR they are December 31, 2027 for class III and most implantable class IIb devices and December 31, 2028 for other classes, as set out in the MDR transitional provisions. For IVDs, sets December 31, 2027 for class D, December 31, 2028 for class C, and December 31, 2029 for class B and sterile class A. A target that missed an application or agreement deadline may be selling a product with no lawful route to market after its class cutoff.
In the US, the FDA’s Quality Management System Regulation took effect on February 2, 2026 and incorporates ISO 13485:2016 by reference into 21 CFR Part 820, as described on the FDA’s QMSR page. A target whose quality system was built around the former Quality System Regulation may need a clause-by-clause gap assessment before its next inspection, and that work belongs in the deal model.
The European Commission also proposed targeted amendments to the MDR and IVDR in December 2025, with adoption currently targeted for 2027.
How is regulatory due diligence different from legal and financial due diligence?
Regulatory due diligence differs from legal and financial due diligence in what it examines. Lawyers and accountants review contracts, liabilities, and figures. A regulatory consultancy reviews whether the products, quality system, and clinical evidence behind those figures meet EU and FDA requirements. The three reviews complement each other and work best in parallel.
Qserve’s principal consultants carry out the review themselves, drawing on regulatory affairs, quality assurance, and clinical experience from within one consultancy. Their findings support the deal team and its legal counsel. They are not legal advice. The review also differs from a Notified Body audit or an FDA inspection, which assess a manufacturer for certification or compliance and not for an investment decision. Related Qserve services sit under audits and assessments.
When do you need regulatory due diligence?
A buyer or investor needs regulatory due diligence whenever a deal’s value depends on products that must hold approvals in regulated markets. That covers acquisitions of medical device and IVD manufacturers, private equity and venture capital investments, licensing and distribution agreements, and carve-outs of product lines.
- Acquisition of a manufacturer: when the legal entity changes hands, its certificates, clearances, and compliance history change hands with it.
- Private equity or venture capital investment: a stake of any size still rests on the target’s authorizations staying valid.
- Licensing or distribution agreement: the product’s approvals may sit with the licensor, so the deal is only as secure as their status.
- Carve-out of a product line: certificates and registrations may need to be transferred or reissued to the buyer’s legal entity.
- Merger of two manufacturers: two quality systems and two sets of certificates have to be aligned.
Starting before signing leaves the most room to act on what the review finds. For a longer guide to timing, read when regulatory due diligence is needed for MedTech acquisitions.
Regulatory due diligence
What our consultants test, and what it tells the deal team
| Area | What the consultants test | What it tells the deal team |
|---|---|---|
| 01Market authorizations | Whether CE certificates, legacy directive certificates, De Novo grants, PMA approvals, and other registrations match the current products, indications, and claims, and whether legacy devices meet the conditions of the EU transition. | Which revenue is protected, in which markets, and until when. |
| 02Technical documentation | Completeness and currency of technical files against MDR Annexes II and III or IVDR Annexes II and III, including risk management and, for software, lifecycle documentation. | How much remediation stands between the file and a successful Notified Body review or FDA submission. |
| 03Clinical evidence | Whether the clinical evaluation or IVD performance evaluation supports the intended purpose and claims, and whether post-market clinical follow-up is planned and carried out. | Whether the evidence will hold at the next certificate review or submission, or whether new studies are needed. |
| 04Quality management system | ISO 13485 certification status, MDSAP participation where relevant, alignment with FDA’s QMSR, CAPA and complaint handling, supplier controls, and audit and inspection history, including open findings. | How reliable the manufacturing and compliance system is, and what integration or quality assurance work it needs. |
| 05Post-market surveillance | Complaint trends, serious incident and field safety corrective action history, FDA recalls and adverse event reports, and the quality of periodic safety reporting. | Whether safety signals or liabilities sit behind the headline figures. |
| 06Regulatory roadmap | The registrations, label expansions, and new products that the valuation assumes, mapped against realistic review timelines in each market and the data still missing. | Whether the growth case is achievable on the stated timeline and budget, and what global market access work it requires. |
Satisfied Clients
How does a regulatory due diligence engagement work?
A Qserve regulatory due diligence engagement starts with a scoping call that fixes the deal thesis, the products and markets in scope, and the timeline. Consultants then review the data room and the target’s regulatory and quality records, and report findings ranked by severity, with the likely cost and time needed to fix each one.
Deal timelines leave little room for open-ended reviews, so the work concentrates on the products that carry the most revenue. Findings can inform the price, the deal structure, or the conditions to closing, or support a decision not to proceed.
Request regulatory due diligence support
Tell Qserve about the target, the markets in scope, and your timeline, and a consultant will get back to you to agree the scope.
How does a regulatory due diligence engagement work?
A Qserve regulatory due diligence engagement starts with a scoping call that fixes the deal thesis, the products and markets in scope, and the timeline. Consultants then review the data room and the target’s regulatory and quality records, and report findings ranked by severity, with the likely cost and time needed to fix each one.
Deal timelines leave little room for open-ended reviews, so the work concentrates on the products that carry the most revenue. Findings can inform the price, the deal structure, or the conditions to closing, or support a decision not to proceed.
Request regulatory due diligence support
Tell Qserve about the target, the markets in scope, and your timeline, and a consultant will get back to you to agree the scope.
Frequently Asked Questions
Couldn't find your question?
What documents does Qserve need from the target to start a review?
A review starts from the target’s regulatory and quality file: current certificates and clearances, technical documentation for the main products, clinical or performance evaluation reports, the latest audit and inspection reports, CAPA and complaint logs, and post-market surveillance reports. Where a document is missing from the data room, the review notes it as an open point.
How long does regulatory due diligence take?
Duration depends mainly on how many products and markets are in scope and how quickly the target opens its data room. Qserve can give a realistic timeline once those two factors are known.
Is the review confidential?
Confidentiality terms are agreed with the deal team before any target documents are shared, and findings go only to the client and its advisers.
Relevant blogs
Conducting thorough yet efficient due diligence presents unique challenges in medical technology investments that demand specialized approaches.
Discover why regulatory due diligence is vital in MedTech M&A to assess compliance risks, valuation impacts, and expansion readiness in global markets.
Discover how MDR/IVDR regulations affect MedTech valuations, from higher costs and market barriers to long-term value, strategy, and M&A readiness.