Building Operational Infrastructure for Clinical AI: Lessons from MaxQ

In 2019, the FDA awarded its first-ever AI Breakthrough Designation to a stroke detection algorithm. The company behind it - MaxQ AI - had developed technology that could detect large vessel occlusion in CT scans faster and more accurately than radiologists working alone. I built the operational infrastructure that got that company to FDA clearance, CE marking, and OEM partnerships with GE Healthcare and Philips.

This article is about what that actually required - not the technology, but the operational, financial, and compliance infrastructure that makes clinical AI commercially viable. It's written for the founders and operators who are building in this space and want to understand what the journey looks like from the inside.

Why clinical AI companies fail operationally before they fail technically

The graveyard of AI medical device companies is full of teams with technically excellent products. Algorithms that genuinely work, validated in multiple studies, published in peer-reviewed journals. Companies that ran out of runway because the regulatory, commercial, and financial infrastructure couldn't keep pace with the science.

The failure modes are predictable:

• Underestimating the timeline to FDA clearance and running out of cash 6 months before approval
• Getting clearance but having no commercial structure capable of executing OEM deals
• Signing OEM agreements without understanding the financial implications - revenue recognition, milestone accounting, deferred development costs
• Building a compliance program that satisfies the FDA but doesn't scale to ISO 13485 requirements when EU market entry becomes relevant
• Not having the financial controls that global OEM partners require before they'll sign distribution agreements

MaxQ avoided most of these failure modes - not because we were particularly smart, but because we built the operational infrastructure in parallel with the technology, rather than after it.

The FDA process: what it actually costs and how long it takes

The FDA 510(k) clearance process for AI Software as a Medical Device (SaMD) is genuinely complex, and the complexity has increased since the AI Action Plan established expectations for algorithmic transparency and bias assessment. Understanding the real timeline and cost is essential for financial planning.

Realistic 510(k) timeline for AI SaMD:

• Pre-submission meeting: 3–6 months to get on the FDA's calendar and receive feedback on your proposed testing approach
• Clinical validation study: 6–18 months depending on the indication, the complexity of the study design, and IRB approval timelines
• Submission preparation: 2–4 months for a well-organized team with existing documentation
• FDA review: 90 days is the statutory goal; reality is 6–12 months for novel AI submissions
• Response cycles: First FDA questions typically arrive at the 90-day mark; responding and resubmitting adds 3–6 months

Total realistic timeline from serious pre-submission preparation to clearance: 24–42 months. Companies that plan for 12–18 months run out of money. Plan for 36 months and budget accordingly.

The financial model that works for clinical AI

Clinical AI companies have a specific financial structure that differs from SaaS companies in important ways. The finance function needs to be built around this structure from the beginning:

Revenue recognition is complex. When you sign an OEM agreement with GE Healthcare, the contract will have multiple components: upfront development fees, milestone payments tied to clearance and commercial launch, and recurring royalties on device sales. Revenue recognition under ASC 606 requires you to identify each performance obligation and recognize revenue as obligations are satisfied. This is not straightforward, and getting it wrong - either over-recognizing development fees or under-recognizing milestone payments - creates accounting adjustments that damage credibility with investors and partners.

Capitalized development costs are significant. Under ASC 350, certain software development costs can be capitalized rather than expensed. For a clinical AI company, this matters: the costs of developing the algorithm after technological feasibility is established can be capitalized and amortized, smoothing reported losses during the development phase. Not all companies take this approach, but for companies with long development cycles and investor sensitivity to burn rate, it's worth modeling carefully.

The cash flow pattern is different from SaaS. Clinical AI companies typically have a long cash consumption period (pre-clearance), followed by milestone receipts on OEM deals, followed by a slower ramp to recurring royalty revenue. The investor who's used to SaaS metrics will misread your financials if they're not translated properly. The financial model needs to make the pattern clear, not obscure it.

What OEM partners actually require before they'll sign

Getting a term sheet from GE Healthcare or Philips is exciting. Getting to signature requires that your company meet their vendor qualification standards, which are more demanding than most early-stage founders expect.

At minimum, OEM partners will conduct a vendor qualification audit that covers:

• Quality Management System: ISO 13485 certification or documented compliance - they need to know your quality system will maintain the algorithm and manage post-market surveillance
• Financial stability: They'll review your audited financials, runway, and capitalization. An OEM partner is not going to integrate your algorithm into their flagship product if they're not confident you'll be around to support it
• Cybersecurity: Medical device cybersecurity is a regulatory requirement and an OEM requirement. SOC 2 Type II or equivalent is increasingly expected
• Data governance: How you handle patient data, training data provenance, and ongoing model monitoring - all documented
• IP ownership: Clean IP assignment from all founders and early employees, no claims from prior employers, no open-source licensing issues that could affect the OEM's ability to distribute

Companies that haven't built this infrastructure before starting OEM conversations waste months scrambling to put it together while the OEM's legal and compliance teams wait - or worse, lose the deal to a competitor that was ready.

The compliance stack that scales

The most common mistake in building clinical AI compliance infrastructure is designing for the first regulatory approval rather than for scale. A quality system built to get through the FDA 510(k) that doesn't accommodate CE marking, Health Canada, TGA, or PMDA requirements will need to be rebuilt when international expansion becomes relevant.

The compliance stack we recommend building from the start:

ISO 13485 QMS. Even if your first target market is the US and FDA 510(k) doesn't require ISO 13485, building your quality management system to ISO 13485 standards positions you for CE marking (which requires it), satisfies OEM partner vendor qualification requirements, and gives you the documentation discipline that makes FDA submissions cleaner.

GDPR and HIPAA from day one. Clinical AI companies handle highly sensitive patient data. If you design for GDPR and HIPAA compliance from the beginning, you don't need to retrofit it when a European OEM partner or a US hospital system requires it. If you design around it, retrofitting is painful and expensive.

Post-market surveillance documentation. The FDA's AI/ML Action Plan expects ongoing algorithm monitoring - tracking performance drift, managing updates, documenting changes. Building the infrastructure for this before clearance means you have it when the FDA starts requiring it more formally.

What I'd do differently

Looking back at the MaxQ experience with the benefit of hindsight:

I would have hired a CFO or fractional CFO earlier - ideally 18 months before we expected OEM conversations to get serious. The financial infrastructure needed to support an OEM deal (audited financials, complex revenue recognition policies, capitalized development cost accounting) takes time to build. Starting late means scrambling.

I would have started ISO 13485 implementation earlier. We started it when our first European OEM partner required it, which meant we were building the QMS under deadline pressure while simultaneously negotiating a complex commercial agreement. Those two processes should not happen simultaneously if you can avoid it.

I would have been more aggressive about clean IP documentation from the very beginning - founder IP assignments, clear work-for-hire agreements with contractors, open-source license audits. OEM partner legal teams are thorough, and any gap they find adds weeks to the deal timeline.

The companies that navigate the clinical AI path successfully are the ones that treat operational infrastructure as a first-order concern - not an afterthought to the science. The science creates the opportunity. The infrastructure determines whether you can capture it.