What's Changing in the Moat You Build

Every CTO at a mid-sized European medtech firm has had the same Monday. Firmware sprint velocity up nineteen percent quarter on quarter. Submission-documentation agents cut GSPR assembly time by sixty percent. Your VP Engineering opens the review with the dashboard. He is mid-sentence when your phone buzzes. It is the CMIO at your biggest hospital system. One sentence: "We are piloting Aidoc on three imaging workflows, happy to talk about integration." Your Head of Regulatory Affairs mentioned a recruiter call from RegDesk over coffee Thursday. Your CEO has a CAIO shortlist from the board on his desk. Your CFO forwarded a Dexcom market-cap chart this morning: "Worth discussing before Q2 planning."

You have run this function for a decade or longer. The pattern used to be simple. Hire strong engineers. Clear the submission. Hold the notified body relationship. Ship the next device generation. Meet the board on cycle time and engineering headcount. The business was understandable.

Something changed. What used to take fifty engineers in firmware and submission prep now runs on five. That compression arrived faster than the discipline to absorb it. Ninety-five percent of corporate AI deployments produce no measurable P&L impact, and the gap between what the tools can do and what your quality system actually absorbs is where your seat now lives or loses. An AI-native diagnostic at ten percent of your submission cost just landed its first named reference at a large hospital system in your category. Your Head of Regulatory Affairs carries notified body knowledge that has never been written down, and a regulatory-AI vendor called last month.

You are not running one R&D function. You are running two, and only one of them is on your scorecard. One funds the next generation of the existing device through the existing regulatory pathway. The other funds what has to exist by 2028: the clinical-evidence engine you have not built, the installed-base telemetry platform you have not commercialised, the data rights you have not renegotiated with your top hospital systems, the architectural reasoning sitting in one RA director's head. On one hurdle rate the first wins every quarter. On one scorecard the second does not exist.

This briefing covers what is happening in your sector, what it means for the R&D function you run, and the three questions your team should answer before the next board cycle.

The AI-natives in your category are not experimenting. They are clearing submissions. Paige.AI and PathAI shipped pathology platforms to 510(k) faster than your last device generation did. Aidoc and Rad AI cleared imaging-triage algorithms in months and priced them as subscriptions, not capex. RegDesk and Veeva Vault RIM AI are compressing what used to be a nine-month documentation exercise into weeks. Your hospital customers' procurement teams now run comparison quotes where your device capex number sits next to the AI-native's per-scan or per-patient subscription. They are not asking which is the better device. They are asking which pricing model their CFO can defend against the board's AI-readiness question.

The moat your product ran on for a decade has moved. The device-feature layer commoditises fast now. A diagnostic capability that used to take a 150-person team four years to build and submit can be rebuilt by a 20-person AI-native in twenty-four months, on modern architecture, priced on an outcome your hospital customer can measure. Your device-feature edge was never going to hold. What can hold is the layer underneath the sensor and the firmware: the installed-base telemetry, the clinical-data graph, the real-world evidence you have rights to aggregate across three product generations, the integration depth your service platform has wired into Epic and Cerner and DICOM workflow. Those compound. They take years to build and they cannot be bought. An AI-native cannot ship them because they do not have your installed base.

Your diagnostic cleared on the current AI tools is on an eighteen-month commoditisation curve. Your telemetry and clinical-data graph from ten thousand devices in the field is the asset the AI-native cannot replicate without your installed base.

The industry's speed mismatch is the third force. AI-native diagnostics build from scratch with no installed-base legacy, no three-year device-development cycle, no notified body relationship to protect. Your firm has all three. You cannot pivot at their speed on their terms. What you can do is identify what is genuinely defensible in your portfolio, stop defending what is not, and ship the moat they cannot build. The firms that are already moving are quiet about it. The ones that are deploying RegDesk and calling it an AI strategy are the ones the board will replace in 2028.

Your build engine. Firmware Copilot adoption is at seventy percent. Submission-assembly agents cut the GSPR documentation exercise by more than half. Your IEC 62304 evidence documentation lags the code. The review discipline that worked in 2022 is training the wrong practice on agent-generated volume now. Business-layer AI and regulated-submission AI are two different problems with two different controls, and the team is treating them as one.

Your platform and data. Whichever firm wins the next decade of medtech will own the data platform, not the sharpest sensor. Your installed base generates telemetry every day from thousands of devices in the field. Today that signal is thrown away or stored as service-contract ballast. Commercialise it. The compounding capital belongs in the clinical-data graph, the installed-base telemetry platform, the data-rights renegotiation across your top hospital contracts on the twenty-four-month renewal window, and the integration depth published for Epic, Cerner, and DICOM workflow. The device commoditises. The data platform compounds.

Your product thesis. Your board asked for the firm's three-sentence product thesis last quarter. Your answer was the one from three years ago. Your rate card assumes AI-native diagnostics will price like device accessories. They do not. Paige and Aidoc price as subscriptions per patient or per scan. Your capex-priced P&L cannot follow. That is a capital-allocation question about where the moat gets built, not a pricing one. Your CFO and commercial leader need a joint document with you before the AI-native forces the conversation on their terms.

Your R&D bench. You stopped hiring junior engineers in 2024. The routine firmware and documentation work that trained juniors into seniors is now running on agents. No routine work, no training ground, no senior bench in 2030. Your Head of Regulatory Affairs is three years from retirement and the notified body relationship is not written down. OpenAI and Anthropic both resumed junior hiring in late 2025 specifically to pair juniors with seniors on judgment-intensive work. The firm that cuts for this year's number has a cheaper function in Q4 and an empty bench in five years.

Your board-level authority. Thirty percent of European AI-strategy ownership sits with the CIO, twenty-three percent CDAO, twenty-one percent CAIO, one percent COO. You are not on the list. Not because you abandoned the mandate. You have not yet claimed it. Your CEO has a CAIO shortlist. Every month without a visible claim, the thesis drifts further from the seat that can defend it. Your Q1 boundary agreement with the CEO lands before the CAIO shortlist, not after.

Your sector is repricing from below because AI-native diagnostics are shipping subscription-priced reference customers at ten percent of your submission cost. Your function is compressing because five engineers now produce what fifty did, and the review bar that worked for fifty cannot hold the volume five produce with agents. Same force, two altitudes. But there is a third thing happening that most mid-market medtech CTOs have not named yet.

The moat that matters in 2028 is not above the model layer. It is underneath it. The firmware feature you clear in this submission cycle on the current AI tools is on an eighteen-month commoditisation curve. The next foundation model rolls in 2027 and your diagnostic feature commoditises. What does not commoditise: the clinical-data graph your installed base generates, the telemetry signal from ten thousand devices in the field, the real-world evidence you have rights to aggregate, and the integration depth you have published for your top ten hospital IT systems. A two-person AI-native cannot build that layer because they do not have the installed base that generates the signal. You do. The window closes in roughly eighteen months, which is the time between now and when the AI-native has enough of their own hospital footprint to start building the same layer.

From 2010 to 2020, three firms competed in continuous glucose monitoring. The first shipped the most integrated pump-plus-sensor system. The second shipped a half-price alternative with excellent industrial design. The third shipped a sensor that was clinically best-in-class on accuracy, and quietly built the data platform underneath it. By 2020 the third firm's market cap crossed forty billion dollars. The first firm's diabetes business was under strategic review. The 2010 scorecard measured sensor accuracy, sensor longevity, insertion comfort, and hardware reliability. Every one of those metrics stayed green at the first firm. They just stopped being the ones the market was scoring. The job had not changed. The unit of judgment had.

You have twelve to eighteen months. The CTOs who claim the authorship of this decision in Q1 author the decade. The ones who wait until the CAIO hire arrives inherit a seat that has narrowed to platform uptime and submission-cycle time, and a scorecard that stopped mattering the quarter their biggest hospital account opened an AI-native pilot.

Every CTO has had the AI conversation. Most are making the same four decisions. A smaller group is making different ones.

Three questions every medtech CTO is tracking. The third is the crux. The first two are how you earn the right to answer it.

Four concrete moves any medtech CTO can start this quarter. Each addresses one sub-function. Pulled together, they become one architecture the firm builds on.

The medtech CTO has four places to go. None can do what we do.

The big health-practice consultancies ship a standardised AI-governance framework across a sector book. Their cost structure requires reusability. Your seat is idiosyncratic. A reusable framework on an idiosyncratic seat produces governance theatre.

The hyperscaler health-cloud arms price as enablement for cloud consumption. Their business model requires platform lock-in. Every build-or-buy on your telemetry and clinical-data graph routes through their pricing for three years.

The medtech regulatory-AI vendors have a quote on your desk. RegDesk, Veeva Vault RIM AI, Rimsys. Their product bills on submission volume. Telling you to spend freed capacity on the clinical-data moat instead is structurally impossible for them.

An in-house or fractional CAIO splits the seat. Strategy CAIO is revenue-measured; Platform CAIO is deployment-measured. Two-thirds of new CAIOs spend year one compiling AI inventories instead of setting direction.

We start with your R&D leadership team because the change cannot outrun the team's personal understanding of what is possible. Three workshops. Each delivers standalone value. Each earns the right to the next.

The questions where your R&D leadership cannot agree on an answer are the ones worth an hour on the agenda. Ask these honestly.