The First Regulatory Affairs Hire

Joining an established regulatory function means walking into decisions other people already made: a document control system, a submission history, a house style for writing a rationale. Being the first hire means none of that exists yet — and the informal practices already in place, whatever they're doing today, aren't a system.

In brief

There's no existing regulatory function to plug into — you're deciding what the function looks like, not inheriting how it already works.
The quality system obligation under 21 CFR Part 820, now the QMSR, doesn't scale down for company size or funding stage; a five-person company making a class II device carries the same baseline requirement as a large one.
The first decisions worth making are usually about document control and decision authority — not the submission itself, which can wait a few weeks longer than the paperwork that will govern every submission after it.
Nobody is calibrating your judgment the way a manager would in an established function, which makes documenting your own reasoning as you go the difference between a defensible early record and a blank one.

You inherit the system before you inherit any process

A shared drive doubling as a document repository, decisions made over chat and never written down — whatever a small company is doing before its first regulatory hire, it isn't a quality system yet, whatever it's accomplishing informally. The QMSR's incorporation of ISO 13485:2016 into 21 CFR Part 820 sets a baseline that doesn't flex for how early-stage the company is: a documented quality system, defined management responsibility, and controlled records are the same obligation whether the company has five employees or five thousand. This is a different problem from choosing between a startup and an established employer as a career decision — here, you've already made that choice, and the job is translating an obligation that doesn't care about company size into something a small company can actually run.

Where to start when there's no playbook

Document control comes before almost everything else, because every other process depends on there being one current version of anything — the quality policy, an SOP, a design file — instead of three drafts living in three inboxes. The second early decision is about authority, not process: what you can decide on your own, and what has to come back to a founder or a head of engineering before it's final. Get that wrong in one direction and you spend the company's runway asking permission for decisions that were always yours to make; get it wrong the other way and you make calls nobody agreed you had the authority to make, which is a worse thing to discover during an inspection than during a hallway conversation. Writing down your own reasoning as you go, rather than reconstructing it later, is worth adopting from day one — see the case for keeping a regulatory decision log.

Where people get stuck

Building the system you had at a larger employer

A five-person company doesn't need the document hierarchy of a company with a dedicated quality department. Over-building it early just makes the system something nobody follows.

Waiting for buy-in before establishing document control

The underlying obligation isn't optional or contingent on funding stage. Delay just means starting later, from further behind.

Never writing down why you decided something

Without a manager checking your reasoning day to day, your own contemporaneous notes are the only record of how today's decisions were made — for you, and for whoever inherits the file later.

The appeal of being the first regulatory hire is real authority over how the function gets built, and the risk is exactly the same thing: there's no one to catch a wrong call before it's load-bearing. Treating the first few decisions — document control, decision authority, what gets written down — as the actual job, ahead of any single submission, is what makes everything built afterward stand on something.

Sources & further reading

21 CFR Part 820, Subpart A — Quality Management System Regulation (QMSR) ecfr.gov
Regulatory Academy — Moving from Individual Contributor to RA Manager regulatoryacademy.com
Regulatory Academy — Startups vs. Established Companies in Regulatory Affairs regulatoryacademy.com
Regulatory Academy — The Case for Keeping a Regulatory Decision Log regulatoryacademy.com

This essay is provided for general educational purposes and reflects the regulatory landscape as of its publication date. It is not legal, regulatory, or career advice.