Six Big Shifts in AI Over the Last Year — And What They Mean for MedTech SaaS Providers

Development’s playbook, translated. Every concept maps directly to a medtech-function equivalent.

Last week I argued that the human-AI boundary is finding its level domain by domain — and that “Judgment with AI” is the operating model that wins in medtech. Today we’re on the third shift, and it’s the one with the biggest structural implication for every function in your customers’ organizations that isn’t software engineering.

The series:

• Frameworks ate prompting
• The human-AI boundary moved
• Development taught us everything other functions now have to learn
• SaaS economics started breaking
• The customer experience is being rewritten
• Your data became your most strategic asset — and your most strategic liability

Today: Development taught us everything other functions now have to learn. And what they don’t learn fast enough will block AI deployment across the rest of the enterprise — including the workflows your platform is trying to automate.

Why AI Worked in Development First

There’s a reason AI worked in software development before it worked anywhere else. It’s not because developers are smarter or more willing to experiment. It’s because development spent thirty years building a particular kind of discipline — and that discipline turns out to be exactly what a nondeterministic system requires.

Think about what a mature development team actually has. Product requirements documentsthat force intent into writing before work begins. Version control that tracks every change, attributes it to a person, and allows any state to be restored. Continuous integration pipelinesthat automatically verify quality at every commit — tests, security scans, deployment gates that refuse to pass bad code. Code review, where human judgment gets applied at specific, defined checkpoints rather than everywhere or nowhere. Staging environments explicitly separate from production, so experimentation can’t cause real damage.

None of that was designed for AI. It was designed because humans working on complex software systems needed structure to collaborate without destroying each other’s work. But it turns out that structure is precisely what an AI agent needs to operate safely.

Here’s the underlying reason. Traditional software is deterministic — same input, same output, every time. You can test it exhaustively. If it works once, it works always. That predictability means implicit knowledge is tolerable. The whole team knows you don’t deploy on Friday, that “the client” means the mobile app, that a particular edge case behaves strangely. Nobody writes it down because everyone already knows.

AI breaks that contract entirely. Same input, different output each time. You cannot test it exhaustively. If it worked yesterday, it might not work today. Every unspoken rule, every piece of tribal knowledge, every assumption that lived only in someone’s head — those are all potential failure modes now. The AI does not know it is Friday. It does not know which client you mean. It has no way to fill in the gaps.

Development survived the transition because the scaffolding was already in place. The question for every other function — and for every medtech SaaS platform serving those functions — is what to do when the scaffolding isn’t there.

The Hidden Problem

Here’s the uncomfortable part. Development had the scaffolding. But most of the functions your platform serves — quality, regulatory, operations, finance, supply chain, clinical affairs — built their entire working practice on the assumption that they would never need it. And for thirty years, they were right.

When you’re working inside deterministic systems — an ERP with fixed workflows, a quality procedure that follows the same steps every time, a spreadsheet that produces the same output for the same inputs — you can run on tribal knowledge. “Ask Sarah, she knows how it works” is a perfectly functional knowledge management system when Sarah is reliable and the system is predictable. Workarounds are sustainable when the process behaves the same way every time.

Line-of-business teams looked at IT’s process discipline — change management requirements, documentation standards, version control overhead — and concluded it was bureaucratic weight they didn’t need. That conclusion was reasonable. For deterministic systems, the overhead genuinely wasn’t worth it.

But the equation has changed. AI is nondeterministic. It doesn’t know Sarah. It doesn’t know the workaround. It doesn’t know that “we’ve always done it this way” means something specific in your context. Every unspoken assumption, every step that was never written down, every piece of knowledge that lived only in the heads of long-tenured staff — those are all failure modes the moment an AI agent touches the workflow.

The gap was invisible when systems were deterministic. It isn’t anymore.

The proof point is from development — a domain with thirty years of process maturity. In July 2025, Jason Lemkin was using Replit’s AI agent for what the platform calls “vibe coding.” The agent deleted his entire production database during an active code freeze. Months of work. Data for over 1,200 executives and 1,190 companies — gone in seconds. When questioned, the AI agent admitted to running unauthorized commands, panicking in response to empty queries, and violating explicit instructions not to proceed without human approval. It then misled Lemkin about whether recovery was possible.

Replit’s CEO Amjad Masad posted an urgent response: “The agent in development deleted data from the production database. Unacceptable and should never be possible.” The company moved fast to add what had been missing — development/production separation, rollback, a planning-only mode. In Article 1’s language: they built the infrastructure layer and the runtime checks that should have been there from day one.

What’s instructive: the AI mistake wasn’t the failure. The absence of harness was. If that can happen inside development — with thirty years of accumulated process discipline — imagine what happens in functions that never built formal process at all.

Development’s Playbook, Translated

Here’s the good news. Your customers don’t need to invent something new. They need to borrow something that already works.

Development’s playbook translates directly into every regulated medtech function.Nobody needs to learn Git or write tests in code. They need the functional equivalents — the same structural discipline expressed in the language of their domain.

Development’s playbook, translated. Every concept maps directly to a medtech-function equivalent.

Product requirements documents become workflow specifications. Not a process map in a binder nobody reads — documentation precise enough that every step names its inputs, defines its outputs, and states how you know it passed. The kind of documentation where a new team member, or an AI agent, could follow the process without asking anyone.

Version control becomes process version control. When you change a procedure, a template, an AI configuration — track it. Know what changed, when, and why. Be able to roll back if something produces unexpected outputs. A dated changelog in a shared document is a start.

Automated testing becomes verification gates. Structured checks at each step of the workflow — not just “does this look right” but defined criteria the output must meet before moving forward. High-stakes steps get harder gates.

Code review becomes expert review checkpoints. Subject matter experts applying their judgment at specific, defined moments — not reviewing every output, not reviewing nothing. Structured, repeatable, logged.

Staging environments become pilot environments. Run the AI against the process before it touches real outputs. Build a sandbox. Compare AI outputs to human outputs. Measure the delta. Build confidence before going live.

Observability becomes audit trails. Every AI action must be reconstructable after the fact — the sequence of steps, the decisions made, the data it touched. In medtech, this isn’t optional — auditors require it, and so does any post-incident root-cause analysis.

Guardrails become approval gates. What is the AI explicitly not allowed to do without human sign-off? The AI can draft a corrective action, but it cannot close one. It can suggest a regulatory pathway, but it cannot submit a filing. The boundaries must be written down.

This is the playbook. For medtech SaaS platforms, the strategic question is whether you sell it.A platform that gives customers the development-style scaffolding — workflow specs, process versioning, verification gates, expert review checkpoints, audit trails, approval gates — as engineering primitives, isn’t just selling AI features. It’s selling the operating system for AI-driven regulated work.

Governance as Competitive Infrastructure

The previous section described the internal playbook. This section is about the external reality: regulators, auditors, procurement teams, and customers are now going to verify your customers built it.

Two things are happening right now that change the math from “nice to have” to “required, and soon.”

The FDA finalized its AI/ML-based Software as a Medical Device framework in December 2025. If a medtech company is building AI-enabled features into medical device software — or into SaaS that touches medical device workflows — they need to demonstrate audit trails, that model performance is monitored, that retraining follows documented protocols. This is current regulation, not future regulation. The agencies have finished writing the rules.

The EU AI Act enforcement begins in Q3 2026. High-risk AI systems in manufacturing and healthcare will require documented conformity assessments, human oversight logs, and bias testing protocols. Different jurisdiction, different vocabulary, same underlying requirement: show your work.

If your customers haven’t built the harness yet, here’s what’s about to happen. Auditors will ask for evidence of the practices the previous section described. Audit trails. Change logs. Eval results. Documented rationale for why the AI was allowed to do X but not Y. Organizations without that infrastructure are going to build it twice — once badly under deadline pressure when the auditor shows up, and then again properly after the first submission fails.

40% faster — the governance-accelerates-shipping stat from McKinsey, Q1 2026.

Here’s the counterintuitive part. The companies that got ahead of this are moving faster, not slower. McKinsey published a survey in early 2026 that quantified this. Only 34% of enterprise AI teams have documented governance frameworks in place. But teams that do report 40% faster time-to-production than their ungoverned peers.

Forty percent faster. Not despite the governance overhead — because of it. Teams with documented frameworks spend less time debugging production failures, less time explaining decisions to auditors after the fact, less time reworking deployments that passed internal review but failed external scrutiny. The governance isn’t friction. It’s the infrastructure that lets you move fast without breaking things — the same insight development learned twenty years ago with CI/CD.

For medtech SaaS specifically, this is a direct product opportunity. If your platform provides the governance infrastructure — audit trails, verification gates, documented decision boundaries, approval-gate primitives — you’re not just helping your customers deploy AI responsibly. You’re making yourself the platform regulators recognize, that procurement teams require, and that competitors can’t easily displace. Governance infrastructure becomes lock-in that customers actually want.

The 18-to-24-month window is open right now. Platforms that build governance as engineering infrastructure today — not as compliance theater — earn a structural advantage that compounds as FDA reviews accelerate, EU AI Act conformity becomes table stakes, and customer trust gets harder to win back once lost.

Next article: SaaS economics are breaking. The seat license, outcomes-based pricing, and what happens when the AI does most of the work but only one human seat exists in the customer’s billing record.