Regulation Follows the Function, Not the Pitch Deck

The same software stack can be an unregulated workflow tool, part of a medical device, a financial institution's service provider, or a consumer product control. Labels such as fintech and healthtech are too broad for legal analysis. Regulators ask what the product does, for whom, with whose money or data, and under whose authority.

Create a classification decision before controls

Describe the intended use, claims, users, customer, delivery channel, geography, money and data flows, hardware, suppliers, and failure modes. Then identify definitions and exclusions in the relevant primary law or regulator material. Preserve the facts, source version, author, approver, and conditions that would invalidate the decision.

Marketing language is part of the evidence. A wellness feature may be analyzed differently after the website promises diagnosis or treatment; a billing tool may change character if it receives and transmits customer funds. Product, sales, legal, security, and operations must approve the same intended-use statement.

Financial services: trace custody and transmission

Draw every step from payer instruction to final settlement, including wallets, processors, banks, agents, beneficiaries, reversals, fees, and foreign exchange. In the United States, FinCEN's MSB analysis is federal; state money-transmission, lending, securities, insurance, and consumer rules can be separate. A processor contract does not automatically transfer every regulatory role.

Record which entity holds funds, transmits value, performs customer identification, files reports, handles complaints, protects records, and answers the regulator. If the model relies on an exemption or partner licence, state its conditions and monitor them. Reclassify before adding a stored balance, cross-border corridor, credit feature, token, or new customer type.

Health: separate device status from data duties

FDA device classification begins with intended use and technological characteristics, not with whether code runs in a phone or cloud. The class, predicate analysis, premarket route, quality-system duties, labeling, reporting, and change control require product-specific review. Do not infer clearance from a competitor's public listing without comparing indications and technology.

HIPAA is another question: it depends on covered-entity and business-associate relationships and protected health information, not merely on a health-themed dataset. When applicable, administrative, physical, and technical safeguards form distinct control families. Other privacy, research, professional-licensing, reimbursement, and national health rules may apply even when HIPAA does not.

Consumer products and data services need their own gates

Worked example: a connected children's device collects voice commands and controls a heating element. The issue map may include product classification, testing and certification, children's privacy, cybersecurity, labeling, incident reporting, recalls, retailer requirements, and supplier traceability. The illustration names possible workstreams; it does not determine which statute applies.

Reviewed 21 August 2026, this module uses US federal authorities to demonstrate classification method, not to describe every US state or any rule in Iran, the UAE, EU, or elsewhere. It is not legal advice or a licence determination. Sector counsel and the competent regulator's current materials must validate classification before launch and after material product changes.

Frequently asked questions

How we sourced this

Every statistic in Regulation Follows the Function, Not the Pitch Deck is attributed. Where a number is an estimate rather than a census, the note says so.

The bottom line

The right compliance program begins with the regulator's definition of what the product actually does.

If you want the adjacent decisions after Regulation Follows the Function, Not the Pitch Deck, start with Compliance auditing, International legal, Startup insurance, Contract controls.