Starting too early might not be the best move (though parent has a point on better auditability), but doing it at the last minute or once the product is plenty

Starting too early might not be the best move (though parent has a point on better auditability), but doing it at the last minute or once the product is plenty mature also means a ton of needless changes that can be disrupting depending on how the product was built/managed. Perhaps it would make sense to at least know and understand the certifications as early as possible, and grow with it in mind. It makes it a lot easier to get certified when times come, or even to explain clients why it wouldn't be required in some cases ("we can already guarantee you this and that, if that's the part you're worrying about")