Those are difficult questions to answer in a forum like this so all I can offer is some general responses.
If your target market is the US (only) then you need to be compliant with the QSR (21 CFR 820). That does require that you have a quality management system in place but it does not prescribe when things have to occur. (If you plan to market outside the US, you'll want to get on board with ISO 13485.) Some of the basics like document control and configuration management should be established early just as good business practices.
Employees must be competent to perform the tasks they are assigned and you have to have evidence of why they are competent for those tasks. By and large, this will be through experience (resumes) but there are going to be some things (e.g., risk management) that require special skills.
"Winging it" is not the best plan.

You should ensure your regulatory pathway is well defined and then map out how you get there, including establishing and operating under a quality management system. I've seen a number of companies get to the point where they think they can submit for market clearance only to find out they didn't do things per the regulations. You don't want to be there.