GxP compliance software for small labs: what to put in the first system
Published , reviewed
Verdict
- Best overall
- QualioCovers documents, training, CAPA, change control and events in one system, and its own help pages describe the audit trail, the signing password and audit-trail records kept for the lifetime of the customer's system.
- Best for an early-stage lab
- ZenQMSZenQMS names labs, CROs and CDMOs from early-stage startups up, and shares its validation plans and requirements with customers. Seven of its ten Part 11 rows are stated rather than described, so ask for the documents.
- Best for a GMP lab short on validation time
- ScilifeCustomers get an executed validation package from the start (plan, URS, risk assessment, IQ, OQ, PQ, trace matrix and summary reports), the only package on this page described as already executed.
Fig. 01A lab of 5 to 30 people working under GMP or GLP writes the same three kinds of record from its first regulated batch or study: approved procedures, deviations, and training. Those are quality-system records, so the first system worth buying is usually an eQMS, and data systems such as a LIMS or an ELN come after. This page maps each GxP duty to the rule that sets it, then reads six eQMS vendors on what they publish about Part 11 and about the validation work they leave with you.
What GxP asks of your records
GxP is shorthand for the good-practice rules: manufacturing (GMP), laboratory studies (GLP) and clinical work (GCP). None of them names a piece of software. Each one names records, and the GxP guide covers who each rule binds. Pick the rules your lab works under to see which duties belong in the first system.
Which GxP rules does your lab work under?
7 duties for the first system, 3 that can wait. First-system jobs: Document control; Deviations and CAPA; Training records; Validation of each system.
In the first system
| Duty | What the rule says | Carried by |
|---|---|---|
| Written procedures, approved by the quality unitGMP, § 211.100(a) | “These written procedures, including any changes, shall be drafted, reviewed, and approved by the appropriate organizational units and reviewed and approved by the quality control unit.” | Document control |
| Deviations recorded, discrepancies investigatedGMP, § 211.100(b), § 211.192 | “Any deviation from the written procedures shall be recorded and justified. … A written record of the investigation shall be made and shall include the conclusions and followup.” | Deviations and CAPA |
| Training on the job and on CGMP, kept currentGMP, § 211.25(a) | “Training in current good manufacturing practice shall be conducted by qualified individuals on a continuing basis and with sufficient frequency to assure that employees remain familiar with CGMP requirements applicable to them.” | Training records |
| Controls on every computer system that holds recordsGMP, § 211.68(b) | “Appropriate controls shall be exercised over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel.” | Validation of each system |
| SOPs with a dated history of every revisionGLP, § 58.81(d) | “A historical file of standard operating procedures, and all revisions thereof, including the dates of such revisions, shall be maintained.” | Document control |
| Deviations from SOPs authorised and documentedGLP, § 58.81(a) | “All deviations in a study from standard operating procedures shall be authorized by the study director and shall be documented in the raw data.” | Deviations and CAPA |
| A current training summary for each personGLP, § 58.29(b) | “Each testing facility shall maintain a current summary of training and experience and job description for each individual engaged in or supervising the conduct of a nonclinical laboratory study.” | Training records |
Can wait, or start on paper
| Duty | What the rule says | Carried by |
|---|---|---|
| Complete laboratory records for every testGMP, § 211.194(a) | “Laboratory records shall include complete data derived from all tests necessary to assure compliance with established specifications and standards, including examinations and assays.” | LIMS |
| Signed records of each QA inspectionGLP, § 58.35(b)(3) | “Inspect each nonclinical laboratory study at intervals adequate to assure the integrity of the study and maintain written and properly signed records of each periodic inspection.” | Audit management |
| Raw data entered under a name, changes that hide nothingGLP, § 58.130(e) | “In automated data collection systems, the individual responsible for direct data input shall be identified at the time of data input. Any change in automated data entries shall be made so as not to obscure the original entry.” | ELN or LIMS |
Quotes are the eCFR text, read 2026-10-22. The split into first and later is our reading for a lab of 5 to 30 people, not the rule's: every duty applies from the first regulated batch or study; what can wait is the software, not the duty.
Device makers
A device maker's GMP duties now sit in the QMSR, which incorporates ISO 13485:2016 by reference and adds its own record content for complaints, servicing and UDI (§ 820.35). That buyer has its own page: medical device QMS software.
Why the first system is a quality system
Read the first-system duties side by side and the pattern is plain. Under both GMP and GLP the day-one records are a controlled procedure with a dated revision history, a deviation that someone authorises and explains, and a training record that shows each person knows the current version. Those three link to each other: a revised SOP should trigger retraining, and a deviation often ends in a revised SOP. A system that holds all three keeps those links in one audit trail instead of three spreadsheets.
Four of the six vendors here describe documents, training and CAPA or quality events in the same product: Qualio, Scilife, Dot Compliance eQMS and MasterControl Quality Excellence. ZenQMS and SimplerQMS lead with document control. If procedures are your only electronic record for now, a document-first product fits; the document control comparison reads that job on its own.
What can wait: audit management, supplier quality and the lab data systems. GLP still wants signed QA inspection records and GMP still wants complete test data, but a small lab can keep those on paper or in the instrument's own software until volume makes that slow. A module can be switched on later; moving procedures and training history out of a system you outgrew means migrating, and checking, every record.
Common misreading
“We keep the signed paper SOP, so the electronic copy is outside Part 11.” Not if your team works from the electronic copy. FDA's 2003 guidance counts records kept electronically in addition to paper and relied on for regulated work as Part 11 records. Decide which copy is the record and write that down in an SOP.
The setup and validation you carry
For a small lab the work that decides the project is often the validation, not the install: someone has to say what the system is for, assess the risk, test what matters and sign a report, usually the same person who runs QA. What the vendor hands over sets how much of that you write from scratch. Here is what each vendor says it supplies, as we recorded it from the vendor's own pages.
Scroll sideways for all columns
| Vendor | What the vendor says it supplies | Status |
|---|---|---|
| Qualio | Claimed on the vendor's pages; what the customer receives is not described there.Qualio page read 2026-10-22 | verified |
| ZenQMS | Validation plans and requirements shared at no extra cost; releases run under change control.ZenQMS page read 2026-10-22 | verified |
| Scilife | Plan, URS, risk assessment, IQ, OQ, PQ, trace matrix and summary reports.Scilife page read 2026-10-22 | verified |
| SimplerQMS | SimplerQMS says it validates the system itself; documents for customers are not described. | not stated |
| Dot Compliance eQMS | A validation documentation package is available to all customers in the subscription.Dot Compliance page read 2026-10-22 | verified |
| MasterControl Quality Excellence | IQ, OQ and PQ test protocols offered to customers, updated with each build.MasterControl page read 2026-10-22 | verified |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
A pre-executed package and a set of templates are different starting points. An executed package is evidence you review and accept for your configuration; templates are documents you still run. Neither is your validation until you have set your intended use against it, as the validation guide for small labs explains.
What stays with your lab, whatever you buy
- § 11.10(a)Validate the system for the way your lab uses it. A vendor's package is evidence you can reuse, not the validation itself.
- § 11.10(i)Show that the people who build, maintain or use the system have the education, training and experience for their tasks.
- § 11.10(j)Write the policy that holds each person accountable for actions taken under their e-signature.
- § 11.100(b)Verify each person's identity before you issue them an e-signature.
- § 11.100(c)Send FDA your own letter certifying that your e-signatures are the legally binding equal of handwritten ones.
- § 11.10(c)Keep records retrievable for the retention period your predicate rule sets; Part 11 sets none of its own.
Requirement by requirement
The ten Part 11 rows, ordered for a first system: validation documents and the audit trail first, because those are what you test and defend at an inspection; open-system controls last, because they apply only if your system is open, which turns on who controls access. Classify yours with the open vs closed system check.
Scroll sideways for all vendors
| Requirement | Qualio | ZenQMS | Scilife | SimplerQMS | Dot Compliance eQMS | MasterControl Quality Excellence |
|---|---|---|---|---|---|---|
| Validation documentation to support the customer's own validation§ 11.10(a) | verified | verified | verified | not stated | verified | verified |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified | stated | verified | verified | stated | verified |
| Audit trail kept as long as the record§ 11.10(e) | verified | stated | stated | stated | stated | stated |
| Two distinct components to sign§ 11.200(a) | verified | stated | stated | stated | stated | verified |
| Signature shows name, date and time, and meaning§ 11.50 | stated | stated | stated | verified | stated | verified |
| Access and authority checks by role§ 11.10(d), (g) | verified | stated | stated | stated | not stated | verified |
| Accurate, complete copies for inspection§ 11.10(b) | verified | stated | stated | stated | not stated | verified |
| Signature linked to its record so it cannot be moved§ 11.70 | stated | stated | stated | stated | stated | stated |
| EU Annex 11 statementEU GMP Annex 11 | stated | not stated | stated | stated | stated | not stated |
| Open-system controls: encryption, digital signatures§ 11.30 | not stated | not stated | not stated | not stated | not stated | not stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Vendor by vendor
Each card says what the product is and who it fits, then the six rows that weigh most for a first system, with the note we took on each page. MasterControl fits a lab that expects to grow into audits and risk work in the same suite; Dot Compliance fits a team that wants its eQMS on the Salesforce platform.
Qualio
eQMSdocument control- What it is
- A cloud quality management system for life sciences covering documents, training, CAPA, change control, events, audits, suppliers and design controls. Customers receive a validation pack with test scripts and a Part 11 assessment.
- Who it fits
- Drug, biotech, device and CRO teams building or replacing their eQMS.
| Requirement | Status |
|---|---|
| Validation documentation to support the customer's own validation§ 11.10(a) | verified |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | verifiedAudit trail records are kept for the lifetime of the customer's system. |
| Two distinct components to sign§ 11.200(a) | verifiedEmail (user ID) plus a Qualio password form the signature, also for SSO users. |
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Access and authority checks by role§ 11.10(d), (g) | verifiedAudit trail access needs the Quality User role. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Qualio's own pages. Ask Qualio for its validation documentation and test the control in your own validation before you rely on it.
Qualio's own Part 11 pageread 2026-10-22
ZenQMS
eQMSdocument control- What it is
- A cloud eQMS for life sciences with document control, version history and PDF export. The vendor shares its validation documentation at no extra cost.
- Who it fits
- Labs, biotech, CROs and CDMOs from early-stage startups up.
| Requirement | Status |
|---|---|
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedValidation plans and requirements shared at no extra cost; releases run under change control. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Access and authority checks by role§ 11.10(d), (g) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on ZenQMS's own pages. Ask ZenQMS for its validation documentation and test the control in your own validation before you rely on it.
ZenQMS's own Part 11 pageread 2026-10-22
Scilife
eQMSdocument control- What it is
- A pre-validated eQMS covering documents, training, CAPA, change control, deviations, audits and supplier qualification. Customers get an executed validation package from the start.
- Who it fits
- GMP pharma and biotech companies that want validation documents delivered with the system.
| Requirement | Status |
|---|---|
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedPlan, URS, risk assessment, IQ, OQ, PQ, trace matrix and summary reports. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedEvery record is attributed to a named user with a timestamp. |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Access and authority checks by role§ 11.10(d), (g) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Scilife's own pages. Ask Scilife for its validation documentation and test the control in your own validation before you rely on it.
Scilife's own Part 11 pageread 2026-10-22
SimplerQMS
eQMSdocument control- What it is
- A cloud eQMS with Microsoft Office integration for document control and other quality processes. The vendor says it validates the system to GAMP 5 and revalidates it with each release.
- Who it fits
- Device, biotech, CRO and pharma companies that want a ready-to-use eQMS.
| Requirement | Status |
|---|---|
| Validation documentation to support the customer's own validation§ 11.10(a) | not statedSimplerQMS says it validates the system itself; documents for customers are not described. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedRecords who made a change, to what, when and why. |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Signature shows name, date and time, and meaning§ 11.50 | verifiedCaptures the signer's name, date, time and meaning of the signature. |
| Access and authority checks by role§ 11.10(d), (g) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on SimplerQMS's own pages. Ask SimplerQMS for its validation documentation and test the control in your own validation before you rely on it.
SimplerQMS's own Part 11 pageread 2026-10-22
Dot Compliance eQMS
eQMS- What it is
- An eQMS built on the Salesforce platform with modules for documents, training, complaints, change, CAPA, quality events, suppliers and audits. A Salesforce licence is not required to use it.
- Who it fits
- Pharma, biotech and device companies that want an eQMS on the Salesforce platform.
| Requirement | Status |
|---|---|
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedA validation documentation package is available to all customers in the subscription. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Signature shows name, date and time, and meaning§ 11.50 | statedThe page names capture of the signature meaning; name and time are not described. |
| Access and authority checks by role§ 11.10(d), (g) | not stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Dot Compliance's own pages. Ask Dot Compliance for its validation documentation and test the control in your own validation before you rely on it.
Dot Compliance's own Part 11 pageread 2026-10-22
MasterControl Quality Excellence
eQMSdocument control- What it is
- A quality management suite covering document control, change control, training, audits, risk and quality events. MasterControl also offers validation tools with pre-written test protocols.
- Who it fits
- Life sciences manufacturers and labs, from startups to large companies, that want one suite for every quality process.
| Requirement | Status |
|---|---|
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedIQ, OQ and PQ test protocols offered to customers, updated with each build. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Two distinct components to sign§ 11.200(a) | verifiedA separate approval password is needed to sign, apart from the login password. |
| Signature shows name, date and time, and meaning§ 11.50 | verifiedSigned records capture the username, date and time, and meaning of the signature. |
| Access and authority checks by role§ 11.10(d), (g) | verifiedAdministrators set permissions for each user and each document vault. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on MasterControl's own pages. Ask MasterControl for its validation documentation and test the control in your own validation before you rely on it.
MasterControl's own Part 11 pageread 2026-10-22
How we read the vendors
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.
FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.
Some vendors' pages could not be read on the read date, so they are not on this page.
Questions
What counts as GxP compliance software?
There is no legal category. Software becomes GxP software when it holds a record that a GxP rule requires, such as a procedure, a deviation, a training record or a test result. FDA keeps no list of approved GxP or Part 11 software, so a vendor's GxP claim means it supports the controls; whether your use complies is something you show in your own validation.
Is GMP compliance software different from GxP compliance software?
GMP is one of the GxP areas, so GMP software is a subset. For a drug lab the GMP duties sit in 21 CFR 211, and the eQMS products on this page are sold for that work. A device maker's GMP rule is now the Quality Management System Regulation, effective February 2, 2026, which incorporates ISO 13485:2016 by reference; read the QMSR guide instead.
Can a small lab run on paper first?
Yes, for any duty you choose. Part 11 reaches records kept electronically under a predicate rule, and FDA's 2003 guidance says that when paper printouts meet the predicate rule and are relied on, using a computer to make them “would not trigger part 11”. The predicate rules still apply to the paper. FDA recommends you document that decision, for example in an SOP. The Part 11 applicability checker walks one record through it.
The vendor ships a validation package. Are we validated?
No. § 11.10(a) asks the regulated company to validate the system for its intended use. A package with test scripts or executed IQ, OQ and PQ saves you writing them, but you still decide what your use is, assess the risk, run or review the tests that matter for your configuration and sign the report.
Do we need a LIMS as well as an eQMS?
They do different jobs. The eQMS holds how you work: procedures, deviations, training. A LIMS holds what you measured: § 211.194(a) asks for complete data from all tests, and § 58.130(e) asks that the person entering data is identified and that changes never hide the original. Many labs start the second on paper notebooks and instrument printouts, then move it into a LIMS when volume grows.
How long do we keep the records the system holds?
Part 11 sets no period; the predicate rule does. Drug GMP: at least 1 year after the batch's expiration date (§ 211.180). GLP: the shortest of 2 years after approval, 5 years after submission, or 2 years after the study ends (§ 58.195). GCP investigators: 2 years after marketing approval, or 2 years after the investigation is discontinued and FDA is notified (§ 312.62(c)). Whatever system you buy has to keep the audit trail at least that long too (§ 11.10(e)).
We only do GCP work for a sponsor. What do we buy?
Possibly nothing of your own on day one. § 312.62(b) puts case histories, including signed and dated consent forms, on the investigator. If the sponsor supplies the EDC, your job is to use it under your own procedures and training. If you choose the system, compare it on the EDC and eConsent rows.
Sources
- 21 CFR Part 211, CGMP for Finished Pharmaceuticals (§§ 211.25, 211.68, 211.100, 211.180, 211.192, 211.194), eCFRread 2026-10-22
- 21 CFR Part 58, Good Laboratory Practice for Nonclinical Laboratory Studies (§§ 58.29, 58.35, 58.81, 58.130, 58.190, 58.195), eCFRread 2026-10-22
- 21 CFR Part 312, Investigational New Drug Application (§§ 312.57, 312.62), eCFRread 2026-10-22
- 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003 guidance), FDAread 2026-10-22
- Medical Devices; Quality System Regulation Amendments, 89 FR 7496, Federal Registerread 2026-10-22
- Qualio: Part 11 page, Qualioread 2026-10-22
- Qualio: validation documentation, Qualioread 2026-10-22
- ZenQMS: Part 11 page, ZenQMSread 2026-10-22
- Scilife: Part 11 page, Sciliferead 2026-10-22
- Scilife: validation documentation, Sciliferead 2026-10-22
- SimplerQMS: Part 11 page, SimplerQMSread 2026-10-22
- Dot Compliance eQMS: Part 11 page, Dot Complianceread 2026-10-22
- MasterControl Quality Excellence: Part 11 page, MasterControlread 2026-10-22
- MasterControl Quality Excellence: validation documentation, MasterControlread 2026-10-22