Medical device QMS software: seven eQMS vendors read against the QMSR and Part 11
Published , reviewed
Verdict
- Best overall
- Greenlight Guru QualityBuilt for medical device teams from first design work through scale-up, it puts design controls and complaints beside CAPA, suppliers and training, says it is aligned with ISO 13485:2016, and gives customers an IQ protocol with completed OQ and PQ reports. Its signature and audit trail rows are claimed on its pages rather than described, so test them in the demo.
- Best for a first QMS
- QualioMade for teams building or replacing an eQMS, it covers design controls, documents, training, CAPA and suppliers, and customers receive a validation pack with test scripts and a Part 11 assessment; Qualio's own pages describe six of the eight rows in the table.
- Best for a growing manufacturer
- Veeva QMSBuilt to bring sites, suppliers and contract manufacturers into one system, it runs complaints, CAPAs, change controls, audits and supplier quality, and Veeva's help pages describe all eight rows in the table. Its product description does not name design controls, so ask where your design and development file will live.
Fig. 01Since February 2, 2026, FDA's device quality rule is the QMSR: Part 820 now incorporates ISO 13485:2016 by reference. For a small device maker that changed the questions to put to QMS software. The old record names are gone, internal audit reports are open to investigators, and the software that keeps it all is validated under the CSA guidance FDA reissued on February 3, 2026. This page maps the records first, then reads seven QMS vendors against the Part 11 rows that matter for a device file.
The records a device QMS holds now
The QMSR kept the content of the old Quality System regulation's files and dropped their names. FDA says the elements of the design history file, device master record and device history record "are largely required to be documented by ISO 13485", so each now has an ISO home. The table puts the old name beside the new one, quotes what FDA or Part 820 says each must hold, and shows which vendors in this comparison name the module in their product description. The rule-by-rule account of the change is in FDA QMSR for small device makers.
Scroll sideways for every column
| Record | Where it sits now | What it has to hold | Named in the product description of |
|---|---|---|---|
| Design and development filewas: Design history file (DHF) | § 820.10(c) and Clause 7.3 | FDA: Clause 7.3.10 requires the file "to contain or reference all the records necessary to establish compliance with design and development requirements, including the design and development plan and design and development procedures." It applies to class II and III devices and the listed class I devices, which include "Devices automated with computer software". What the QMSR changed for design records | Greenlight Guru Quality, Qualio |
| Medical device filewas: Device master record (DMR) | Clause 4.2.3 and § 820.45 | FDA: the file "will contain or reference the procedures and specifications that are current on the manufacturing floor." Product specifications and the procedures for manufacturing, measuring, monitoring and servicing that sat in the DMR "will now be located in the manufacturer's MDF". Labeling and packaging are inspected against it under § 820.45. Document control software compared | Greenlight Guru Quality, Qualio, MasterControl Quality Excellence, SimplerQMS, QT9 QMS, Reliance |
| Medical device or batch recordwas: Device history record (DHR) | Clause 7.5.1 and § 820.35(c) | FDA: "many of the requirements previously in the DHR are largely required to be in the medical device or batch record, as described in Clause 7.5.1." § 820.35(c) adds that the UDI "must be recorded for each medical device or batch of medical devices." Electronic batch record software compared | none of this lineup |
| Complaint records | § 820.35(a), Clause 8.2.2 and part 803 | For complaints reported under part 803, complaints you decide to investigate and complaints you investigated anyway, § 820.35(a) lists seven items: the device name, the date received, any UDI or UPC, the complainant's name, address and phone number, the nature and details, any correction or corrective action, and any reply. A complaint you do not investigate needs the reason recorded. CAPA software compared, complaints included | Greenlight Guru Quality, Veeva QMS |
| Nonconformance and CAPA recordswas: § 820.100 CAPA (removed) | Clauses 8.5.2 and 8.5.3 | FDA incorporated the corrective and preventive action requirements of ISO 13485 by reference, and manufacturers "must verify or validate corrective and preventive actions to ensure that such actions are effective and do not adversely affect the finished device." CAPA software compared | Greenlight Guru Quality, Qualio, Veeva QMS, Reliance |
| Supplier and purchasing records | Clause 7.4 | FDA: suppliers are evaluated on "ability and performance", in proportion to the "effect of the purchased product on the quality of" the finished device, and "monitoring and reevaluation of suppliers and the performance of purchased products is required." Supplier quality software compared | Greenlight Guru Quality, Qualio, Veeva QMS, Reliance |
| Training and competence records | Clause 6.2 | FDA reads Clause 6.2 as requiring that anyone doing work that affects quality is competent "on the basis of appropriate education, training, skills, and expertise". Training records software compared | Greenlight Guru Quality, Qualio, MasterControl Quality Excellence |
| Change control records | § 820.10(a) | Part of the documented quality system § 820.10(a) requires. It is where a change to a document, a process or a design gets its review and signed approval before it takes effect. Change control software compared | Greenlight Guru Quality, Qualio, MasterControl Quality Excellence, Veeva QMS, Reliance |
| Internal audit and management review recordswas: Exempt from inspection under old § 820.180(c) | Open to FDA investigators | FDA declined to keep the old exception for "management review, quality audits, and supplier audit reports", noting that "such records are maintained in the regular course of business and should be readily available." Audit management software compared | Greenlight Guru Quality, Qualio, MasterControl Quality Excellence, Veeva QMS, Reliance |
Last column: the vendors whose product description, as we recorded it from their own pages, names that module. A name missing there means the description we read does not mention it, not that the product lacks it; ask.
Common misreading
"The QMSR means we need ISO 13485 certification." It does not. FDA says in the final rule that it "does not intend to require medical device manufacturers to obtain ISO 13485 certification". You need a quality system that meets the standard as Part 820 incorporates it, and records that show it.
Where Part 11 applies in a device QMS
The QMSR does not switch Part 11 off. § 820.1(b) says it "supplements regulations in other parts of this chapter except where explicitly stated otherwise", and Part 11 is not excepted. FDA's CSA guidance draws the line for device makers in one sentence: "If a manufacturer maintains in electronic form a document required under Part 820, then Part 11 generally applies." A complaint record, a signed design review, a supplier evaluation and a training record all qualify once they live in an eQMS. A routine activity log that is not evidence of anything does not; CSA uses exactly that example.
On signatures, the rule's preamble is relaxed about method and strict about substance. An ISO 13485 "approved" record has a signature and date, and FDA's focus "is on whether the substance of the requirements is met and not the physicality of the record or signature methodology." In an eQMS the signature method is electronic, so the Part 11 signature rows (§ 11.50, § 11.70, § 11.200(a)) are what make that approval count. The Part 11 applicability checker runs one record at a time.
Inspection risk
Relying on the 2003 enforcement discretion to skip validating the eQMS. FDA's 2003 guidance does say FDA does not intend to take enforcement action on Part 11's validation requirement, but CSA states that this discretion "expressly does not apply to validation requirements for computer software used as part of production or the quality management system arising under Subclauses 4.1.6, 7.5.6, and 7.6 of ISO 13485." For a device maker, validating the QMS software is a QMSR duty, not a Part 11 one.
Requirement by requirement
Eight rows, chosen for a device file: the signature rows first, because design reviews, CAPA closures and supplier approvals are signed records, then access, the audit trail, copies for an investigator and the validation evidence a vendor hands over. On the vendors' own pages, Veeva QMS describes the most rows and Greenlight Guru Quality, QT9 QMS and Reliance describe the fewest. That tells you what to test in the demo, not that a control is missing.
Scroll sideways for all vendors
| Requirement | Greenlight Guru Quality | Qualio | MasterControl Quality Excellence | Veeva QMS | SimplerQMS | QT9 QMS | Reliance |
|---|---|---|---|---|---|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated | stated | verified | verified | verified | stated | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | stated | stated | stated | verified | stated | stated | stated |
| Two distinct components to sign§ 11.200(a) | stated | verified | verified | verified | stated | stated | stated |
| Access and authority checks by role§ 11.10(d), (g) | stated | verified | verified | verified | stated | stated | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated | verified | verified | verified | verified | verified | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated | verified | stated | verified | stated | stated | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated | verified | verified | verified | stated | stated | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | verified | verified | verified | verified | not stated | stated | verified |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Two rows left out
Open-system controls (§ 11.30) are not here because the open or closed call is yours: it turns on who controls access, and you document it. Run the open vs closed system check. The EU Annex 11 row is left out because Annex 11 is EU GMP guidance for medicinal products. Both rows, for the same products, are in the eQMS comparison.
Validating the QMS itself, the CSA way
CSA, the guidance FDA reissued on February 3, 2026 for production and quality management system software, is written for exactly this job. Its list of features that are generally not high process risk reads like an eQMS module list: software "used as part the quality management system for Corrective and Preventive Actions (CAPA) routing, automated logging/tracking of complaints, automated change control management, or automated procedure management". For those, CSA says you may consider unscripted testing. For a feature whose failure "may result in a quality problem that foreseeably compromises safety", it suggests more rigour, such as scripted testing or a hybrid of the two.
The vendor's own work counts too. CSA says a manufacturer could take the developer's validation work "as the starting point and determine what additional activities may be needed", and for some lower-risk features "this may be all the assurance that is needed". The method is laid out in CSA vs CSV, and the CSA validation scope planner sorts each feature for you. Start with the records you will actually hold at go-live.
Your go-live scope
Pick the records your eQMS holds on day one. Pre-filled for a class II maker before its first clearance.
On CSA's not-high-process-risk list
3 of 6 records
Design and development filea CSA worked example
CSA gives no design-control example. Its nearest is a SaaS product life cycle system used for project records, which "does not directly impact patient safety or product quality but does maintain a quality record where integrity of the data is needed."
Part 11 rows to test: Signature shows name, date and time, and meaning § 11.50; Signature linked to its record so it cannot be moved § 11.70; Secure, computer-generated, time-stamped audit trail § 11.10(e); Audit trail kept as long as the record § 11.10(e)
Named by: Greenlight Guru Quality, Qualio
Medical device fileon CSA's not-high list
On CSA's list of features that are generally not high process risk: software used for "automated procedure management".
Part 11 rows to test: Signature shows name, date and time, and meaning § 11.50; Signature linked to its record so it cannot be moved § 11.70; Access and authority checks by role § 11.10(d), (g); Accurate, complete copies for inspection § 11.10(b)
Named by: Greenlight Guru Quality, Qualio, MasterControl Quality Excellence, SimplerQMS, QT9 QMS, Reliance
Nonconformance and CAPA recordson CSA's not-high list
On CSA's list: "Corrective and Preventive Actions (CAPA) routing". CSA's first worked example is a nonconformance management system.
Part 11 rows to test: Signature shows name, date and time, and meaning § 11.50; Signature linked to its record so it cannot be moved § 11.70; Secure, computer-generated, time-stamped audit trail § 11.10(e); Access and authority checks by role § 11.10(d), (g)
Named by: Greenlight Guru Quality, Qualio, Veeva QMS, Reliance
Supplier and purchasing recordsyour own risk call
Not on CSA's list, but every CSA worked example starts with a vendor assessment kept under purchasing controls. The vendor of your eQMS is itself a supplier in this file.
Part 11 rows to test: Access and authority checks by role § 11.10(d), (g); Secure, computer-generated, time-stamped audit trail § 11.10(e); Accurate, complete copies for inspection § 11.10(b)
Named by: Greenlight Guru Quality, Qualio, Veeva QMS, Reliance
Training and competence recordsa CSA worked example
CSA's second worked example is a learning management system.
Part 11 rows to test: Signature shows name, date and time, and meaning § 11.50; Signature linked to its record so it cannot be moved § 11.70; Secure, computer-generated, time-stamped audit trail § 11.10(e)
Named by: Greenlight Guru Quality, Qualio, MasterControl Quality Excellence
Change control recordson CSA's not-high list
On CSA's list: software used for "automated change control management".
Part 11 rows to test: Signature shows name, date and time, and meaning § 11.50; Secure, computer-generated, time-stamped audit trail § 11.10(e); Access and authority checks by role § 11.10(d), (g)
Named by: Greenlight Guru Quality, Qualio, MasterControl Quality Excellence, Veeva QMS, Reliance
Validation documentation for customers, by vendor
- verifiedGreenlight Guru Quality, Qualio, MasterControl Quality Excellence, Veeva QMS and Reliance
- statedQT9 QMS
- not statedSimplerQMS
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
A cloud eQMS also changes on the vendor's timetable. In CSA's SaaS example the vendor documents the changes and testing in each automatic update, and the manufacturer "performs an assessment of the changes and the effect they may have on the intended use", then re-tests in proportion. Agree that release-note format with the vendor before you sign.
Once the QMS is live, its first real test is usually a CAPA. The CAPA software comparison reads the same rows against that one workflow, from the nonconformance to the signed effectiveness check.
Vendor by vendor
Each card shows the six rows a device file leans on most: the signature, its two components, the audit trail and how long it is kept, copies for an investigator, and the validation pack. The full set is in the table above.
Greenlight Guru Quality
eQMSdocument control- What it is
- An eQMS for medical device companies covering documents, CAPA and nonconformance, change control, audits, suppliers, training, complaints and design controls. The vendor says it is aligned with ISO 13485:2016.
- Who it fits
- Medical device teams from first design work through scale-up.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedAn IQ protocol and completed OQ and PQ reports are provided. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Greenlight Guru's own pages. Ask Greenlight Guru for its validation documentation and test the control in your own validation before you rely on it.
Greenlight Guru's own Part 11 pageread 2026-10-22
Qualio
eQMSdocument control- What it is
- A cloud quality management system for life sciences covering documents, training, CAPA, change control, events, audits, suppliers and design controls. Customers receive a validation pack with test scripts and a Part 11 assessment.
- Who it fits
- Drug, biotech, device and CRO teams building or replacing their eQMS.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Two distinct components to sign§ 11.200(a) | verifiedEmail (user ID) plus a Qualio password form the signature, also for SSO users. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | verifiedAudit trail records are kept for the lifetime of the customer's system. |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedAudit trail search and export are described. |
| Validation documentation to support the customer's own validation§ 11.10(a) | verified |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Qualio's own pages. Ask Qualio for its validation documentation and test the control in your own validation before you rely on it.
Qualio's own Part 11 pageread 2026-10-22
MasterControl Quality Excellence
eQMSdocument control- What it is
- A quality management suite covering document control, change control, training, audits, risk and quality events. MasterControl also offers validation tools with pre-written test protocols.
- Who it fits
- Life sciences manufacturers and labs, from startups to large companies, that want one suite for every quality process.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verifiedSigned records capture the username, date and time, and meaning of the signature. |
| Two distinct components to sign§ 11.200(a) | verifiedA separate approval password is needed to sign, apart from the login password. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedAudit trail data exports in human-readable form; reports print or export to spreadsheets. |
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedIQ, OQ and PQ test protocols offered to customers, updated with each build. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on MasterControl's own pages. Ask MasterControl for its validation documentation and test the control in your own validation before you rely on it.
MasterControl's own Part 11 pageread 2026-10-22
Veeva QMS
eQMS- What it is
- A cloud quality management application on the Veeva Vault platform. It runs deviations, CAPAs, change controls, internal and external audits, complaints, lab investigations and supplier quality.
- Who it fits
- Pharma, biotech and device companies that bring sites, suppliers and contract manufacturers into one system.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verifiedEach eSignature holds the signer's name, title, signing date and time, and the meaning chosen. |
| Two distinct components to sign§ 11.200(a) | verifiedSigners enter username and password; saved browser passwords are blocked. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | verifiedDocument and object audit history have no retention limit. |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedAudit trails export to PDF or text/CSV. |
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedA validation package binder for each release, in a vault customers can log in to. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Veeva Systems' own Part 11 pageread 2026-10-22
SimplerQMS
eQMSdocument control- What it is
- A cloud eQMS with Microsoft Office integration for document control and other quality processes. The vendor says it validates the system to GAMP 5 and revalidates it with each release.
- Who it fits
- Device, biotech, CRO and pharma companies that want a ready-to-use eQMS.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verifiedCaptures the signer's name, date, time and meaning of the signature. |
| Two distinct components to sign§ 11.200(a) | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedRecords who made a change, to what, when and why. |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | not statedSimplerQMS says it validates the system itself; documents for customers are not described. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on SimplerQMS's own pages. Ask SimplerQMS for its validation documentation and test the control in your own validation before you rely on it.
SimplerQMS's own Part 11 pageread 2026-10-22
QT9 QMS
eQMSdocument control- What it is
- A cloud quality management system with document control, automatic routing and Part 11 signatures. QT9 also sells an ERP that connects to it.
- Who it fits
- Device, pharmaceutical and other manufacturers, from startups up.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedDescribed as a secure, time- and user-stamped audit trail for all quality records. |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on QT9 Software's own pages. Ask QT9 Software for its validation documentation and test the control in your own validation before you rely on it.
QT9 Software's own Part 11 pageread 2026-10-22
Reliance
eQMS- What it is
- A configurable cloud quality management platform, formerly ETQ Reliance, with applications for document control, CAPA, change, audits, nonconformance and supply chain quality. Its Life Sciences Compliance application adds Part 11 controls and validation support.
- Who it fits
- Larger manufacturers and life sciences companies with many quality processes to configure.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedA Validation Execution Package for self-validation, or validation consulting. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Octave's own pages. Ask Octave for its validation documentation and test the control in your own validation before you rely on it.
Octave's own Part 11 pageread 2026-10-22
How we read the vendors
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.
FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.
Who is not in the table
Some QMS vendors' pages could not be read on the read date. They are left out rather than guessed at, so a vendor missing here is one we could not read, not one we ruled out.
Questions
What is a medical device quality management system?
The documented system a device maker runs its quality work through. Since February 2, 2026, § 820.10(a) requires a manufacturer to "Document a quality management system that complies with the applicable requirements of ISO 13485" plus the rest of Part 820. QMS software (an eQMS) is where its records live and get signed. For the same products read across every quality process, not just device work, see the Part 11 compliant eQMS comparison.
Does the QMSR require ISO 13485 certification?
No. In the final rule FDA says it "does not intend to require medical device manufacturers to obtain ISO 13485 certification and will not rely on ISO 13485 certificates to conduct its regulatory oversight", and that an FDA inspection "will not result in the issuance of a certificate of conformity". A certificate may still matter to other regulators and customers; it does not replace an FDA inspection.
What happened to the DHF, DMR and DHR?
FDA dropped the names, not the content. It "eliminated terms associated with these specific record types" because their elements "are largely required to be documented by ISO 13485", and it calls the ISO recordkeeping requirements "substantively similar". The design history file maps to the design and development file, the device master record to the medical device file, and the device history record to the medical device or batch record.
Renaming folders in your eQMS is optional; the content each file must contain or reference is not.
Does Part 11 apply to the records in our eQMS?
Generally, yes. FDA's CSA guidance puts it plainly: "If a manufacturer maintains in electronic form a document required under Part 820, then Part 11 generally applies." Its counter-example is a routine activity log that is not needed as evidence of a validated state, where Part 11 would not apply. Decide each record and write the result down.
We have not been cleared yet. Which records come first?
The design record. For class II and III devices, and class I devices automated with computer software, the design and development clause applies, and FDA says the final design output kept in the design and development file "forms the basis or starting point for the MDF". Design records you never captured cannot be rebuilt later, so the design module, document control and training usually go live before complaints and servicing. The scope builder above is pre-filled that way.
Can FDA investigators now read our internal audit and management review reports?
Yes. The old Quality System regulation kept them out of inspections under § 820.180(c); the QMSR does not. FDA declined to keep the exception, noting that "such records are maintained in the regular course of business and should be readily available." Write audit findings and management review minutes as records an investigator will read, and make sure the eQMS can export them complete. See audit management software.
Is our eQMS vendor a supplier under purchasing controls?
In practice, yes. Each of the worked examples in FDA's CSA guidance starts with an assessment of the software vendor, kept "according to their established purchasing control procedures". For a SaaS system the example adds a service agreement covering "security, data integrity, privacy, availability, change management, and business continuity". More in Part 11 for cloud and SaaS systems.
Do device makers need an EU Annex 11 statement?
Usually not for device work. Annex 11 is part of the EU's GMP guidance for medicinal products, with its legal basis in the medicines directives (Directive 2001/83/EC for human medicines), so the row is left out of the table above. If you also make medicines, or a customer audits you against EU GMP, read EU Annex 11 for US labs and device makers.
Sources
- 21 CFR Part 820, Quality Management System Regulation (§§ 820.1, 820.10, 820.35, 820.45), eCFRread 2026-10-22
- Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496 (preamble pp. 7504–7518), Federal Registerread 2026-10-22
- Computer Software Assurance for Production and Quality Management System Software (issued February 3, 2026), FDAread 2026-10-22
- Computer Software Assurance guidance, PDF (pp. 10, 15, 21–22 and Appendix A), FDAread 2026-10-22
- 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003), FDAread 2026-10-22
- EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22