Document control software under Part 11: what seven vendors publish and what the rule asks
Published , reviewed
Verdict
- Best overall
- Veeva QualityDocs8 of 9 rows verified on Veeva's own help pages, the most in this lineup, with each signature kept as a read-only record of name, date and time, and meaning, audit history with no retention limit, and periodic review and controlled copies built into the document lifecycle.
- Best for a small lab
- QualioMade for drug, biotech, device and CRO teams building their eQMS, with 6 of 9 rows verified: signing with user ID plus a Qualio password, an audit trail kept for the life of the system, and a validation pack with test scripts and a Part 11 assessment, the document a small lab would otherwise write itself.
- Best for a manufacturer
- MasterControl Quality ExcellenceOne suite covers document control, change control and training, the three processes a manufacturer's document revision runs through, plus audits, risk and quality events; 6 of 9 rows are verified, among them a separate approval password apart from the login and IQ, OQ and PQ protocols updated with each build.
Fig. 01Document control is where many labs meet Part 11 first. The SOP approval moves from ink to a click, and that click becomes the signature the predicate rule relies on. This page reads seven document control systems against the Part 11 rows that matter for controlled documents, using only what each vendor publishes, and walks one SOP through its life so you know what to make each vendor show you in a demo.
What document control has to do
A controlled document lives through ten stages, from a numbered draft to a retired version an inspector can still pull. Pick a stage to see what the system must do, the rule that asks for it, and the test to run in a vendor demo. Where a stage maps to a row in the vendor table, you see who has it verified.
Stage 01 of 10
Draft and number
Every document gets a unique number and a version, and a draft can never be mistaken for the version in force.
EU GMP Chapter 4, 4.3
“Documents should have unambiguous contents and be uniquely identifiable.”
Part 11 says nothing about numbering. The predicate rule and your own document control SOP do.
Ask the vendor to show you
Create a draft SOP and show where its number, version and draft state appear on screen and on a printout.
In the vendor table
No Part 11 row covers this stage. It is a document control feature: test it in the demo and write it into your requirements.
All 10 tests as plain text, for your next vendor call.
Inspection risk
A bench copy at version 3 when the system shows version 4 in force. The work at that bench did not follow the approved procedure, and § 211.100(b) says written procedures “shall be followed”. Test the recall of old copies in every demo, not only the approval.
Which rule asks for it
Part 11 does not ask for document control. Your predicate rule does, and Part 11 joins the moment the approval, the history or the copy is electronic and relied on. Find your row:
| Who | Rule | What it asks of documents |
|---|---|---|
| Drug manufacturing and QC labs | 21 CFR 211 § 211.100(a), § 211.22(c) | Procedures and every change to them are drafted, reviewed and approved, then “reviewed and approved by the quality control unit”, which is responsible for “approving or rejecting all procedures or specifications impacting on the identity, strength, quality, and purity of the drug product.” |
| Nonclinical (GLP) labs | 21 CFR 58 § 58.81(a), (c), (d) | Significant SOP changes “properly authorized in writing by management”; SOPs “immediately available” in each lab area; a historical file of every revision with its date. |
| Device makers | 21 CFR 820 § 820.10(a) | Document a quality management system that complies with ISO 13485. FDA's QMSR preamble: “Clause 4.2.4 of ISO 13485 specifies that documents required by the quality management system shall be controlled.” |
| EU GMP sites and their suppliers | EU GMP Chapter 4, 4.1 to 4.5 | Controls for master documents and official copies; instructions “approved, signed and dated”, uniquely identifiable, with a defined effective date; documents “regularly reviewed and kept up-to-date”. |
| Any of the above, once approvals are electronic | 21 CFR 11 §§ 11.10, 11.50, 11.70, 11.200 | The signed approval shows name, date and time, and meaning; it is linked so it cannot be moved to another record; it takes two components; changes leave an audit trail that never hides the old entry. |
Common misreading
Reading § 11.10(k) as “Part 11 requires document control for all your SOPs”. It covers the documentation for running and maintaining the system itself: “Adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance.” Your SOPs are controlled because § 211.100, § 58.81, ISO 13485 or Chapter 4 say so. For the full text of each control, see Part 11 requirements, section by section.
Requirement by requirement
9 rows, in the order a document lives them: the signed approval, who may sign, the history, the copy for an inspector, the vendor's validation support and its EU Annex 11 statement. We left out the open-system row: whether a hosted system is open or closed turns on who controls access (§ 11.3(b)(4) and (9)), which the open vs closed system check settles for your set-up.
Scroll sideways for all vendors
| Requirement | MasterControl Quality Excellence | Veeva QualityDocs | Qualio | SimplerQMS | ZenQMS | Montrium QMS Document Control | QT9 QMS |
|---|---|---|---|---|---|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verified | verified | stated | verified | stated | stated | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | stated | verified | stated | stated | stated | stated | stated |
| Two distinct components to sign§ 11.200(a) | verified | verified | verified | stated | stated | stated | stated |
| Access and authority checks by role§ 11.10(d), (g) | verified | verified | verified | stated | stated | stated | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified | verified | verified | verified | stated | stated | verified |
| Audit trail kept as long as the record§ 11.10(e) | stated | verified | verified | stated | stated | not stated | stated |
| Accurate, complete copies for inspection§ 11.10(b) | verified | verified | verified | stated | stated | stated | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | verified | verified | verified | not stated | verified | verified | stated |
| EU Annex 11 statementEU GMP Annex 11 | not stated | not stated | stated | stated | not stated | stated | not stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Reading the table
Veeva QualityDocs, MasterControl Quality Excellence and Qualio publish the control itself for most rows, on help pages or validation papers we could read. ZenQMS, Montrium QMS Document Control and QT9 QMS make most of the same points as a general Part 11 claim, so those rows read stated: the control may well be there, but their own pages do not show it. Ask for the validation pack before the demo.
Watch the § 11.70 row. In document control a signature must stay with the version it approved and never carry over to the next one, yet only one of the seven vendors describes how the link is made. Test it: approve version 2, start version 3, and check the approval did not follow.
| Vendor | verified | stated | not stated |
|---|---|---|---|
| Veeva QualityDocs | 8 of 9 | 0 of 9 | 1 of 9 |
| Qualio | 6 of 9 | 3 of 9 | 0 of 9 |
| MasterControl Quality Excellence | 6 of 9 | 2 of 9 | 1 of 9 |
| SimplerQMS | 2 of 9 | 6 of 9 | 1 of 9 |
| ZenQMS | 1 of 9 | 7 of 9 | 1 of 9 |
| Montrium QMS Document Control | 1 of 9 | 7 of 9 | 1 of 9 |
| QT9 QMS | 1 of 9 | 7 of 9 | 1 of 9 |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Vendor by vendor
Each card says what the product is, who it is built for, and six rows on the signed approval and the document's history, with the vendor's note where it gave one.
MasterControl Quality Excellence
eQMSdocument control- What it is
- A quality management suite covering document control, change control, training, audits, risk and quality events. MasterControl also offers validation tools with pre-written test protocols.
- Who it fits
- Life sciences manufacturers and labs, from startups to large companies, that want one suite for every quality process.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verifiedSigned records capture the username, date and time, and meaning of the signature. |
| Signature linked to its record so it cannot be moved§ 11.70 | stated |
| Two distinct components to sign§ 11.200(a) | verifiedA separate approval password is needed to sign, apart from the login password. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedAudit trail data exports in human-readable form; reports print or export to spreadsheets. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on MasterControl's own pages. Ask MasterControl for its validation documentation and test the control in your own validation before you rely on it.
MasterControl's own Part 11 pageread 2026-10-22
Veeva QualityDocs
document control- What it is
- A regulated quality content management application on the Veeva Vault platform. It runs document lifecycles, periodic review reminders, controlled copies and read-and-understood sign-off.
- Who it fits
- GxP companies that need controlled SOPs and quality documents shared with internal and external parties.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verifiedEach eSignature holds the signer's name, title, signing date and time, and the meaning chosen. |
| Signature linked to its record so it cannot be moved§ 11.70 | verifiedEach eSignature is a read-only child record that points to the record that was signed. |
| Two distinct components to sign§ 11.200(a) | verifiedSigners enter username and password; saved browser passwords are blocked. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | verifiedDocument and object audit history have no retention limit. |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedAudit trails export to PDF or text/CSV. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Veeva Systems' own Part 11 pageread 2026-10-22
Qualio
eQMSdocument control- What it is
- A cloud quality management system for life sciences covering documents, training, CAPA, change control, events, audits, suppliers and design controls. Customers receive a validation pack with test scripts and a Part 11 assessment.
- Who it fits
- Drug, biotech, device and CRO teams building or replacing their eQMS.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | stated |
| Two distinct components to sign§ 11.200(a) | verifiedEmail (user ID) plus a Qualio password form the signature, also for SSO users. |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | verifiedAudit trail records are kept for the lifetime of the customer's system. |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedAudit trail search and export are described. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Qualio's own pages. Ask Qualio for its validation documentation and test the control in your own validation before you rely on it.
Qualio's own Part 11 pageread 2026-10-22
SimplerQMS
eQMSdocument control- What it is
- A cloud eQMS with Microsoft Office integration for document control and other quality processes. The vendor says it validates the system to GAMP 5 and revalidates it with each release.
- Who it fits
- Device, biotech, CRO and pharma companies that want a ready-to-use eQMS.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verifiedCaptures the signer's name, date, time and meaning of the signature. |
| Signature linked to its record so it cannot be moved§ 11.70 | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedRecords who made a change, to what, when and why. |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on SimplerQMS's own pages. Ask SimplerQMS for its validation documentation and test the control in your own validation before you rely on it.
SimplerQMS's own Part 11 pageread 2026-10-22
ZenQMS
eQMSdocument control- What it is
- A cloud eQMS for life sciences with document control, version history and PDF export. The vendor shares its validation documentation at no extra cost.
- Who it fits
- Labs, biotech, CROs and CDMOs from early-stage startups up.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | statedSignatures attach to the document version they belong to. |
| Two distinct components to sign§ 11.200(a) | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on ZenQMS's own pages. Ask ZenQMS for its validation documentation and test the control in your own validation before you rely on it.
ZenQMS's own Part 11 pageread 2026-10-22
Montrium QMS Document Control
document controle-signature- What it is
- The document control module of Montrium's QMS, with periodic review scheduling, PDF conversion and e-signatures supported by Adobe Acrobat Sign. Montrium supplies a validation template package for each major release.
- Who it fits
- Growing life sciences companies that need SOP and document control first.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | not stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Montrium's own pages. Ask Montrium for its validation documentation and test the control in your own validation before you rely on it.
Montrium's own Part 11 pageread 2026-10-22
QT9 QMS
eQMSdocument control- What it is
- A cloud quality management system with document control, automatic routing and Part 11 signatures. QT9 also sells an ERP that connects to it.
- Who it fits
- Device, pharmaceutical and other manufacturers, from startups up.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedDescribed as a secure, time- and user-stamped audit trail for all quality records. |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on QT9 Software's own pages. Ask QT9 Software for its validation documentation and test the control in your own validation before you rely on it.
QT9 Software's own Part 11 pageread 2026-10-22
How we read the vendors
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.
FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.
Some vendors' pages could not be read on the read date, so they are not in this lineup rather than shown with guesses. Device makers comparing the wider quality system should also read the Part 11 eQMS comparison and the QMSR guide for small device makers; if training on new versions is the pain, the SOP management software comparison reads that side.
Takeaway
Shortlist on fit, then make every vendor run the demo script, stated rows first. Write what you saw into your validation, as the computer system validation guide lays out.
Before you buy: Word, a shared drive and wet ink
Many small labs run document control on Word templates, a shared drive and a paper binder of signed originals. That can hold up. FDA's 2003 guidance says that when you rely on signed paper printouts that meet the predicate rule, the computer used to write them does not bring Part 11 in. Record the decision in your document control SOP, keep the signed paper as the original, and the shared drive is a drafting space, not the record.
Start with the SOP template: it builds a controlled-document header, a revision history and an approval block with the meaning of each signature. Track who read which version with the training record template.
Fails the rule
A typed name on the approval page of a Word file, saved to a shared folder and treated as the approval. If that file is the record you rely on, the typed name is standing in for the signature § 211.100(a) requires. It then has to meet Part 11: a printed name, date and time, and meaning controlled with the record (§ 11.50), and two distinct components to sign (§ 11.200(a)). A typed name has neither.
The point to move to software is usually one of three: approvals start happening away from the paper (remote reviewers, a contract site signing off), the binder can no longer show which version is in force at each bench, or an inspector or customer audit asks for the history of an SOP and it takes a day to rebuild. Check a signed record against the rule first with the signature manifestation check, and read what an audit trail must capture before you judge a vendor's.
Takeaway
Paper with wet ink is a valid system if it is run as one. Buy software when the paper can no longer prove which version was in force and who approved it, not because a vendor calls Word non-compliant.
Questions
Does FDA certify document control software as Part 11 compliant?
No. FDA keeps no list of certified or approved Part 11 software. Part 11 binds the people who use a system, and the only certification in it is your own letter to FDA that your electronic signatures are legally binding (§ 11.100(c)). A vendor's Part 11 claim means its product can support the controls; you still validate it for your use (§ 11.10(a)) and write the policies around it.
We print SOPs and sign them in ink. Do we need Part 11 document control at all?
Not for the approvals. FDA's 2003 guidance says that when paper printouts meet the predicate rule and you rely on the paper, the computer used to make them does not trigger Part 11. It even notes that validation would not be important for a word processor used only to generate SOPs. Write that decision down in an SOP.
The predicate rule still applies to the paper: approval, a history of revisions, the current version at the bench. The Part 11 applicability checker walks one record through the question.
Is a PDF signed in an e-signature tool enough for document control?
It can cover the signature: manifestation (§ 11.50) and linking (§ 11.70) are what e-signature tools are judged on, and our e-signature software comparison reads them row by row. It does not cover numbering, effective dates, controlled copies, periodic review or retiring the old version. Those stay with a procedure or a document control system.
How often do SOPs need a periodic review?
Part 11 names no interval, and neither do § 211.100 or § 58.81. EU GMP Chapter 4 asks that documents be “regularly reviewed and kept up-to-date” (4.5) without a number. Set the interval in your own document control SOP, by risk, and make the system enforce it with a dated record of each review.
Document control software, SOP management software or a full eQMS: which do we need?
Document control is the core: versions, signed approval, effective dates, copies, retirement. SOP management adds the training side, read-and-understood sign-off tied to each version; see the SOP management software comparison. An eQMS puts CAPA, deviations, change control and audits on the same records; see the Part 11 eQMS comparison. Several vendors here sell all three, so buy for the processes you will run in the first year.
Does the vendor's validation pack mean the system is validated?
No. A vendor's IQ, OQ and PQ protocols or executed pack shorten the work, but § 11.10(a) asks the user to validate for accuracy, reliability, intended performance and the ability to spot altered records. Start from your own requirements (the URS template writes them) and test the stages in the demo script above against them.
How long do we keep superseded versions?
Part 11 sets no retention period; the predicate rule does. GLP labs keep a historical file of every SOP revision with its date (§ 58.81(d)), and § 11.10(c) asks that electronic records stay retrievable for the whole retention period. Retire old versions from use, never from the archive.
Sources
Regulation text from the eCFR and the European Commission; guidance from FDA; vendor statuses from each vendor's own pages, linked on its card. General information, not regulatory advice.
- 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR), eCFRread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003 guidance), FDAread 2026-10-22
- 21 CFR 211.100, Written procedures; deviations, eCFRread 2026-10-22
- 21 CFR 211.22, Responsibilities of quality control unit, eCFRread 2026-10-22
- 21 CFR 58.81, Standard operating procedures, eCFRread 2026-10-22
- 21 CFR 820.10, Requirements for a quality management system, eCFRread 2026-10-22
- Medical Devices; Quality System Regulation Amendments, 89 FR 7496, Federal Registerread 2026-10-22
- EudraLex Volume 4, Chapter 4: Documentation (January 2011), European Commissionread 2026-10-22
- EudraLex Volume 4, GMP guidelines index, European Commissionread 2026-10-22