Part 11 compliant eQMS: what seven vendors say and what the rule requires
Published , reviewed
Verdict
- Best overall
- Veeva QMSEight of the ten rows are described on Veeva's own help pages, from signatures kept as read-only records tied to what was signed to audit history with no retention limit, and it runs deviations, CAPAs, change control, audits, complaints and supplier quality in one place. TrackWise Digital describes more rows, but from a vendor assessment dated March 2019; for a company that runs every quality process in one suite, Veeva's current help pages are the firmer evidence.
- Best for a small lab
- QualioIt covers the modules a small lab starts with (documents, training, CAPA, change control, events and audits), keeps the audit trail for the lifetime of the system, and gives customers a validation pack with test scripts and a Part 11 assessment.
- Best for a device maker
- Greenlight Guru QualityIt is built for medical device teams, with design controls and complaints beside CAPA, and provides an IQ protocol with completed OQ and PQ reports; its signature controls are claimed rather than described, so test them first.
Fig. 01An eQMS is where a regulated company's quality records live and get signed: SOPs, training, deviations, CAPAs, change controls, audits and supplier files. This page reads seven eQMS vendors against the ten Part 11 rows, then answers what the table cannot: which modules to switch on first, and how much of the system you validate yourself.
Requirement by requirement
Each cell says how far the vendor's own pages go on one control. TrackWise Digital has the most rows described, but they come from Sparta Systems' own Part 11 and Annex 11 assessment dated March 2019; we read it on 2026-10-22, and a current edition is the first thing to ask for. Greenlight Guru Quality and QT9 QMS describe the fewest controls on their public pages, which tells you what to test, not that the controls are missing.
Scroll sideways for all vendors
| Requirement | MasterControl Quality Excellence | Veeva QMS | Qualio | Greenlight Guru Quality | TrackWise Digital | Scilife | QT9 QMS |
|---|---|---|---|---|---|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verified | verified | stated | stated | verified | stated | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | stated | verified | stated | stated | verified | stated | stated |
| Two distinct components to sign§ 11.200(a) | verified | verified | verified | stated | verified | stated | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified | verified | verified | stated | verified | verified | verified |
| Audit trail kept as long as the record§ 11.10(e) | stated | verified | verified | stated | verified | stated | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | verified | verified | verified | verified | verified | verified | stated |
| Accurate, complete copies for inspection§ 11.10(b) | verified | verified | verified | stated | verified | stated | stated |
| Access and authority checks by role§ 11.10(d), (g) | verified | verified | verified | stated | verified | stated | stated |
| Open-system controls: encryption, digital signatures§ 11.30 | not stated | stated | not stated | not stated | not stated | not stated | not stated |
| EU Annex 11 statementEU GMP Annex 11 | not stated | stated | stated | not stated | verified | stated | not stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
How far each vendor's own pages go
Rows out of 10, counted from the table above. A count of published evidence, not a grade of the product.
- MasterControl Quality Excellence6 verified, 2 stated, 2 not stated
- Veeva QMS8 verified, 2 stated, 0 not stated
- Qualio6 verified, 3 stated, 1 not stated
- Greenlight Guru Quality1 verified, 7 stated, 2 not stated
- TrackWise Digital9 verified, 0 stated, 1 not stated
- Scilife2 verified, 7 stated, 1 not stated
- QT9 QMS1 verified, 7 stated, 2 not stated
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Which modules first: a small lab or a device maker
An eQMS is sold as a suite, but nobody goes live on every module at once, and every module you switch on is a module you validate. The order below follows the records your rules name and an inspector asks for, with the Part 11 control that matters most in each. Each row links the comparison for that module.
A GLP testing facility or a drug QC lab with a small QA team. The inspector opens the SOP file, then the training files, then the deviations.
- 01
Document control
21 CFR 58.81(a), (d); 21 CFR 211.100(a)
GLP asks for a historical file of every SOP and each revision with its date; drug CGMP asks that procedures, including any changes, be reviewed and approved by the quality control unit. Every other module points at an SOP number and version, so this one goes live first.
Part 11 to test first: § 11.50 on the approval: printed name, date and time, meaning. § 11.10(e) on each revision.
- 02
Training records
21 CFR 211.25(a)
Each person needs training in the operations they perform and in the written procedures behind them. Tie each training record to the SOP version it covers, or a revision leaves people trained on the wrong text.
Part 11 to test first: § 11.50 meaning on the sign-off (Trained, Read and understood). § 11.10(g) on who may sign it.
- 03
Deviations
21 CFR 211.100(b); 21 CFR 58.81(a)
"Any deviation from the written procedures shall be recorded and justified." Under GLP, study deviations from SOPs are authorised by the study director and documented in the raw data.
Part 11 to test first: § 11.10(e): edits to the description or the justification must not obscure what was first written.
- 04
Investigations and CAPA
21 CFR 211.192
"A written record of the investigation shall be made and shall include the conclusions and followup." The CAPA module is where that follow-up lives and is closed.
Part 11 to test first: § 11.10(f): the system enforces the order (no closure before the effectiveness check). § 11.70 on the closing signature.
- 05
QA inspections and audits
21 CFR 58.35(b)(3)
The QA unit keeps "written and properly signed records of each periodic inspection": the study, the phase inspected, who inspected, findings and the action taken.
Part 11 to test first: § 11.50 on the signed inspection record. § 11.10(d) to keep the reports to the QA unit.
Can wait. Supplier qualification and a separate change control module can wait until the core four hold real records; until then, changes ride through document control.
If you are still working out which rules bind you at all, start with the GxP compliance software guide, which maps software categories to GMP, GLP and GCP duties.
The ten rows across a whole quality system
On a single-purpose tool a requirement row has one job. In an eQMS the same control runs through every module, so a weak spot shows up everywhere at once. This is where each row does its work, and the one thing to ask the vendor to show you live.
Scroll sideways for all columns
| Requirement | Where it does its work in an eQMS | Ask the vendor to show you |
|---|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | Every SOP approval, training sign-off and CAPA closure, and the printout of each. § 11.50(b) wants the three items on any display or printout. | Print a signed SOP. Are the printed name, the date and time and the meaning on the paper, not only on screen? |
| Signature linked to its record so it cannot be moved§ 11.70 | Approvals carried into a PDF rendition, and signatures on a record that is later revised or reopened. | Revise an approved document. Does the old approval stay with the old version and never show on the new one? |
| Two distinct components to sign§ 11.200(a) | Every signing step, and above all single sign-on set-ups, where the login and the signature can blur. | With single sign-on on, what does the signer enter at the moment of signing, the first time and the second? |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | Deviation descriptions, investigation edits, CAPA due dates and training records, the fields people quietly fix. | Change a CAPA due date. Does the trail show the old value, the new value, who and when, with the old value still readable? |
| Audit trail kept as long as the record§ 11.10(e) | Records kept for years after a batch or device ships. Part 11 sets no period of its own; the predicate rule does. | What happens to the trail when we archive a record, and when we leave you? |
| Validation documentation to support the customer's own validation§ 11.10(a) | The starting point of your own validation, for each release the vendor ships into your tenant. | What is in the pack for the release we go live on, and how much notice do we get of the next one? |
| Accurate, complete copies for inspection§ 11.10(b) | An inspector asking for one CAPA, its linked deviation and its history, today. | Export one CAPA with its audit trail, as a readable document and as data. |
| Access and authority checks by role§ 11.10(d), (g) | Who may approve a change, close a CAPA, sign a training record for someone else, or read a draft audit report. | Show the role set-up. Try to approve as a user without the approver role. |
| Open-system controls: encryption, digital signatures§ 11.30 | A cloud eQMS. Open or closed turns on who controls access to the system, which is your call to document, not the vendor's. | Who at your company can reach our records, and how is that access granted and logged? |
| EU Annex 11 statementEU GMP Annex 11 | EU GMP sites, partners or customers who audit you against the EU guide. | Is there an Annex 11 assessment, and does it cover the modules we will switch on? |
Scoping the validation of an eQMS
§ 11.10(a) asks for "validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records." It binds the company using the system. A vendor that calls its eQMS pre-validated has done its half; the configured system is still yours to validate. For the full method see CSA vs CSV, and for tools that run the test execution itself see paperless validation software.
- 01
Write the intended use, module by module
List the modules you will switch on, the predicate-rule record each one holds, and who signs what with which meaning. A module you leave off is out of scope; a module you switch on later is a change. The URS template gives you the numbered requirement list to test against.
- 02
Sort each feature by process risk
FDA's CSA guidance covers software "used as part of production or the quality management system for medical devices", so a device maker's eQMS sits squarely inside it. It sorts features into high process risk, "when its failure to perform as intended may result in a quality problem that foreseeably compromises safety", and everything else. FDA wrote CSA for device makers; a drug or GLP lab often borrows its risk ideas. The CSA validation scope planner walks each feature through it.
- 03
Take the vendor's evidence, then test what only you configured
The vendor's pack covers its product. Your workflows, signature meanings, role set-up and any row marked stated in the table above are yours to test. CSA lets you consider unscripted testing for features that are not high process risk, and more rigour, such as scripted testing or a hybrid, for the ones that are.
- 04
Run the Part 11 checks on your own configuration
Print a signed record (§ 11.50), edit one and read the trail (§ 11.10(e)), export one for an inspector (§ 11.10(b)), and try to sign without the role (§ 11.10(g)). For records held in a vendor's cloud, CSA points the assurance at the features "relevant to the integrity of the records and 21 CFR Part 11 requirements applicable to the records".
- 05
Plan for the vendor's releases
A cloud eQMS changes under you on the vendor's timetable. Decide now how you read each release note, which tests you re-run and who signs the impact assessment. EU GMP Annex 11 asks for systems to be "periodically evaluated to confirm that they remain in a valid state".
What each vendor publishes about its validation pack
| Vendor | Status | What the vendor's page says |
|---|---|---|
| MasterControl Quality Excellence | verified | IQ, OQ and PQ test protocols offered to customers, updated with each build. |
| Veeva QMS | verified | A validation package binder for each release, in a vault customers can log in to. |
| Qualio | verified | Validation documents for customers are described on the vendor's own pages. |
| Greenlight Guru Quality | verified | An IQ protocol and completed OQ and PQ reports are provided. |
| TrackWise Digital | verified | A validation package is available for each release. |
| Scilife | verified | Plan, URS, risk assessment, IQ, OQ, PQ, trace matrix and summary reports. |
| QT9 QMS | stated | The vendor says validation documentation exists; its contents are not listed. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Common misreading
"Pre-validated" and "Part 11 compliant" describe the vendor's product. Part 11 binds the people who use the system, so the validation report an inspector reads has your name on it, not the vendor's.
Vendor by vendor
Each card shows the six rows that carry most weight across a quality system. Validation packs are covered above; the full ten rows are in the table at the top.
MasterControl Quality Excellence
eQMSdocument control- What it is
- A quality management suite covering document control, change control, training, audits, risk and quality events. MasterControl also offers validation tools with pre-written test protocols.
- Who it fits
- Life sciences manufacturers and labs, from startups to large companies, that want one suite for every quality process.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Signature shows name, date and time, and meaning§ 11.50 | verifiedSigned records capture the username, date and time, and meaning of the signature. |
| Two distinct components to sign§ 11.200(a) | verifiedA separate approval password is needed to sign, apart from the login password. |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedAudit trail data exports in human-readable form; reports print or export to spreadsheets. |
| Access and authority checks by role§ 11.10(d), (g) | verifiedAdministrators set permissions for each user and each document vault. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on MasterControl's own pages. Ask MasterControl for its validation documentation and test the control in your own validation before you rely on it.
MasterControl's own Part 11 pageread 2026-10-22
Veeva QMS
eQMS- What it is
- A cloud quality management application on the Veeva Vault platform. It runs deviations, CAPAs, change controls, internal and external audits, complaints, lab investigations and supplier quality.
- Who it fits
- Pharma, biotech and device companies that bring sites, suppliers and contract manufacturers into one system.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | verifiedDocument and object audit history have no retention limit. |
| Signature shows name, date and time, and meaning§ 11.50 | verifiedEach eSignature holds the signer's name, title, signing date and time, and the meaning chosen. |
| Two distinct components to sign§ 11.200(a) | verifiedSigners enter username and password; saved browser passwords are blocked. |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedAudit trails export to PDF or text/CSV. |
| Access and authority checks by role§ 11.10(d), (g) | verified |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Veeva Systems' own Part 11 pageread 2026-10-22
Qualio
eQMSdocument control- What it is
- A cloud quality management system for life sciences covering documents, training, CAPA, change control, events, audits, suppliers and design controls. Customers receive a validation pack with test scripts and a Part 11 assessment.
- Who it fits
- Drug, biotech, device and CRO teams building or replacing their eQMS.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | verifiedAudit trail records are kept for the lifetime of the customer's system. |
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Two distinct components to sign§ 11.200(a) | verifiedEmail (user ID) plus a Qualio password form the signature, also for SSO users. |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedAudit trail search and export are described. |
| Access and authority checks by role§ 11.10(d), (g) | verifiedAudit trail access needs the Quality User role. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Qualio's own pages. Ask Qualio for its validation documentation and test the control in your own validation before you rely on it.
Qualio's own Part 11 pageread 2026-10-22
Greenlight Guru Quality
eQMSdocument control- What it is
- An eQMS for medical device companies covering documents, CAPA and nonconformance, change control, audits, suppliers, training, complaints and design controls. The vendor says it is aligned with ISO 13485:2016.
- Who it fits
- Medical device teams from first design work through scale-up.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Access and authority checks by role§ 11.10(d), (g) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Greenlight Guru's own pages. Ask Greenlight Guru for its validation documentation and test the control in your own validation before you rely on it.
Greenlight Guru's own Part 11 pageread 2026-10-22
TrackWise Digital
eQMS- What it is
- A cloud quality management system covering quality events, deviations, CAPA, audits, change control, documents, training, complaints and supplier quality. Sparta Systems is part of Honeywell.
- Who it fits
- Pharma, biotech and device companies that want quality events, CAPA and change control in one system.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedRecords user ID, old and new value, and time stamp; entries cannot be deleted. |
| Audit trail kept as long as the record§ 11.10(e) | verified |
| Signature shows name, date and time, and meaning§ 11.50 | verifiedRead in the vendor's Part 11 and Annex 11 assessment, dated March 2019. |
| Two distinct components to sign§ 11.200(a) | verifiedUser ID and password; the password is needed at each signing. |
| Accurate, complete copies for inspection§ 11.10(b) | verified |
| Access and authority checks by role§ 11.10(d), (g) | verified |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Sparta Systems' own Part 11 pageread 2026-10-22
Scilife
eQMSdocument control- What it is
- A pre-validated eQMS covering documents, training, CAPA, change control, deviations, audits and supplier qualification. Customers get an executed validation package from the start.
- Who it fits
- GMP pharma and biotech companies that want validation documents delivered with the system.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedEvery record is attributed to a named user with a timestamp. |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Access and authority checks by role§ 11.10(d), (g) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Scilife's own pages. Ask Scilife for its validation documentation and test the control in your own validation before you rely on it.
Scilife's own Part 11 pageread 2026-10-22
QT9 QMS
eQMSdocument control- What it is
- A cloud quality management system with document control, automatic routing and Part 11 signatures. QT9 also sells an ERP that connects to it.
- Who it fits
- Device, pharmaceutical and other manufacturers, from startups up.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedDescribed as a secure, time- and user-stamped audit trail for all quality records. |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Two distinct components to sign§ 11.200(a) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Access and authority checks by role§ 11.10(d), (g) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on QT9 Software's own pages. Ask QT9 Software for its validation documentation and test the control in your own validation before you rely on it.
QT9 Software's own Part 11 pageread 2026-10-22
How we read the vendors
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.
FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.
Who is not in the table
Some eQMS vendors' pages could not be read on the read date, so they are left out rather than guessed at. A vendor missing here is a vendor we could not read, not one we ruled out.
Questions
What is an eQMS?
An electronic quality management system: software that holds the quality records a regulated company has to keep (controlled documents, training records, deviations, CAPAs, change controls, audits, complaints and supplier files) and routes each one through review and signed approval. Where those records are required by an FDA rule and kept electronically, Part 11 applies to them. What is GxP? sets out which rules those are.
Does FDA approve or certify eQMS software?
No. FDA keeps no list of certified or approved Part 11 software. Part 11 binds the persons who use a system, and the only certification in it is the letter a company sends FDA about its own electronic signatures (§ 11.100(c)). A vendor's Part 11 claim tells you what to test, not that testing is done.
Should a small lab buy a full eQMS or start with document control?
Start with the records your predicate rule names first: SOPs and their revisions, then training, then deviations. A full suite you only half use still has to be validated for what you switched on, and a module switched on later is a change to that validation. If documents are all you need this year, read the document control comparison and the SOP management comparison first.
Does Part 11 apply to every module of an eQMS?
Only to records kept under an FDA records requirement or submitted to FDA (§ 11.1(b)). Most eQMS modules hold exactly those records, but a scratch area or a meeting-notes space may not. FDA's 2003 guidance asks you to write that call down: "We recommend that you document this decision (e.g., in a Standard Operating Procedure (SOP), or specification document)."
Our vendor says the eQMS is pre-validated. Do we still validate?
Yes. § 11.10(a) asks the company using the system to validate it. The vendor's pack covers the product as shipped; your validation covers your configuration and intended use, sized by risk.
What does the QMSR change for a device maker's eQMS?
Since 2026-02-02 Part 820 incorporates ISO 13485:2016 by reference, so the modules follow its clauses, and § 820.35 adds content to complaint, servicing and UDI records. The QMSR "supplements regulations in other parts of this chapter", so Part 11 still applies. FDA also dropped the old exception that kept internal and supplier audit reports from investigators. More in FDA QMSR for small device makers and the medical device QMS comparison.
Is a cloud eQMS an open or a closed system?
It turns on who controls access to the system, not on where the server sits: a closed system is one where "system access is controlled by persons who are responsible for the content of electronic records" (§ 11.3(b)(4)). Two vendors in this lineup describe their systems as closed; the decision is still yours to document. Read Part 11 for cloud and SaaS systems.
Do we need an EU Annex 11 statement as well?
If you work under EU GMP, yes. Annex 11 overlaps Part 11 but adds supplier agreements, periodic evaluation, incident management, business continuity and archiving. The 2011 text is the one in force; a revision was consulted on in 2025.
Sources
- 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003), FDAread 2026-10-22
- Computer Software Assurance for Production and Quality Management System Software, FDAread 2026-10-22
- 21 CFR Part 58, Good Laboratory Practice (§§ 58.35, 58.81), eCFRread 2026-10-22
- 21 CFR Part 211, CGMP for Finished Pharmaceuticals (§§ 211.25, 211.100, 211.192), eCFRread 2026-10-22
- 21 CFR Part 820, Quality Management System Regulation (§§ 820.1, 820.10, 820.35), eCFRread 2026-10-22
- Medical Devices; Quality System Regulation Amendments, 89 FR 7496, Federal Registerread 2026-10-22
- EudraLex Volume 4, Annex 11: Computerised Systems, European Commissionread 2026-10-22