Supplier quality management software: six vendors read against the supplier file

Six records make up the file. The rules name them differently, and some do not name them at all: Part 211 never uses the words “audit” or “agreement”, while the device rule now runs through ISO 13485's purchasing clause, which the QMSR incorporates by reference. Choose a record to see what it holds, how it is signed, and what each rule says.

Device makers read the purchasing duty through the rule that took effect on February 2, 2026; our QMSR guide for small device makers covers the switch. Teams that also sell into the EU should read Annex 11 § 3 with the rest of the annex in our EU Annex 11 guide.

The system that holds your supplier file is itself bought from a supplier, and Annex 11 treats it that way. Formal agreements must exist with any third party that provides, configures, validates, maintains or retains a computerised system § 3.1; whether to audit that party is a risk decision § 3.2; and quality system and audit information on software suppliers should reach inspectors on request § 3.4. The QMSR preamble says the same of services: a consultant supplying advice is a supplier the manufacturer must assess 89 FR 7510. In clinical investigations FDA's 2024 Q&A asks for a written agreement with an IT service provider that includes “a plan that ensures the sponsor will have access to data throughout the regulatory retention period”.

So the eQMS vendor goes on your approved supplier list, with a file like any other:

• Its validation package and Part 11 assessment, for the release you runsupports your own validation § 11.10(a)
• A quality agreement or service agreement naming who does whatAnnex 11 § 3.1
• An audit, or the risk reason a questionnaire or remote review was enoughAnnex 11 § 3.2
• Release notes reviewed against your requirements before each upgradeAnnex 11 § 3.3
• How you get your records back, in full, for the whole retention period§ 11.10(c)

In this lineup, Veeva QMS, TrackWise Digital, Reliance, Dot Compliance eQMS and Qualio describe validation documentation for customers on their own pages. Ideagen Quality Management claims it without describing it, so ask to see the package before you sign. Veeva QMS, TrackWise Digital, Reliance, Dot Compliance eQMS and Qualio name EU Annex 11 on their own pages. Where the vendor hosts your records, read our guide to Part 11 for cloud and SaaS systems before you write the agreement, and put the supplier controls you need into your user requirement specification so validation tests them.

The rows run in the order a supplier record meets them: who may change a status, the signature on the change, the trail behind it, the copy an inspector asks for, then the vendor as your own supplier. The open-system row § 11.30 stays in because supplier portals put outside users on your system; read it with the FAQ below.

TrackWise Digital's statuses come from the vendor's Part 11 and Annex 11 assessment. We read it on 2026-10-22; the document itself is dated March 2019, so ask for the assessment that matches the release you would buy.

The same statuses, regrouped by the four jobs a supplier file asks of the software. Each cell counts the rows the vendor describes on its own pages; the rest are claimed or not covered, and the table above shows which.

On approving or disqualifying a supplier, Veeva QMS and TrackWise Digital describe every signature and authority row we read. On showing how a status changed, Veeva QMS, TrackWise Digital and Qualio describe both trail rows. For a team that audits suppliers on site, Ideagen's audits can run offline with checklists; Reliance has a supply chain quality application; Dot Compliance runs its supplier module on the Salesforce platform. A row the vendor only claims is a question for the demo, not a reason to drop it.

What makes supplier software different from a document system is not in our register: we read no vendor's pages on these controls, so we give no status. Make each vendor do them live.

1. 01

   Status blocks use

   Ask: Disqualify a supplier, then try to receive and release a lot from it.

   Weak answer: A warning you can click past, or a status kept as free text that nothing else reads.

   § 211.84(a); § 11.10(f)

2. 02

   Re-evaluation has a clock

   Ask: Show the suppliers whose re-qualification or certificate-of-analysis check is overdue.

   Weak answer: Due dates live in a spreadsheet beside the system.

   § 211.84(d)(2) “at appropriate intervals”; 89 FR 7510

3. 03

   A supplier answers its own SCAR

   Ask: Log in as a supplier user, answer a SCAR, then open the trail.

   Weak answer: The supplier can see other suppliers' requests, or your staff paste its answer in under their own names.

   § 11.10(d); § 11.10(e)

4. 04

   Finding to SCAR to CAPA

   Ask: Raise a finding in a supplier audit, issue a SCAR from it, escalate it to a CAPA, then walk back.

   Weak answer: Record numbers typed into text fields; the links do not show from both ends.

   Your own procedure; Clause 8.5.2 for device makers

5. 05

   The agreement in force for an old lot

   Ask: Revise a quality agreement, then show which version applied to a lot received last year.

   Weak answer: Only the current agreement is kept, or the old one is overwritten.

   § 11.10(e) “shall not obscure”; Annex 11 § 3.1

6. 06

   One supplier, one export

   Ask: Export a supplier's whole file: status history, qualification, agreement, audits and SCARs, signatures showing.

   Weak answer: Signatures drop off the printout, or the trail is a separate request to the vendor's support desk.

   § 11.10(b); § 11.50(b)

Two of these cross into neighbouring systems. Findings come from the audit management side, and a SCAR that escalates becomes a CAPA, read in our CAPA software comparison; check that the links hold in both directions.

Each card shows six rows a supplier approval leans on. Some quality vendors' pages could not be read on the read date, so they are not in this lineup; a missing vendor is not a verdict on it.

1. 21 CFR Part 211, CGMP for Finished Pharmaceuticals (§§ 211.22, 211.80, 211.82, 211.84, 211.184, 211.192), eCFRread 2026-10-22
2. Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496 (2024), Federal Registerread 2026-10-22
3. 21 CFR Part 820, Quality Management System Regulation, eCFRread 2026-10-22
4. EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22
5. Contract Manufacturing Arrangements for Drugs: Quality Agreements (guidance, November 2016), FDAread 2026-10-22
6. 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
7. Electronic Records; Electronic Signatures, final rule and preamble, 62 FR 13430 (1997), Federal Registerread 2026-10-22
8. Part 11, Electronic Records; Electronic Signatures: Scope and Application (guidance, 2003), FDAread 2026-10-22
9. Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (guidance, October 2024), FDAread 2026-10-22