Any software that creates, modifies, or controls quality records in a regulated medical device company is subject to validation. Under FDA 21 CFR Part 11 and EU Annex 11, an electronic quality management system (eQMS) is not simply an IT tool. It is a validated computerised system, and its validation status must be established before it goes live and maintained throughout its lifecycle. Failure to validate, or to maintain validation after system changes, is a recurring Form 483 observation and a trigger for Warning Letters.
GAMP 5 provides the industry-standard risk-based framework for categorising software. A cloud eQMS typically falls into Category 4 (configurable software) or Category 5 (custom software), depending on how workflows and forms are built. The category determines the depth of testing and documentation required. Category 4 systems generally require documented configuration specifications alongside the standard IQ/OQ/PQ protocols. Category 5 systems carry a heavier burden because the custom logic itself must be verified.
A complete validation package for an eQMS covers several interlocking documents: a validation plan, a risk assessment, a requirements specification, installation qualification (IQ), operational qualification (OQ), performance qualification (PQ), a traceability matrix linking each requirement to at least one test script, and a validation summary report signed by quality leadership. Supplier documentation, including the vendor’s own quality management certificates and their Software Development Lifecycle (SDLC) documentation, feeds into but does not replace the user-site validation package.
That supplier-versus-user distinction matters in practice. A vendor’s ISO 9001 certificate or SOC 2 report demonstrates that their development process is controlled. It does not prove that the system, as configured for your workflows and your data, performs correctly in your environment. Inspectors from FDA, notified bodies, and competent authorities will ask for your validation package, your change control records for any post-validation configuration changes, and evidence of periodic review. They are not satisfied by pointing to the vendor’s documentation alone.
The whitepaper below walks through a practical eQMS validation approach, covering the key documents, common audit findings, and how qmsWrapper supports validation lifecycle management from initial qualification through ongoing change control.
