What is QMS?
A quality management system (QMS) is the documented framework that defines how a company manages quality: the policies, procedures, records, and responsibilities that control how a product is designed, made, monitored, and improved. Any regulated manufacturer runs one. For medical device companies the QMS is also the evidence inspectors review, and it has to meet ISO 13485:2016 and, in the US, the FDA's QMSR.
Medical device QMS software (Digital QMS/eQMS)
Medical device QMS software is a digital QMS that helps MedTech teams run a Quality Management System in one place. It helps automate quality work (like document control, change control, training, CAPA, and audits) so you can stay compliant with standards like ISO 13485 and regulations like the FDA’s 21 CFR Part 820. It also helps companies reduce mistakes and keep quality data organized across the full device lifecycle.
Greenlight Guru is a purpose-built eQMS for medical device companies, with modules for document management, change management, CAPA & nonconformance, audit management, supplier management, and training management.
Key features to look for in medical device QMS software
Practical medical device QMS software should include:
- Document control (version control, approvals, audit trail)
- Change control (review/approval workflows, traceability)
- CAPA management (linked investigations, actions, verification)
- Audit management (internal + supplier audits, findings, follow-ups)
- Supplier management / Supplier quality management (supplier documentation, supplier audits, supplier performance)
- Training management / Employee training (role-based training, sign-offs, training records)
What quality processes make up a QMS?
A QMS is more than just documentation. It's a set of functional, ongoing processes designed to consistently produce medical devices that are safe and effective for the end user.
Management Controls
Medical device companies that are required to establish a QMS to support product safety must appropriately structure oversight and accountability of such a system to ensure that the system is effective and that it is followed where required by all employees at the company. There are several QMS processes that fall under management controls, including management review of the quality system, internal quality audit procedures and the management approval process which applies to all documents in the QMS.
Design Controls
In a QMS, medical device companies must establish a set of processes known as design controls to help ensure that the medical device being designed and manufactured is safe and effective for the intended user, while accurately addressing user needs that reflect the design inputs and requirements. The design control process helps ensure that manufacturers not only make devices adequately, but that they also make the correct device that effectively addresses and satisfies the identified user needs.
Corrective and Preventive Action (CAPA)
The QMS is centered around the Corrective and Preventive Action (CAPA) process. As an organization collects feedback on its devices, it may become aware of product defects that are caused by errors in the manufacturing, storage or transportation of the medical device. When a nonconformance event occurs, medical device companies must maintain a process for taking corrective action to ensure that the event does not happen again. When a possible source of nonconformance is identified, a preventive action process can be initiated to help ensure that the issue is addressed before it leads to an adverse event.
Essential Elements of a Medical Device QMS
A medical device QMS includes the documents, records, processes, responsibilities, and controls needed to manage product quality and regulatory compliance. While every company’s QMS should be right-sized to its device, risk profile, and business model, most medical device quality systems include the following elements:
| QMS Element |
What It Includes |
| Quality manual or quality policy |
The organization’s quality objectives, scope, responsibilities, and quality system structure |
| Standard operating procedures |
Documented procedures that define how quality and regulatory processes are performed |
| Work instructions and forms |
Detailed instructions and templates used to execute controlled processes |
| Quality records |
Evidence that QMS procedures are being followed |
| Design and Development File |
Records showing how a device was designed and developed |
| Medical Device File |
Specifications, drawings, instructions, and other information needed to manufacture the device |
| Device History Record |
Records showing that a device was manufactured according to the Medical Device File (now exists as part of the Production and Process controls under QMSR). |
| Training records |
Evidence that employees are trained on relevant procedures and responsibilities |
| Supplier records |
Supplier qualification, monitoring, audit, and performance documentation |
| Audit records |
Internal audit, supplier audit, findings, and corrective action documentation |
How a QMS improves organizational processes
A QMS improves day-to-day execution by turning “tribal knowledge” into repeatable standard operating procedures, then proving they’re followed with records and audit trails. It helps teams define what should happen, document that it happened, measure whether it worked, and improve the process when gaps appear.
A strong QMS supports:
- Quality assurance : preventing problems by designing strong processes and controls.
- Quality control : catching problems early via checks, inspections, and clear acceptance criteria.
- Process control : making manufacturing and post-market workflows consistent and measurable.
- Lower defect rate : fewer issues when CAPAs, changes, and training are connected.
- Better supplier quality : fewer incoming issues when supplier approvals, audits, and nonconformances are tracked.
- Stronger brand reputation : fewer recalls, fewer audit findings, and more consistent customer outcomes.
Quality assurance and quality control are two of the processes a QMS coordinates, and they are not the same job. Quality assurance is the set of planned activities that prevent defects: documented procedures, design controls, supplier qualification, and training. Quality control is the inspection and testing that catches defects that got through: incoming inspection, in-process checks, and final acceptance against specification. A QMS connects the two through change management and continuous improvement. When a QC result trends toward a limit, the change is evaluated, approved, and trained before it reaches production, and the CAPA record shows the loop closed. That connection is what an auditor is looking for when they ask how you know your process is under control.
QMS performance metrics
Track performance metrics in your QMS like: CAPA cycle time, audit finding closure time, training completion rate, change-control lead time, complaint trend rate, and supplier defect rate (incoming defects per lot).
Who is responsible for the QMS?
It used to be that medical device companies consisted of a quality manager and a filing cabinet. Today, the QMS gives everyone (quality, engineering, manufacturing, leadership, and other MedTech teams) a single source of truth to manage the quality of their product.
A QMS tool lets you store key quality documents and artifacts, track corrective and preventive actions (CAPAs), promote effective product development, continually monitor process improvement, and adhere to industry standards and regulations - all in one central location to make information available to anyone at your organization who might need it.
With visibility and easy access to quality records and data, it’s easier to collaborate and make quality a shared responsibility throughout your organization. Everyone in your company can see the documented controls for supplier management, production processes, labeling, packaging, handling, and even storage of your product, so you can maintain complete centralized control over the products that you create.
How is a QMS regulated?
In order to promote standardized approaches to total quality management, regulatory bodies around the world enforce QMS requirements. These vary by geographic region with each market having a designated regulatory authority in charge of enforcing QMS regulations and standards.
There are several regulations and standards with specific QMS requirements for medical devices:
- 21 CFR Part 820
- 21 CFR Part 11
- ISO 13485
21 CFR Part 820: the QMSR
In the United States, a QMS for medical devices is regulated by the Food and Drug Administration (FDA) under 21 CFR Part 820, the Quality Management System Regulation (QMSR). The QMSR took effect on February 2, 2026 and incorporates ISO 13485:2016 by reference, so the ISO standard's requirements are now the FDA's requirements, with a small number of FDA-specific additions for records, labeling, and packaging controls.
According to FDA, medical device manufacturers are required to develop a QMS that is consistent with the:
- Level of risk presented by the medical device
- Complexity of the medical device
- Complexity of medical device manufacturing processes
- Complexity and size of manufacturing facility
It is, however, ultimately up to the manufacturer to assign roles and responsibilities of the persons who will be executing such processes using a risk-based approach. Risk mitigation and reduction methods, when done effectively, can have a strong positive impact on both customer satisfaction and the business.
FDA QMS requirements state that the manufacturer is responsible for creating their organization’s policies based on meeting the customer requirements, perceived product risk, and requirements specific to the device and applicable regulations and standards.
21 CFR Part 11: QMS electronic records and signatures regulation
Medical device companies that implement electronic records or electronic signatures as part of their FDA-mandated QMS must look to 21 CFR Part 11 for the specific guidelines that permit the use of technology in quality systems.
QMS software has changed the way that the FDA thinks about record keeping and electronic signatures as they pertain to quality systems. Your quality manager is frequently required to sign, date, and approve certain documents generated as part of your QMS.
However, if your entire QMS is electronic, what controls are in place to ensure that the electronic signatures provided have the exact same weight and meaning as a physical signature? The controls which permit the use of electronic signatures and records as part of a QMS are outlined in 21 CFR Part 11.
ISO 13485:2016, the QMS standard
ISO 13485:2016 is the internationally recognized quality management standard for medical devices. Published by the International Organization for Standardization, ISO 13485 specifies the requirements a manufacturer must meet to certify its quality system against customer and applicable regulatory requirements. Since February 2, 2026, ISO 13485:2016 also sits inside US regulation, because the FDA's QMSR incorporates it by reference.
QMS requirements under ISO 13485:2016 apply to every stage throughout the entire lifecycle of a medical device and can be applied by medical device manufacturers, suppliers or any other third-party entity that provides QMS-related services to the primary medical device organization.
To comply with ISO 13485 QMS requirements, manufacturers must ensure all contents within the QMS align with applicable requirements of the standard and those specific to the market in which your medical device is manufactured and sold.
What about ISO 9000 vs ISO 13485?
ISO 9001 is part of the larger ISO 9000 family, all of which cover particular aspects of quality management. That family is generic, so companies of any size in any industry can use it. ISO 13485 was derived from ISO 9001 but adds the risk management, design control, traceability, and record-retention requirements that regulators expect of medical devices, which is why ISO 13485 rather than ISO 9001 is the standard that matters for a device QMS.
ISO 9001:2015 is the best-known standard in the ISO 9000 family because it lays out the basic requirements for implementing the processes, procedures, and documentation that makes up a QMS. If you’re a medical device manufacturer, however, there’s really no reason to follow ISO 9001 instead of a more MedTech-specific ISO standard such as ISO 13485.
What is an eQMS (electronic quality management system)?
An eQMS (electronic quality management system) replaces existing, outdated versions of QMS tools that often consist of physical paper stored in physical storage locations, like filing cabinets and desk drawers.
QMS software eliminates the cumbersome nature of non-electronic QMS tools by providing a single source of truth for organizations to manage the quality of their product or service.
What is purpose-built QMS software?
Purpose-built QMS software is designed for one industry rather than adapted to it. For medical devices that means the workflows already match ISO 13485 and the QMSR: design controls linked to risk management, CAPA linked to complaints, training linked to document revisions. A general-purpose platform can be configured to do this; a purpose-built one does it on day one.
The best QMS software allows medical device manufacturers to easily keep up-to-date records, makes documents easily accessible to all key stakeholders, and has dedicated workflows built into the system that align with industry standards and regulations.
Purpose-built QMS software can be a major boon for your medical device business, in several key areas.
QMS software supports CAPA & process improvement
CAPA generates more records than any other quality process, and those records are the first thing an inspector asks for. Greenlight Guru's QMS software assigns each CAPA a tracking number, links it to the complaint, nonconformance, or audit finding that triggered it, and carries it through investigation, action plan, and effectiveness check in one workflow. Read more in our guide to the 5 key elements of an effective CAPA system.
QMS software promotes effective product development
The goal of an effective product development team is to create a product that meets identified user needs and is both safe and effective for its intended use. Medical device companies implement design controls, a crucial set of QMS processes, to ensure that product development follows the needs of the user without getting off track.
Greenlight Guru’s QMS software helps by providing a single platform where your engineers can securely store and access all of the documentation produced in the product development process.
With a software-based QMS, you'll never misplace or lose track of the most important documents related to your device.
QMS software creates staff accountability and engagement
Greenlight Guru's QMS software allows anyone at your organization to find and reference the policies most relevant to their role. By establishing and documenting controls for supplier management, production processes, labeling, packaging, handling, and even storage of your product, you maintain complete centralized control over the products that you create.
QMS software solutions built with cloud-based technology also provide:
- Faster deployment
- Automatic software updates
- Cost-effectiveness and scalability
- The ability to work from anywhere
- Increased team collaboration
QMS software enables continuous improvement
Manufacturers are responsible for developing, controlling and monitoring processes to ensure that manufactured medical devices conform to the required specifications. There are also quality management processes used to test products for conformance once the manufacturing process has been completed.
A valuable best practice for managing a QMS is to continually monitor its effectiveness and ensure that the QMS is adjusted as necessary.
One means to do so is to establish key performance indicators for the processes within the QMS. Consider applying a “Deming Cycle” methodology for your QMS effectiveness monitoring.
Medical Device Expertise
AI, Data, Intelligence
Learning, Templates. Training
