Compliance and Quality Management (QMS).
A quality management system turns regulatory requirements into controlled workflows. It defines the quality specifications and demonstrates that they are met. In pharma and medical devices alike, the law requires such a system. What the law requires is more than documentation: a living, process-based system that people sustain. We build such systems in business and IT and keep developing them.
Trust in processes and safe products, demonstrable at any time.
GxP quality management brings two tasks together. Compliance management interprets the legal requirements, defines compliance objectives and creates the required transparency. Quality management enforces those requirements by defining and controlling the quality specifications for products, processes and services. The foundation for both is process management. Instructions and evidence arise within the processes, not detached from them.
Compliance, quality and traceability.
Interpret, enforce, reconstruct.
The third pillar ties the first two together: traceability makes it reconstructable at any time which instruction applied, who carried it out and with what result. Only together do they add up to an effective QMS.
- Compliance: interpret legal requirements, define objectives, create transparency
- Quality: define, enforce and control the quality specifications
- Traceability: plan it in prospectively and without gaps, in medical devices right down to the UDI
What do the regulations require of a QMS?
Pharma and medical devices require the same thing, only in two vocabularies: a process-based quality system across the entire lifecycle, monitored and demonstrated. In pharma, EU GMP Chapter 1 mandates a Pharmaceutical Quality System, and ICH Q10 has supplied the model behind it since 2008, with management responsibility, process and product monitoring, CAPA and change management. In medical devices, Article 10(9) of the MDR calls for a quality management system for every risk class. As a harmonized standard, EN ISO 13485 gives rise to the presumption of conformity for the requirements it covers. In the United States, the FDA's QMSR has applied since February 2, 2026, and it incorporates ISO 13485:2016. In both industries, the QMS is mandated on a legal basis of its own. Both QMS models go back to the concepts of the ISO 9000 family, so one system covers both industries, supplemented by the industry-specific obligations. They also share one measure: effort, formality and depth of documentation follow the risk to product and patient, not the volume of documents. What each framework requires is set out in the table.
| Framework | What it requires |
|---|---|
| EU GMP Chapter 1Pharma · binding guideline | requires a Pharmaceutical Quality System across the product lifecycle. Chapter 4 governs documentation, explicitly media-neutral |
| ICH Q10Pharma · the PQS model (2008) | describes the model behind it: management responsibility, process and product monitoring, CAPA and change management, supported by quality risk management and knowledge management as enablers |
| MDR Art. 10(9)Medical devices · EU law | requires the QMS regardless of class, including Class I. EN ISO 13485 is harmonized for it |
| ISO 13485:2016Medical devices · QMS standard | codifies the QMS requirements including control of documents and records: approved instructions, controlled records |
| FDA QMSR (21 CFR Part 820)Medical devices · US law, effective February 2, 2026 | its first obligation reads, word for word, "Document." The verb calls for documenting a QMS, not delivering a single document. The obligation is fulfilled through the incorporated ISO 13485. The former document-control section, § 820.40, has been removed and is shown as "[Reserved]" |
After nearly three decades, the FDA retired its own Quality System Regulation and incorporated the international standard instead. A QMS aligned with this shared expectation, process-based and risk-based, covers pharma and medical devices with a single system and lays the groundwork for the digital transformation in GxP-regulated fields.
If it is not documented, it did not happen.
That is the maxim of GMP practice, and it holds in the pharmaceutical industry and in medical devices alike. What is required is not individual documents as an end in themselves but the documentation of the QMS.
EU GMP Chapter 4 explicitly leaves the form open ("Documentation may exist in a variety of forms, including paper-based, electronic or photographic media"), while requiring that the media used be defined in the QMS and suitably controlled. Even “written” is defined in a media-neutral way. ISO 9001:2015 no longer prescribes a quality manual at all, only "documented information". Two document types carry the system:
Quality is made for people - by people.
"To establish, implement and maintain a system that allows the delivery of products with the quality attributes appropriate to meet the needs of patients, health care professionals, regulatory authorities [...] and other internal and external customers."
ICH Q10, objective 1.5.1 "Achieve Product Realisation", the first objective in the Pharmaceutical Quality System. Among the stakeholders it names, the patient comes first.
Documentation demonstrates quality. Only people can create quality itself. An effective QMS lives in processes and culture. We owe quality to the patient, not to the auditor. That is why every QMS project at QFINITY starts with the records, not with the manual: where instruction and record diverge, that is where the work lies.
And inspection practice expects exactly that: PIC/S PI 041 dedicates a section of its own to quality culture. ICH Q10 places the responsibility for the quality system with senior management.
A QMS that enforces compliance.
Frequently asked questions about the GxP QMS.
No. ISO 9001 is the generic root whose concepts ICH Q10 and ISO 13485 build on. A GxP QMS has to meet the industry-specific requirements: EU GMP with the Q10 model in pharma, the MDR or the QMSR with ISO 13485 for medical devices. A 9001 certificate alone does not demonstrate that. The reverse also holds: the risk-based thinking that ISO 9001:2015 introduced has been anchored in the GxP world since ICH Q9 (2005). Anyone who runs a PQS already brings that risk-based thinking with them.
In the pharma world, no. ICH Q9 describes Quality Risk Management as a methodology, ICH Q10 makes it an enabler of the entire system, and ISO 9001:2015 deliberately speaks of risk-based thinking rather than a separate process. Medical devices require more: through the harmonized EN ISO 13485, documented risk management processes are expected in product realization (clause 7.1 in conjunction with ISO 14971). Risk-based thinking belongs in every decision taken within the QMS, from the scope of a validation to the depth of a deviation investigation. Formal risk assessments remain instruments at defined points, in validation, change management and CAPA for example. They do not, however, constitute the system itself.
The QMSR has applied since February 2, 2026. It incorporates ISO 13485:2016. A company already operating to ISO 13485 has completed a substantial part of the transition. What remains to be checked are the FDA additions, among them mandatory content for complaint and servicing records (§ 820.35, including the identification of the individual who performed the service), the UDI in the records, and the labeling controls (§ 820.45). The former QSR structure no longer applies. What governs now is ISO 13485 together with the supplementary FDA requirements.
Yes. Article 10(9) of the MDR requires the quality management system regardless of class, including Class I. The risk class scales the depth of the evidence of conformity and the involvement of the Notified Body, not the QMS obligation itself.
In practice, no. Traceability arises from links that are created at the moment of execution. Afterwards, they can rarely be reconstructed without gaps. That is why it has to be planned prospectively into processes, systems and records, in medical devices down to the level of device and batch (UDI).
From the records, not from the procedures. Inspectors read deviation, CAPA and change records. They check whether the management reviews in line with ICH Q10 take place and whether the decisions taken there take effect in the processes. They also ask staff about their own processes. PIC/S PI 041 describes which behaviors point to a quality culture, for instance whether errors are reported or concealed. A QMS that exists only on paper shows itself in the gaps between instruction and record.
Last updated:
A QMS that is lived and delivers its own evidence.
In an initial consultation, we assess your QMS maturity based on instructions, records, traceability and culture. We then set out the next steps. The consultation is free of charge and takes about 30 minutes.
Schedule a consultation
