Compliance and Quality Management (QMS).
A quality management system turns regulatory requirements into controlled workflows: it defines the quality specifications and demonstrates that they are met. In pharma and medical devices alike, the law requires one - and it requires more than documentation: a living, process-based system, sustained by people. We build and improve such systems - in business and IT.
Process confidence, product safety - demonstrable at any time.
Compliance management interprets the legal requirements, defines compliance objectives and creates the required transparency. Quality management enforces those requirements: it defines and controls the quality specifications for products, processes and services. The foundation for both lies in process management: instructions and evidence arise along the processes - not alongside them.
Compliance, quality and traceability.
Interpret, enforce, reconstruct.
Compliance management, quality management and traceability interlock: the first interprets the requirements, the second enforces them, the third makes both reconstructable at any time. Only together do they add up to a robust QMS.
- Compliance: interpret legal requirements, define objectives, create transparency
- Quality: define, enforce and control the quality requirements
- Traceability: plan it end-to-end and prospectively - the device world codifies it down to the UDI for every device or batch
What do the regulations require of a QMS?
The same thing, in two vocabularies: a process-based quality system across the entire lifecycle - lived, monitored, demonstrated. Each sector requires it under its own body of law; the models share their root in the ISO 9000 concepts.
| Framework | What it requires |
|---|---|
| EU GMP Chapter 1Pharma · binding guideline | requires a Pharmaceutical Quality System across the product lifecycle; Chapter 4 governs documentation - explicitly media-neutral |
| ICH Q10Pharma · the PQS model (2008) | describes the model behind it: management responsibility, process and product monitoring, CAPA, change management - with quality risk management and knowledge management as enablers |
| MDR Art. 10(9)Medical devices · EU law | requires the QMS regardless of class - including Class I; EN ISO 13485 is harmonized and confers a presumption of conformity |
| ISO 13485:2016Medical devices · QMS standard | codifies the QMS requirements including control of documents and records - approved instructions, controlled records |
| FDA QMSR - 21 CFR Part 820Medical devices · US law, effective February 2, 2026 | its first obligation is literally titled "Document." - the verb: document a QMS, not deliver a document. The obligation is fulfilled through the incorporated ISO 13485; the former document-control section § 820.40 has been removed: [Reserved] |
After nearly three decades, the FDA retired its own Quality System Regulation and incorporated the international standard instead. Build your QMS on this shared expectation - process-based, risk-based, lived - and a single system serves both worlds, laying the foundation for the digital transformation in GxP-regulated fields.
If it is not documented, it did not happen.
That is the GMP principle, and it holds in both worlds - in pharma and medical devices alike. What is required is not document entities but documentation: EU GMP Chapter 4 explicitly leaves the form open ("Documentation may exist in a variety of forms, including paper-based, electronic or photographic media"), while requiring that the media used be defined in the QMS and suitably controlled; even “written” is defined in a media-neutral way - and ISO 9001:2015 no longer prescribes a quality manual at all - only "documented information". Two document types carry the system:
And documented is not the same as lived: documentation provides the evidence - it is people who live the system.
Quality is made for people - by people.
"To establish, implement and maintain a system that allows the delivery of products with the quality attributes appropriate to meet the needs of patients, health care professionals, regulatory authorities [...] and other internal and external customers."
ICH Q10, objective 1.5.1 "Achieve Product Realisation" - the first objective of the Pharmaceutical Quality System. First on the list of needs: the patient.
Documentation demonstrates quality - only people can create it. An effective QMS lives in processes and culture. We owe quality to the patient - not to the auditor.
And inspection practice expects exactly that: PIC/S PI 041 dedicates a section of its own to quality culture, and ICH Q10 places the responsibility for it with senior management.
A QMS that enforces compliance.
Frequently asked questions about the GxP QMS.
No. ISO 9001 is the generic root whose concepts ICH Q10 and ISO 13485 build on. A GxP QMS has to meet the sector-specific requirements: EU GMP with the Q10 model in pharma, MDR or QMSR with ISO 13485 for medical devices. A 9001 certificate alone does not demonstrate that. The reverse also holds: the risk-based thinking ISO 9001:2015 introduced is something the GxP world has lived since ICH Q9 (2005) - master a PQS, and you have the head start.
In the pharma world, no: ICH Q9 describes Quality Risk Management as a methodology - ICH Q10 makes it an enabler of the entire system, and ISO 9001:2015 deliberately speaks of risk-based thinking rather than a separate process. The device world requires more: ISO 13485 requires documented risk management processes in product realization (Cl. 7.1, in conjunction with ISO 14971). Risk-based thinking belongs in every decision taken within the QMS: effort, formality and depth of documentation scale with risk. Formal risk assessments remain instruments at defined points - in validation, change management and CAPA, for example. They are not the system itself.
The QMSR has been in force since February 2, 2026: it incorporates ISO 13485:2016 - if you already operate to 13485, you are most of the way there. What remains to be checked are the FDA additions, among them mandatory content for complaint and servicing records (§ 820.35, including the individual who performed the service), the UDI in the records, and the labeling controls (§ 820.45). The old QSR structure is history - the standard is what counts.
Yes. MDR Art. 10(9) requires the quality management system regardless of class - including Class I. The risk class scales the depth of the conformity assessment and the involvement of the Notified Body, not the QMS obligation itself.
In practice, no. Traceability arises from links that are created at the moment of execution - they can rarely be reconstructed without gaps after the fact. That is why it has to be planned into processes, systems and records from the outset - in the device world down to the UDI for every device or batch.
A QMS that creates quality - not just evidence of it.
In an initial consultation, we assess your QMS maturity - instructions, records, traceability, culture - and name the next steps. Free of charge, about 30 minutes.
Schedule a consultation
