Compliance and Quality Management (QMS).
A quality management system turns regulatory requirements into controlled operations: it defines what quality means and demonstrates that it is met. Pharma and medical devices both require it by law - and what the law requires is more than documentation: a living, process-based system, carried by people. We build and improve such systems - in business and IT.
Process confidence, product safety - demonstrable at any time.
Compliance management interprets the legal requirements, defines compliance objectives and creates the required transparency. Quality management enforces those requirements: it defines and controls the quality requirements for products, processes and services. The foundation lies in process management: instructions and evidence emerge along the processes - not beside them.
Compliance, quality and traceability.
Interpret, enforce, reconstruct.
Compliance management, quality management and traceability interlock: the first interprets the requirements, the second enforces them, the third makes both traceable. Only in combination do they add up to a robust QMS.
- Compliance management: interpret legal requirements, define objectives, create transparency
- Quality management: define, enforce and control the quality requirements
- Traceability: plan end-to-end traceability prospectively, never bolt it on - the device world codifies it down to the UDI for every device or batch
What do the regulations require of a QMS?
The same thing, in two vocabularies: a process-based quality system across the entire lifecycle - lived, monitored, demonstrated. Pharma and medical devices each require it under their own law; the models share their root in the ISO 9000 concepts.
| Framework | What it requires |
|---|---|
| EU GMP Chapter 1Pharma · binding guideline | requires a Pharmaceutical Quality System across the product lifecycle; Chapter 4 governs documentation - explicitly media-neutral |
| ICH Q10Pharma · the PQS model (2008) | describes the model behind it: management responsibility, process and product monitoring, CAPA, change management - with quality risk management and knowledge management as enablers |
| MDR Art. 10(9)Medical devices · EU law | requires the QMS regardless of class - including Class I; EN ISO 13485 is harmonized and grants the presumption of conformity |
| ISO 13485:2016Medical devices · QMS standard | codifies the QMS requirements including control of documents and records - approved instructions, controlled records |
| FDA QMSR - 21 CFR Part 820Medical devices · US law, effective February 2, 2026 | its first obligation is literally titled "Document." - the verb: document a QMS, not deliver a document. The obligation is fulfilled through the incorporated ISO 13485; the former document-control section § 820.40 is gone: [Reserved] |
After nearly three decades, the FDA retired its own Quality System Regulation and incorporated the international standard instead. Build your QMS on this shared expectation - process-based, risk-based, lived - and one system serves both worlds and lays the foundation for the digital transformation in GxP-regulated fields.
What is not documented does not exist.
That is the GMP principle, and it holds in both worlds - in pharma and medical devices alike. What is required, however, are not document entities but documentation: EU GMP Chapter 4 explicitly leaves the form open ("Documentation may exist in a variety of forms, including paper-based, electronic or photographic media"), while requiring that the media used be defined in the QMS and suitably controlled; even “written” is defined in a media-neutral way - and ISO 9001:2015 no longer requires a quality manual, only "documented information". Two document types carry the system:
And documented does not yet mean lived: documentation provides the evidence - it is people who live the system.
Quality is made for people - by people.
"To establish, implement and maintain a system that allows the delivery of products with the quality attributes appropriate to meet the needs of patients, health care professionals, regulatory authorities [...] and other internal and external customers."
ICH Q10, objective 1.5.1 "Achieve Product Realisation" - the first objective of the Pharmaceutical Quality System. First on the list of needs: the patient.
Documentation demonstrates quality - people create it. An effective QMS lives in processes and culture. We owe quality to the patient - not to the auditor.
Inspection practice expects exactly that: PIC/S PI 041 dedicates a section of its own to quality culture, and ICH Q10 places the responsibility for it with senior management.
A QMS that enforces compliance.
Frequently asked questions about the GxP QMS.
No. ISO 9001 is the generic root on whose concepts ICH Q10 and ISO 13485 build. A GxP QMS has to meet the sector-specific requirements: EU GMP with the Q10 model in pharma, MDR or QMSR with ISO 13485 for medical devices. A 9001 certificate alone does not demonstrate that. The reverse also holds: the risk-based thinking ISO 9001:2015 introduced is something the GxP world has lived since ICH Q9 (2005) - master a PQS, and you have the head start.
No. ICH Q9 describes Quality Risk Management as a methodology - ICH Q10 makes it an enabler of the entire system, and ISO 9001:2015 deliberately speaks of risk-based thinking rather than a separate process. Risk-based thinking belongs in every decision the QMS makes: effort, formality and depth of documentation scale with risk. Formal risk assessments remain instruments at defined points - in validation, change management and CAPA, for example - they are not the system itself.
The QMSR has been in force since February 2, 2026: it incorporates ISO 13485:2016 - if you already operate to 13485, you are close. What remains to be checked are the FDA additions, among them mandatory content for complaint and servicing records (§ 820.35, including the individual who performed the service), the UDI in the records, and the labeling controls (§ 820.45). The old QSR structure is history - the standard is what counts.
Yes. MDR Art. 10(9) requires the quality management system regardless of class - including Class I. The risk class scales the depth of the conformity assessment and the involvement of the Notified Body, not the QMS obligation itself.
In practice, no. Traceability arises from links that are created at the moment of execution - reconstructing them later is rarely complete. That is why it belongs prospectively in processes, systems and records - in the device world down to the UDI for every device or batch.
A QMS that creates quality - not just the paperwork.
In an initial consultation, we assess where your QMS stands - instructions, records, traceability, culture - and name the next steps. Free of charge, about 30 minutes.
Schedule a consultation
