Choosing ISO 13485 software: QMS features for medtech
“ISO 13485 software” can mean two things: software that is itself a medical device, or software for your quality management system (QMS). This page is about the second: a QMS tool for document control, CAPA and audit evidence. Read the technical documentation, the CAPA explanation and the audit process before you compare features. The ISO page for ISO 13485 describes the standard for quality management systems for medical devices.
A QMS tool can manage records, but it does not automatically make your organisation compliant. The MDR (EU) 2017/745 sets its own requirements for, among other things, the QMS, risk management, suppliers, post-market surveillance and corrective actions. You therefore also need to assess which software affects product quality or release, and how you control that application.
Start with evidence flows
First map out which records you create, who approves them and which change could create a product or patient safety risk. Then choose features that support the full chain.
| QMS process | Necessary feature | Testable evidence | Pitfall |
|---|---|---|---|
| Document control | Versions, approval, validity and distribution | History of the document and approver | An old work instruction keeps circulating |
| Nonconformity and CAPA | Cause, action, owner and effectiveness | Record from complaint to closure | Closing an action without measuring effect |
| Complaints and PMS | Intake, triage, trend and escalation | Timeline and decision | Complaint stored separately from the product record |
| Suppliers | Approval, risk, evaluation and changes | Assessment and follow-up | Critical supplier without an owner |
| Risk management | Link to risk analysis and measures | Review and change trail | Risk analysis in a separate folder with no link |
| Technical file | Structure, access rights and retention | Export with version history | Record cannot be found again |
| Training | Assignment to current documents | Completion and competence | Only recording “read” |
| Internal audit | Planning, finding and action | Audit report and follow-up | Audit closes without an improvement action |
Do not just test whether a button exists. Ask the vendor to follow one record from complaint through root cause analysis and CAPA to effectiveness check. Can you see who decided, which version was valid and why the action was closed?
Audit trail and electronic approval
Ask whether the audit trail clearly records changes, user, time, and relevant old and new values. Which details are needed depends on the intended use, risk and applicable rules. Check that logs cannot be silently deleted, that export works, and that roles prevent an author from overwriting their own critical decision. Ask how electronic signatures are linked to a record.
Retention is part of the selection too. Discuss backups, retention, restore tests, export when the contract ends and access for auditors. A vendor may offer a secure platform, but you still need to decide which retention period and approval route suit your QMS.
When must you validate software?
Software that supports your QMS or a production or service process must be validated before use, and reassessed after relevant changes. Based on intended use and risk, determine which parts affect product quality, release, traceability or safety decisions. Record the reason, describe requirements and test scenarios, approve the results and manage changes again. The scope of validation follows from risk and use; a general marketing claim from a vendor is not validation evidence.
Distinguish between configuration and a software change. A new CAPA workflow may need a different risk assessment than a colour change on a dashboard. Involve quality and regulatory functions in that decision.
Fictional case: from complaint to CAPA
A manufacturer receives a complaint about a connector. The QMS tool records the product, batch and complaint, links an investigation and records the cause: an outdated work instruction at a supplier. The owner opens a CAPA, changes the document, trains the staff involved and schedules an effectiveness check after three production batches.
The auditor can now follow the whole chain: complaint, risk assessment, supplier action, current instruction, training and measurement result. The tool keeps the trail; the quality team makes the substantive judgements and decides whether the CAPA works.
QMS software does not provide an ISO 13485 certificate or CE marking. Have certification, conformity and validation decisions reviewed by the responsible quality and regulatory managers.
Selection checklist
At every demonstration, ask about roles and segregation of duties, audit trail, version control, electronic approval, export, retention, backup, APIs and vendor support. Test a complaint, a document change, a training record and an internal audit. For each feature, note which risk it controls and which evidence an auditor will see.
Frequently asked questions
Is ISO 13485 software the same as software as a medical device?
No. A QMS tool manages processes and evidence. Software with an intended purpose that falls under the definition of a medical device can itself fall under product legislation. Assess the QMS function and the product status separately.
Must a QMS tool be CE marked?
Not because of the name “QMS tool” alone. The status depends on the intended purpose, the functions and the applicable legislation. Seek regulatory advice if the intended purpose may fall under the definition of a medical device.
Can a cloud tool be used in an ISO 13485 QMS?
Yes, provided your risks, access, supplier control, availability, backup, retention and validation are appropriately managed and you can show the evidence.