Medical device document control software

Document control is the set of rules that governs every document your quality management system depends on: how SOPs, work instructions, and templates are written, reviewed, approved, distributed, revised, and retired — and how the records they produce are protected. ISO 13485 demands it in clauses 4.2.3 and 4.2.4, and since the FDA's Quality Management System Regulation (QMSR) incorporates ISO 13485 by reference, the same requirements now apply to US-regulated manufacturers.

In practice, QMS document control answers four questions an auditor will ask on day one: which version of this procedure is current, who approved it, who was trained on it, and where is the evidence? A document control system — whether that's a rigorous folder convention or dedicated eQMS software — exists to make those four answers instant.

It's the first distinction an auditor expects you to have internalized, and it decides how each file in your QMS must be handled.

ISO 13485 clause 4.2.3 requires a documented procedure that ensures documents are reviewed and approved before use, that changes and current revision status are identified, that current versions are available where people work, that documents stay legible and identifiable, and that obsolete documents can't be used unintentionally. Clause 4.2.4 adds the record side: records must remain legible, identifiable, and retrievable for a defined retention period, protected from damage and loss.

Under the QMSR, effective February 2026, the FDA no longer maintains its own former document control text in 21 CFR 820.40. ISO 13485 now supplies the foundational document-control framework for the FDA, but manufacturers must still assess the QMSR's FDA-specific provisions and, for electronic records and signatures, 21 CFR Part 11.

Whatever tool you use — folders, spreadsheets, or an eQMS — your document control procedure has to account for each of these states.

Two current versions in circulation. The classic finding: a superseded SOP still lives in someone's downloads folder or a shared drive, and production keeps following it. Withdrawal of old versions has to be systematic, not an email asking people to please delete the file.

Approvals without meaning. A scanned signature or a bare “approved by” initials column doesn't say whether the person signed as author, reviewer, or approver — Part 11 requires the meaning of each signature, and auditors check for it.

Training that lags revisions. The SOP changed in March, the team was trained in June, and every record created in between was produced under a procedure its authors had never seen. If training isn't triggered by the revision becoming effective, this gap is nearly guaranteed.

Records quietly edited. Fixing a typo in a signed record breaks its integrity. Corrections need to be traceable amendments, with the original preserved.

If you sell into the US and keep QMS records electronically, Part 11 applies to those records and signatures. Three requirements do most of the work: validated systems with tamper-evident audit trails (§11.10), signatures that show name, time, and meaning — author, reviewer, or approver (§11.50), and signatures that belong to one person and are never reassigned (§11.100).

One honest caveat: software alone does not make you compliant. Part 11 compliance is a property of your process plus your validated tools — you still need procedures, training, and a validation rationale for the system itself. Any vendor that promises “Part 11 compliance out of the box” is skipping that sentence.

You don't strictly need software — companies have passed audits with disciplined folder structures. But the folder approach makes every lifecycle step above a manual chore, and the two-current-versions failure mode almost inevitable as the team grows. Good medical device document control software makes the compliant path the default: one effective version, forced review flows, signatures with meaning, and training that fires automatically.

Whatever tool you evaluate — including ours — it should pass every item below. Copy this into your vendor comparison.

Formwork implements the full lifecycle you saw above — it's the workflow in the product preview at the top of this page. Documents move through draft, review, and approval with role-based permissions; approvals carry Part 11 e-signatures with name, timestamp, and meaning; when a revision becomes effective, training is assigned automatically and recorded; and any document exports audit-ready with its complete history and signatures.

It comes with the free OpenRegulatory template library built in, so you start from a proven Document and Record Control SOP instead of a blank page — and if you're migrating from another eQMS or from folders, migrations are free.