ISO 13485 QMS software: digitizing the quality system without confusing the tool with the requirement
"Which software covers ISO 13485?" The question comes up in every project, and it is the wrong question: no screen covers an entire quality system on its own, and an eQMS creates neither management responsibility, nor decision criteria, nor compliance. Before choosing, you need to separate what the frameworks require of the QMS from what software can automate. Here is how.
What do the regulations require?
The regulations reason in terms of responsibilities and processes, never in terms of a module catalogue. The most common trap is turning a commercial list of features into a list of requirements. Three terms frame the subject.
- QMS
- The quality management system: the organized set of processes, responsibilities, procedures, resources and records through which a manufacturer controls the quality and compliance of its activities. A QMS is not a piece of software: the tool digitizes parts of it, while governance and responsibilities remain the organization's.
- eQMS
- A market term for software that digitizes all or part of the QMS: documents, non-conformities, CAPA, audits, training, changes, suppliers, complaints and so on, depending on the product. No regulatory definition sets the minimum scope of an eQMS.
- CAPA
- A structured set of corrective and, where relevant, preventive actions: identify a problem or a risk, look for its cause to the necessary depth, act on that cause and verify that the action is effective. The MDR and the IVDR explicitly include the management of these actions and the verification of their effectiveness in the QMS.
| Framework | What it requires in practice |
|---|---|
| MDR 2017/745 & IVDR 2017/746 | A QMS that is documented, implemented, maintained and kept up to date, proportionate to the class and type of device, regardless of any ISO certificate. They explicitly mention CAPA management and the verification of CAPA effectiveness. |
| ISO 13485 | The most widely used reference framework for structuring that QMS. Certification covers your organization within a defined scope, never a piece of software as a product. |
| FDA QMSR (2 February 2026) | Incorporates ISO 13485:2016; the structure of Part 820 is shortened and QSIT is dropped as an inspection method. Procedures and matrices that still cite the former sections (e.g. 820.100) need to be remapped. |
Operational summary: it replaces neither reading the texts nor the opinion of your regulatory affairs lead.
What should you do?
No screen "covers" such a broad system. The right approach is to choose which process to make more reliable and which evidence to produce. Here is what your organization has to keep up, whatever the tool.
- Digitize first where the system breaks down (missed deadlines, missing evidence, reconstruction work) rather than the first module in a brochure.
- Make the workflow reflect your rules (opening criteria, responsibilities, investigation levels, approvals) instead of letting a generic configuration move a bad process from the spreadsheet to the browser.
- Make every event complete and assigned: source, date, product or lot, visible owner, deadline. A line with no owner turns a delay into nobody's responsibility.
- Keep the investigation and actions linked to the originating event, with the expected evidence, and verify effectiveness before final closure.
- Reuse the data (categories, causes, lead times) for the management review, PMS and trends, without re-entry.
- Make the interfaces with production, document management and the ERP explicit: define the master system for each piece of data, so that the link survives the handover from production to quality.
Praeventis structures quality events, CAPAs and actions
Praeventis covers the operational follow-up of incidents, deviations, CAPAs, changes and actions: owners, statuses, deadlines, evidence and history stay linked within a single workflow. It complements your quality system; it does not replace the responsibilities, procedures or document tools your organization maintains elsewhere.
- Quality tickets with project, category, owner, status and deadlines.
- CAPA with criticality, actions and post-implementation analysis; actions linked to their originating event.
- Attachments and evidence kept in the record; named accounts and configurable permissions.
- Change history and exports for analysis, management review or audit.
The Cerebellis software related to this topic
Further reading
Computerized system validation (CSV) according to GAMP 5
Software categories, V-model, risk analysis and traceability matrix: how GAMP 5 structures a risk-proportionate computerized system validation.
CAPA and non-conformities for medical devices: from deviation to effectiveness
Correction, corrective action, cause and effectiveness check: structuring a CAPA process proportionate to risk, without opening a CAPA for every deviation.
Medical device traceability: reconstruct a lot in seconds
What ISO 13485 and the MDR require of lot traceability, the six practical requirements to meet, and a simple test to see where yours stands.