Medical Device QMS: ISO 13485 and FDA-Compliant Quality Management

For manufacturers past clearance. Built for production.

Medical Device QMS Software: A Full Production-Phase Quality System for QMSR and ISO 13485 Compliance

Most medical device QMS software is built for the design phase. It optimises for 510(k) submission readiness, design history file completeness, and the document-heavy work of early-stage product development. That is a well-served market. The market that is less well served is the mid-market manufacturer who cleared FDA review and is now managing a quality system for an active, commercially distributed product.

The quality system needs of a manufacturer in active production are materially different. Device History Records must be maintained for every manufactured unit. Field complaints require investigation and evaluation against the Medical Device Report. Production nonconformances require CAPA with verified closure. Training records for production and quality staff must connect to current procedure versions and be available on demand. The Device Master Record must be controlled, versioned, and accessible as the authoritative production specification.

eLeaP’s medical device QMS software is built for this environment. This page covers the QMSR regulatory update, Device History Record and Device Master Record management, complaint handling under 21 CFR Part 820.198, CAPA for production-phase quality systems, and integrated training under ISO 13485 Section 6.2.

Design Phase vs. Production Phase: Why the QMS Requirements Are Different

A device company in the design phase needs a QMS that manages design controls, risk management under ISO 14971, and the design history file. Greenlight Guru is purpose-built for that phase. Its product and content strategy is explicitly oriented toward startups navigating 510(k) preparation and FDA design control requirements. For that buyer, it is a reasonable fit.

A manufacturer who has passed clearance and is shipping product to hospitals, distributors, or direct-to-patient channels has a different set of problems. Design is largely frozen. The quality system is now predominantly operational: production records, nonconformance management, incoming inspection, supplier audits, complaint intake, MDR evaluation, and training for the production floor. The DHF is a maintained archive, not an active workspace. The DHR is a growing ledger of production evidence that must be complete and accurate for every unit shipped.

eLeaP targets this production-phase manufacturer. The platform covers the full quality system suite — document control, CAPA, supplier quality, nonconformance, training, and complaint management — in a single configurable instance. It is not optimised for startup design controls. It is optimised for the ongoing quality operations of a manufacturer with cleared products, production staff, and regulatory surveillance obligations.

The QMSR Update: What FDA’s January 2024 Rule Means for Your QMS Software

In January 2024, the FDA published the Quality Management System Regulation, replacing 21 CFR Part 820 in its prior form and becoming effective in February 2026. The QMSR is the most significant structural change to the medical device quality regulation in decades. Its core mechanism is incorporation by reference: the QMSR adopts ISO 13485:2016 as the foundational quality system standard for medical device manufacturers regulated by the FDA.

The practical consequence is that a medical device quality system built on ISO 13485 is now, in substance, a QMSR-compliant quality system. FDA’s supplemental requirements in the QMSR address areas where the agency’s expectations exceed the ISO 13485 baseline — complaint handling, MDR evaluation, and certain records requirements — but the underlying quality system architecture is ISO 13485. Device manufacturers who had already aligned their quality systems to ISO 13485 for international market access are in the strongest position for QMSR compliance.

eLeaP’s medical device QMS software is structured around ISO 13485 requirements across all functional modules — document control, CAPA, supplier management, production controls, training, and complaint handling. Customers using eLeaP for ISO 13485 certification have the structural foundation for QMSR compliance already in place. The transition documentation package available from eLeaP maps the QMSR requirements to the ISO 13485 sections addressed by each platform module, supporting the gap assessment step that manufacturers need to complete before the February 2026 effective date.

For manufacturers who have been operating under the prior 21 CFR Part 820 without ISO 13485 alignment, the QMSR transition requires a more substantive quality system review. eLeaP supports this transition with configurable workflow templates mapped to the QMSR requirements and a structured implementation approach that prioritises the areas of greatest gap for manufacturers coming from the prior 820 framework.

Device Master Record and Device History Record: Two Distinct Requirements, One Connected System

The Device Master Record and the Device History Record are the two foundational record types in medical device production quality. They are conceptually distinct — the DMR is the specification, the DHR is the evidence — but they must be connected: the DHR for every unit produced must demonstrate that the unit was manufactured in conformance with the DMR in effect at the time of production. When an FDA investigator examines a DHR, they are verifying that the production record references the correct DMR revision and that every step performed matches the authorised specifications.

Device Master Record Management

The DMR under the QMSR and ISO 13485 Section 4.2 must include or reference the device specifications, production process specifications, quality assurance procedures and specifications, packaging and labeling specifications, and installation and servicing procedures. eLeaP manages the DMR as a controlled document set within the quality management system. Each document type that constitutes the DMR — manufacturing specifications, work instructions, acceptance criteria, test procedures — is version-controlled, routed through the configured approval workflow on revision, and is accessible from the device record in the system.

When a DMR document is revised, the change control workflow governs the revision from initiation through impact assessment, approval, and release. Documents that affect validated processes or established production methods trigger the appropriate revalidation or process verification activities as part of the change closure workflow. The change record links to the revised DMR document and to any associated CAPA, deviation, or complaint that originated the change — providing the full traceability chain that an auditor or investigator expects to find.

Device History Record Management

The DHR for each manufactured unit must demonstrate that the device was manufactured in accordance with the DMR. Under the QMSR and ISO 13485 Section 7.5.8, the DHR must include the dates of manufacture, the quantity manufactured and released, the acceptance records indicating the device was manufactured in accordance with the DMR, the primary identification label, and any unique device identifier or other identification used. For implantable devices, the DHR must also include the name and address of all consignees.

eLeaP’s production record structure creates DHR records at the unit or batch level, depending on the manufacturer’s production model. The DHR links to the DMR version in effect at the time of production, the equipment qualification records for equipment used in production, the acceptance inspection records for incoming materials used in the unit, and the in-process and final acceptance test records. Nonconformances detected during production associate directly with the DHR for the affected unit, along with the disposition decision and any CAPA initiated.

Training records for the production personnel who performed each DHR step are accessible from the DHR record. An FDA investigator reviewing a DHR can verify, in the same system session, that the operators who performed each step were trained on the current work instruction version at the time the step was performed. This traceability — from the DHR step to the operator to the training record to the document version — is the standard that QMSR and ISO 13485 Section 6.2 together require, and it is available as a native capability in eLeaP rather than as a manual reconciliation exercise across separate systems.

Complaint Handling: 21 CFR Part 820.198, MDR Evaluation, and the QMSR Requirement

21 CFR Part 820.198, carried forward in the QMSR, requires that each manufacturer maintain complaint files and establish and maintain procedures for receiving, reviewing, and evaluating complaints by a formally designated unit. Every complaint must be evaluated to determine whether it requires investigation and, if investigation is required, whether the investigation reveals information that requires submission of a Medical Device Report under 21 CFR Part 803.

The complaint handling obligation is one of the most inspection-sensitive areas of the medical device quality system. FDA investigators review complaint files for evidence that complaints were received and logged promptly, that every complaint was evaluated for MDR reportability, that investigations were conducted for complaints meeting the investigation criteria, and that MDRs were filed within the required timeframes — 30 days for malfunction complaints that could cause or contribute to serious injury, five days for events that require remedial action to prevent unreasonable risk.

eLeaP’s complaint management workflow captures complaints at intake — from healthcare providers, distributors, patients, or sales representatives — and routes each complaint through a structured evaluation workflow. The initial evaluation determines whether the complaint meets the criteria for investigation under the manufacturer’s complaint handling procedure. If an investigation is required, the investigation record captures the device identification, the lot or unit number, the nature of the complaint, and the investigation findings.

The MDR evaluation step is a required stage in the investigation workflow. The evaluator works through the MDR decision criteria — did the device malfunction, cause, or contribute to a death or serious injury, or could it do so if the malfunction recurred — and documents the determination with the rationale. If an MDR is required, the complaint record generates the MDR filing documentation and tracks the submission status and submission date against the applicable reporting window. If no MDR is required, the rationale for that determination is documented in the complaint record and available for review.

Complaint trending is a native reporting function. When multiple complaints reference the same device family, the same component, or the same failure mode, the trend surfaces in the complaint management dashboard. Complaint trends that indicate a potential systematic product issue generate notifications for quality management review and, where indicated, initiate the CAPA process. The link between the complaint trend and the resulting CAPA is maintained in both records — the complaint records reference the CAPA, and the CAPA record references the complaints that originated it.

CAPA for Medical Device Manufacturers: Production Nonconformances and the QMSR Requirement

The QMSR CAPA requirement, aligned with ISO 13485 Section 8.5.2 and 8.5.3, requires that manufacturers identify the causes of actual and potential nonconformities, evaluate the need for action to prevent recurrence, determine and implement actions needed, record the results of actions taken, and review the effectiveness of corrective and preventive actions taken. This is the same structural requirement as the pharma CAPA obligation — root cause, corrective action, and verified effectiveness — applied to device manufacturing nonconformances.

For production-phase medical device manufacturers, the CAPA input sources are different from a startup’s design-phase CAPA inputs. Production nonconformances, incoming inspection rejections, field complaints, supplier SCARs, internal audit findings, and post-market surveillance data all feed the CAPA system. The quality system must connect each of these input sources to the CAPA record so that the CAPA investigation has access to the full picture of the quality event.

eLeaP’s CAPA workflow for medical device manufacturers is configured to the production context. Nonconformances detected in production associate directly with the DHR for the affected unit. When a nonconformance pattern indicates a systemic issue — the same failure mode appearing across multiple DHRs for the same device family — the CAPA is initiated from within the nonconformance trending view, with all contributing events linked to the CAPA record. The root cause investigation has access to the production records, the equipment qualification status, and the training records for personnel involved in the affected production steps without manual data assembly.

CAPA effectiveness verification for production-phase issues requires a monitoring period during which the effectiveness criteria are assessed against actual production data. eLeaP’s effectiveness verification workflow defines the monitoring period, the specific metrics being tracked, and the threshold that constitutes a successful verification. The CAPA record is not available for closure until the monitoring period is complete and the effectiveness data is documented. Recurrence during the monitoring period automatically re-opens the effectiveness verification stage and notifies quality management.

Training for Medical Device Production Staff: ISO 13485 Section 6.2 and the QMSR

ISO 13485 Section 6.2 requires that personnel performing work affecting product quality be competent on the basis of appropriate education, training, skills, and experience, and that records of training and experience be maintained. The QMSR adopts this requirement by reference. For production-phase manufacturers, this means that every operator performing a step in the manufacturing process must be demonstrably trained on the current version of the work instruction governing that step, and that training records must be traceable to the specific document version.

eLeaP’s integrated QMS and LMS deliver this traceability natively. When a work instruction in the DMR is revised, the system identifies every production role assigned to that document and creates retraining assignments automatically. The training completion record carries the document version number. The DHR for any unit produced after the revision effective date references an operator training record that reflects the current work instruction version, not the prior one. The gap between document revision and confirmed retraining — the gap that generates training-related 483 observations — is closed structurally rather than procedurally.

For manufacturers implementing new production lines, new products, or new procedures, eLeaP’s role-based training matrix assigns all required training to new personnel or personnel moving into new roles without manual enrollment. The delta calculation — identifying which training items the new role requires that the current training record does not cover — is automatic. A new production operator cannot be assigned to a production step in the system until the training matrix confirms that their training record satisfies the requirements for that step.

Evaluating Medical Device QMS Software for Production-Phase Manufacturers

The market includes platforms optimised for pre-market development and platforms marketed as full QMS suites without production-phase depth. When evaluating medical device QMS software for a manufacturer in active production, the evaluation should test workflow specificity rather than feature presence.

eLeaP’s answers to all five questions are yes, demonstrable in a scoped walkthrough configured for medical device production. The demo covers DHR-to-DMR traceability, complaint intake through MDR evaluation, and the document revision-to-training assignment workflow — against a configuration reflecting device manufacturing rather than a generic quality system demonstration. Request a scoped demo at eleapsoftware.com.

Related resources: