1Why there is no standard price.
No GMP regulation or guidance sets what quality software should cost. What the rules set is the work a regulated company does before it relies on a computerised system and for as long as it uses one. EU GMP Annex 11 applies to “all forms of computerised systems used as part of a GMP regulated activities” and says “the application should be validated; IT infrastructure should be qualified.”¹ In the US, FDA’s data integrity guidance for drug manufacturers treats each CGMP workflow on a computer system as an intended use to be checked through validation, to an extent “commensurate with the risk posed by the automated system”.²
So an eQMS budget has two parts. One is what the vendor charges for the software and its hosting. The other is the work your own team, or consultants it hires, does to specify, assess, validate, migrate and maintain the system. Vendors quote the first. The rules below decide the second, and they apply to the regulated company whichever product it buys.
2The work GMP attaches to an eQMS.
| Work | What the rules expect |
|---|---|
| User requirements | Requirements that “describe the required functions of the computerised system and be based on documented risk assessment and GMP impact”, traceable through the life cycle.¹ |
| Supplier assessment | The supplier’s competence and reliability are “key factors” in selection, the need for an audit is based on risk, and documentation supplied with an off-the-shelf product is reviewed against your requirements.¹ |
| Agreements | Formal agreements with any third party that provides, installs, configures, validates, maintains or retains the system, stating its responsibilities.¹ |
| Validation | Documentation covering the relevant life cycle steps, with standards, protocols and acceptance criteria justified by risk assessment.¹ |
| Data migration | Checks that records moved from the old system are “not altered in value and/or meaning”.¹ |
| Training | People who develop, maintain or use the system have the education, training and experience for their tasks.³ |
| Operation | Regular backups with restore checked during validation, controlled changes to configuration, periodic evaluation that it remains in a valid state, and business continuity arrangements.¹ |
None of these rows comes with a licence. The draft revision of Annex 11, put out for consultation by the European Commission and PIC/S from 7 July to 7 October 2025, states the point directly: when a regulated user relies on a vendor’s or service provider’s qualification or operation of a system, “the regulated user remains fully responsible”.⁴⁵ The draft is not yet in force; EudraLex Volume 4 still lists the January 2011 Annex 11.⁶
3What sets the size of the validation work.
Risk sets it. Annex 11 bases the extent of validation on “a justified and documented risk assessment”.¹ FDA’s guidance on computer software assurance, final in February 2026 and written for software used in medical device production and quality management systems, takes the same line: the burden of validation should be “no more than necessary to address the risk”.⁷ It gives CAPA routing, complaint logging, change control management and procedure management as examples of functions that generally do not pose a high process risk, and for those suggests unscripted methods such as scenario or exploratory testing.⁷
Reusing the vendor’s evidence is the other lever. The guidance lets a manufacturer take the developer’s own development practices, validation work and electronic information “as the starting point”, and says that for some lower-risk functions this “may be all the assurance that is needed”. It also recommends using system logs, audit trails and other data the software keeps rather than “paper documentation, screenshots”.⁷ ISPE’s GAMP 5 Second Edition, published in July 2022, encourages regulated companies “to maximize supplier involvement to leverage knowledge, experience, and documentation where possible”.⁸ PIC/S sets the limit: companies “should therefore not place sole reliance on vendor qualification packages”, and their own tests should show data integrity holds in normal, intended use.⁹
Customisation pushes the other way. For bespoke or customised systems, Annex 11 expects a process for the formal assessment and reporting of quality and performance measures for every life cycle stage.¹ The more functions you customise and the more records you migrate, the larger the validation.
4What a free or open-source eQMS still costs.
A tool without a licence fee is still a computerised system used in GMP work, so every row in the table above still applies.¹ Some of the work can grow. Annex 11 asks the regulated user to “take all reasonable steps” to ensure the system was developed under an appropriate quality management system and to assess the supplier appropriately; where no company stands behind the software, there is no one to assess, audit or bind by agreement, and the company has to establish those points itself.¹ FDA’s software assurance guidance accepts that manufacturers “may have limited access to information from the software vendor” and recommends a risk-based analysis of the vendor as part of the assurance approach.⁷ GAMP 5’s Second Edition added open-source software to its appendices, alongside cloud computing and AI.⁸
Paper and spreadsheets are also allowed: EU GMP says documentation may be “paper-based, electronic or photographic media”.¹⁰ They move the cost rather than remove it. FDA’s software assurance guidance gives the example of a spreadsheet: used only to record time and temperature readings, it may need little beyond a vendor assessment, installation and configuration; once its custom formulas are used directly in production or the quality system, further validation by the manufacturer might be necessary.⁷
5What to ask before you compare quotes.
The draft Annex 11 lists what a contract with a service provider should cover, and each item moves cost between you and the vendor.⁴ FDA’s worked example of a SaaS system adds a service agreement covering security, data integrity, privacy, availability, change management and business continuity, and vendor documentation of each automatic update’s changes and testing.⁷
| Question | Why it changes the cost |
|---|---|
| What validation evidence does the vendor supply for each release? | Evidence you can reuse is testing you don’t repeat.⁷ |
| How often do new versions arrive, and can you test them before release? | Each release needs an assessment of its effect on your intended use.⁴⁷ |
| Which of your processes are configuration, and which need customisation? | Customised functions carry more life cycle documentation.¹⁴ |
| What does the vendor provide for audits and inspections? | The draft expects agreed conditions for supplier audits and support during inspections.⁴ |
| How do you get your records out when you leave? | The draft expects an exit strategy that lets you keep control of system data.⁴ |
6How it runs in Seal.
In Seal, deviations, CAPA, change control, documents and training run on the same records as the laboratory and manufacturing work they govern, and you can start with one process beside the system you run today. Once the scope is agreed and the inputs received, Seal prepares a first working process and its validation pack for you to evaluate within 48 hours, configured from one of your procedures; production timing then depends on scope, interfaces, migration and your release requirements. See the eQMS comparison and quality management in Seal.
The validation and AI assurance guide sets out who does what. Seal provides the platform controls and the supplier verification and release evidence for the version in scope; your team owns the intended use, requirements, risk acceptance and production approval, including migrated data, procedures and training. When a change is prepared for review, its selected acceptance tests run and their results join the release review.
References
- 1EudraLex Volume 4, Annex 11: Computerised Systems, revision 1, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 2Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 321 CFR 11.10, Controls for closed systems, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 10 (read 6 November 2026) - 4Annex 11: Computerised Systems, draft for consultation, European Commission and PIC/S, July 2025. https:/
/ picscheme. org/ docview/ 9714 (read 6 November 2026) - 5Joint stakeholders consultation on the revision of Chapter 4, Annex 11 and the new Annex 22 of the PIC/S and EU GMP Guides, PIC/S, 7 July 2025. https:/
/ picscheme. org/ en/ news/ 131/ joint- stakeholders- consultation- on- the- revision- of- chapter- 4 (read 6 November 2026) - 6EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026) - 7Computer Software Assurance for Production and Quality Management System Software, Guidance for Industry and FDA Staff, FDA, February 2026. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ computer- software- assurance- production- and- quality- management- system- software (read 6 November 2026) - 8GAMP 5 Guide, 2nd Edition: A Risk-Based Approach to Compliant GxP Computerized Systems, ISPE, July 2022. https:/
/ ispe. org/ publications/ guidance- documents/ gamp- 5- guide- 2nd- edition (read 6 November 2026) - 9PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, PIC/S, 1 July 2021. https:/
/ picscheme. org/ docview/ 4234 (read 6 November 2026) - 10EudraLex Volume 4, Chapter 4: Documentation, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ chapter4_ 01- 2011_ en_ 0. pdf (read 6 November 2026)
AQuestions and answers
Is there free eQMS software that is GMP compliant?
Software is not compliant by itself; compliance depends on how a regulated company specifies, validates and controls it for its intended use. A tool without a licence fee can be used for GMP work if the company does the same requirements, supplier assessment, validation, migration, training and change control work as for a paid product. That work is where most of the cost sits.
Do we have to validate a cloud or SaaS eQMS?
Yes. EU GMP Annex 11 applies to all computerised systems used in GMP work, and FDA’s software assurance guidance for device manufacturers covers software as a service. You can reuse the vendor’s development and testing evidence where your assessment supports it, but the regulated company remains responsible for showing the system is fit for its intended use.
Why do eQMS validation costs vary so much between companies?
Because the extent of validation follows intended use and risk. Routing a CAPA or a change request generally carries less process risk than software that decides whether product is acceptable without further human review, so it needs less test evidence. Customisation, interfaces to other systems and the volume of migrated records all add work.
What costs continue after an eQMS goes live?
Changes to the system and its configuration go through change control, the system is evaluated periodically to confirm it is still in a validated state, backups and restores are checked, and each vendor release is assessed for its effect on your intended use. Budget for that work alongside the subscription.
Can a small company run its QMS on paper or spreadsheets instead?
Yes. GMP allows paper and electronic documentation, so an eQMS is a choice, not a requirement. Paper carries its own costs in controlled forms, manual review and retrieval. A spreadsheet that only records values needs little assurance, but one whose formulas are used directly in production or quality work may need further validation for that use.