1Documents and records are different things.
EU GMP divides documentation into two primary types: “instructions (directions, requirements) and records/reports”.¹ Instructions are written and approved before the work: specifications, manufacturing formulae and processing instructions, procedures, protocols and technical agreements. Records “provide evidence of various actions taken to demonstrate compliance with instructions”, such as activities, events, investigations and the history of each batch.¹ For medical devices, the QMSR incorporates ISO 13485:2016 into 21 CFR Part 820, and section 820.35 adds required content to records kept under the standard’s clause 4.2.5, Control of Records.²³
The split between instructions and records is the difference between the two kinds of system. A document management system is built around instructions: getting the right version written, approved, issued and retired. An eQMS is built around the quality system’s processes, which produce records: a deviation and its investigation, a change and its evaluation, a complaint and its follow-up.
2What a document management system must do under GMP.
Chapter 4 of the EU GMP guide sets the expectations for controlled documents, whatever the medium.¹ Where the documents are electronic, Annex 11 and, for FDA-regulated records, Part 11 add controls for the system.⁴⁵
| Requirement | Source |
|---|---|
| Instructions approved, signed and dated by authorised people, uniquely identifiable, with a defined effective date | EU GMP 4.3¹ |
| Documents regularly reviewed and kept up to date | 4.5¹ |
| Working copies reproduced from masters without introducing errors | 4.2¹ |
| Controls for electronic templates, forms and master documents | 4.1¹ |
| An inventory of the documents in the quality management system | 4.32¹ |
| Integrity of each record secured throughout its retention period | 4.10¹ |
| The identity of whoever enters, changes, confirms or deletes data, with date and time | Annex 11, 12.4⁴ |
| Validation, access limits, authority checks and time-stamped audit trails for electronic records | 21 CFR 11.10⁵ |
What carries the risk is the approval, distribution and record-keeping, not the editor. FDA’s 2003 guidance on Part 11 gives the example that validation “would not be important for a word processor used only to generate SOPs”.⁶ The system that approves, issues and retains the procedure is a different matter.
3What an eQMS adds.
The quality system has to run processes that documents alone do not cover. EU GMP Chapter 1 expects a pharmaceutical quality system to ensure that planned changes are evaluated and approved before implementation and evaluated afterwards, that deviations get an appropriate level of root cause analysis with corrective and preventive actions whose effectiveness is monitored, that suppliers are selected and monitored, and that self-inspection regularly appraises the system.⁷ ICH Q10 names four elements: process performance and product quality monitoring, CAPA, change management and management review.⁸ Chapter 4 lists the procedures and records expected for, among others, training, complaints, recalls, returns, change control, investigations into deviations and non-conformances, internal audits and supplier audits.¹
| Process | What its records must show |
|---|---|
| Deviations and investigations | In the US, the investigation extends to other batches that may be affected, and its written record “shall include the conclusions and followup”.⁹ |
| CAPA | Actions arising from complaints, rejections, non-conformances, recalls, deviations, audits, inspections and trends, with a structured investigation of root cause.⁸ |
| Change control | Risk-based evaluation of each proposed change, and assessment of whether it needs a regulatory filing.⁸ |
| Complaints | For devices, the device name, date received, device identifiers, complainant, nature and details of the complaint, any corrective action and any reply.³ |
| Management review | Inspection and audit results, quality reviews, effectiveness of changes and CAPA, and follow-up actions.⁸ |
These processes link records to each other over time. A CAPA starts from an investigation and is judged on what happens afterwards; management review looks at whether changes and CAPAs worked.⁷⁸ That tracking across events is the work an eQMS exists to do.
4Where the two meet.
Many quality processes end in a document. A CAPA or a change often revises a procedure, the revision must be approved before it takes effect, and the people who follow it need training, with EU GMP expecting records of training and of verification of its effectiveness.⁷¹ Change management in ICH Q10 should give “a high degree of assurance there are no unintended consequences of the change”.⁸ So the change record, the document revision and the training it triggers need to be traceable to one another. When a DMS and a separate eQMS hold them, that link has to be kept across two systems; when the eQMS includes document control, it is kept in one.
Size the choice to the company. EU GMP says the size and complexity of a company’s activities should be considered when designing its quality system.⁷ An early-stage company may need controlled procedures first and few quality events; a manufacturer releasing batches needs both. Whichever you pick, a general-purpose platform used for GMP documents or records is a computerised system in GMP use: it should be validated for that use and meet the controls above.⁴¹⁰
5How it runs in Seal.
In Seal, document control runs requests, review, approval, change impact, training, effective dates, controlled copies and supersession as one governed workflow, and a revision identifies the affected roles and can gate the work that depends on it. The instruction is linked to the training, forms and execution rules it governs, and a revision carries its reason, impact assessment, configuration and verification through change control, while completed records keep the version they used; see document management in Seal. You can start with one procedure in a 48-hour evaluation: an effective SOP, a proposed revision and the form or training requirement it affects.
If your documents live in SharePoint, the SharePoint comparison sets out what Microsoft’s own documentation says: no certification exists for Part 11, and customers who build applications subject to FDA regulation are responsible for meeting its requirements.
References
- 1EudraLex Volume 4, Chapter 4: Documentation, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ chapter4_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 2Quality Management System Regulation (QMSR), FDA, updated 2 February 2026. https:/
/ www. fda. gov/ medical- devices/ postmarket- requirements- devices/ quality- management- system- regulation- qmsr (read 6 November 2026) - 321 CFR 820.35, Control of records, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820/ subpart- B/ section- 820. 35 (read 6 November 2026) - 4EudraLex Volume 4, Annex 11: Computerised Systems, revision 1, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 521 CFR 11.10, Controls for closed systems, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 10 (read 6 November 2026) - 6Guidance for Industry: Part 11, Electronic Records; Electronic Signatures, Scope and Application, FDA, August 2003. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ part- 11- electronic- records- electronic- signatures- scope- and- application (read 6 November 2026) - 7EudraLex Volume 4, Chapter 1: Pharmaceutical Quality System, European Commission, in operation since 31 January 2013. https:/
/ health. ec. europa. eu/ document/ download/ e458c423- f564- 4171- b344- 030a461c567f_ en?filename=vol4- chap1_ 2013- 01_ en. pdf (read 6 November 2026) - 8ICH Q10, Pharmaceutical Quality System, ICH, Step 4, 4 June 2008. https:/
/ database. ich. org/ sites/ default/ files/ Q10%20Guideline. pdf (read 6 November 2026) - 921 CFR 211.192, Production record review, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- J/ section- 211. 192 (read 6 November 2026) - 10Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026)
AQuestions and answers
Is an EDMS the same as a document management system?
Yes. EDMS stands for electronic document management system; the E says only that the documents are electronic. Under GMP it meets the same document control expectations as paper, plus the computerised system rules of Part 11 and EU GMP Annex 11.
Does an eQMS replace a document management system?
It can, if its document control meets GMP: approval, effective dates, versions, controlled distribution, periodic review and retention. Some companies keep a separate DMS and connect it to the eQMS. Then the link between a change or CAPA and the document revision it causes has to be kept across both systems.
Can SharePoint be used as a GMP document management system?
It can be used if the company configures it, validates it for its intended use and meets the controls GMP expects, such as signed approval, audit trails, retention and access control. That configuration and validation is the regulated company’s responsibility, not the platform vendor’s.
What is the difference between a document and a record in GMP?
EU GMP divides documentation into instructions, such as specifications, procedures and protocols, and records, which give evidence of what was done, such as batch records, investigations and test results. Instructions are approved before use and revised under control. Records are made as the work happens, and any change to an entry should leave the original readable.
Should training records sit in the DMS or the eQMS?
Either can hold them, but they should show who was trained on which version of a procedure, and EU GMP expects the effectiveness of training to be verified. Keeping training beside document control makes it easier to see who needs retraining when a procedure changes.