1Start from the quality system you have to run.
An eQMS runs processes your quality system already needs, so the list of what it must do comes from the rules for that system rather than from a vendor’s module list. For medicines, the requirements sit in EU GMP Chapter 1 on the pharmaceutical quality system, ICH Q10 and EU GMP Chapter 4 on documentation.¹²³ For medical devices, the Quality Management System Regulation, in force since 2 February 2026, incorporates ISO 13485:2016 by reference into 21 CFR Part 820.⁴
| Process | What the rules expect |
|---|---|
| Deviations, root cause and CAPA | An appropriate level of root cause analysis, corrective and preventive actions, and monitoring of their effectiveness.¹² |
| Change control | Prospective evaluation and approval of planned changes, using quality risk management, and evaluation after implementation.¹² |
| Complaints, recalls and returns | Written procedures and records.³ For devices, specific content for complaint records.⁵ |
| Documents and training | Controlled, approved instructions, an inventory of quality system documents, and training records including verification of the effectiveness of training.³ |
| Suppliers and outsourced work | Selection and monitoring of suppliers, assessment before outsourcing, written agreements and monitoring of performance.¹² |
| Internal audit | Self-inspection or quality audit that regularly appraises the quality system.¹ |
| Management review | Review of inspection and audit results, quality reviews and earlier actions, with resulting improvements.² |
Size the system to the company. Chapter 1 says the size and complexity of the company’s activities should be taken into account when developing or modifying a pharmaceutical quality system.¹ A company that does not run a process does not need software for it on day one.
2Write the requirements before you see a demo.
EU GMP Annex 11 expects user requirements that “describe the required functions of the computerised system and be based on documented risk assessment and GMP impact”, traceable through the system’s life.⁶ The draft revision of Annex 11, consulted on from July to October 2025 and not yet in force, says this applies whether a system is developed in-house, bought off the shelf or “provided as-a-service”. If the vendor supplies the requirements, the regulated user should review and approve them and decide whether the system fits its GMP requirements and processes “as is, or whether it should be configured or customised”.⁷⁸
PIC/S makes the same point about data integrity: requirements should cover data management and integrity, because “inadequate consideration of DI requirements may result in the purchase of software systems that do not include the basic functionality required”.⁹ The draft also calls requirements “the very basis for system qualification and validation”, so writing them first is not wasted work whichever system you choose.⁷
3The controls every eQMS needs.
Where records required by FDA’s regulations are kept electronically, Part 11 applies; in the EU, Annex 11 covers every computerised system used in GMP work.¹⁰⁶ An eQMS holds many of those records, so these controls are part of the requirements, not extras.
| Control | Requirement |
|---|---|
| Validation for intended use | Validation to ensure accuracy, reliability, consistent performance and the ability to discern invalid or altered records.¹¹ |
| Access and authority | Access limited to authorised people, and authority checks on who can sign, alter records or perform an operation.¹¹ |
| Audit trail | Secure, computer-generated, time-stamped audit trails that do not obscure earlier entries.¹¹ In the EU, the reason for a change or deletion of GMP-relevant data is documented.⁶ |
| Attribution | Systems for data and documents record who entered, changed, confirmed or deleted data, with date and time.⁶ |
| Electronic signatures | The signer’s printed name, date and time, and meaning, linked to the record so it cannot be copied or transferred.¹²¹³ |
| Copies and retrieval | Accurate and complete copies in human-readable and electronic form, and records retrievable throughout the retention period.¹¹ |
| Backup and continuity | Regular backups with restore checked, and arrangements for continuity if the system fails.⁶ |
4Assess the supplier as well as the software.
Annex 11 calls the competence and reliability of a supplier “key factors” in selection, bases the need for an audit on risk, and expects the regulated user to check that the system was developed under an appropriate quality management system. Suppliers’ quality system and audit information should be available to inspectors on request.⁶ ICH Q10 asks for the suitability and competence of the other party to be assessed before work is outsourced.²
FDA’s guidance on computer software assurance, written for device manufacturers and final in February 2026, lists ways to assess a software vendor: an onsite audit, if applicable; its accreditations and certifications, such as SOC reports and ISO certifications; its practices for software development, quality assurance and cybersecurity; and its data integrity controls.¹⁴ What you find decides how much of the vendor’s own testing you can reuse. The same guidance treats the developer’s validation work as a possible “starting point”, and ISPE’s GAMP 5 Second Edition encourages using supplier knowledge and documentation where possible.¹⁴¹⁵ PIC/S adds that companies should not place “sole reliance on vendor qualification packages”.⁹
5Plan for releases, change and leaving.
A cloud eQMS changes under you. In FDA’s worked example of a SaaS system, the vendor documents the changes and testing in each automatic update, and the manufacturer assesses their effect on its intended use and tests in proportion.¹⁴ The draft Annex 11 expects a contract that agrees, among other things, conditions for supplier audits, support during inspections, the process for new versions and “the regulated user’s possibility to test these prior to release”, and an exit strategy that keeps control of system data.⁷
Ask each vendor how often releases arrive, what evidence comes with them and how you would export every record with its audit trail and signatures. Annex 11 expects archived data to stay accessible, readable and intact, and the ability to retrieve it to be tested when the system changes.⁶
6Test the shortlist on your own work.
A demonstration shows the vendor’s scenario. PIC/S tells inspectors to check that end-user testing shows the software “not only meets the requirements of the vendor, but is fit for its intended use”.⁹ Before you sign, run a real deviation, change and CAPA from your own procedures through each shortlisted system, with your roles and signatures, and check the result against your requirements.
7How it runs in Seal.
Seal’s eQMS comparison sets out what to check when choosing: whether a deviation opens from the batch or test it concerns, whether a CAPA is judged on the runs that follow, whether each change to a workflow is released with its own tests and approvals, and whether your own team configures it. Seal’s quality system covers deviations, CAPA, change control, documents, training, audits, suppliers, complaints and risk, on the same platform as the laboratory and manufacturing work they govern; see quality management in Seal.
You can start with one quality workflow in a 48-hour evaluation, beside the eQMS you already run. If that is Veeva Vault QMS, Seal’s connection links its deviations, CAPAs and change controls with related work in Seal, starting with read access; the Veeva Vault QMS comparison sets out how the two differ.
References
- 1EudraLex Volume 4, Chapter 1: Pharmaceutical Quality System, European Commission, in operation since 31 January 2013. https:/
/ health. ec. europa. eu/ document/ download/ e458c423- f564- 4171- b344- 030a461c567f_ en?filename=vol4- chap1_ 2013- 01_ en. pdf (read 6 November 2026) - 2ICH Q10, Pharmaceutical Quality System, ICH, Step 4, 4 June 2008. https:/
/ database. ich. org/ sites/ default/ files/ Q10%20Guideline. pdf (read 6 November 2026) - 3EudraLex Volume 4, Chapter 4: Documentation, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ chapter4_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 4Quality Management System Regulation (QMSR), FDA, updated 2 February 2026. https:/
/ www. fda. gov/ medical- devices/ postmarket- requirements- devices/ quality- management- system- regulation- qmsr (read 6 November 2026) - 521 CFR 820.35, Control of records, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820/ subpart- B/ section- 820. 35 (read 6 November 2026) - 6EudraLex Volume 4, Annex 11: Computerised Systems, revision 1, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 7Annex 11: Computerised Systems, draft for consultation, European Commission and PIC/S, July 2025. https:/
/ picscheme. org/ docview/ 9714 (read 6 November 2026) - 8Joint stakeholders consultation on the revision of Chapter 4, Annex 11 and the new Annex 22 of the PIC/S and EU GMP Guides, PIC/S, 7 July 2025. https:/
/ picscheme. org/ en/ news/ 131/ joint- stakeholders- consultation- on- the- revision- of- chapter- 4 (read 6 November 2026) - 9PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, PIC/S, 1 July 2021. https:/
/ picscheme. org/ docview/ 4234 (read 6 November 2026) - 1021 CFR 11.1, Scope, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- A/ section- 11. 1 (read 6 November 2026) - 1121 CFR 11.10, Controls for closed systems, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 10 (read 6 November 2026) - 1221 CFR 11.50, Signature manifestations, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 50 (read 6 November 2026) - 1321 CFR 11.70, Signature/record linking, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 70 (read 6 November 2026) - 14Computer Software Assurance for Production and Quality Management System Software, Guidance for Industry and FDA Staff, FDA, February 2026. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ computer- software- assurance- production- and- quality- management- system- software (read 6 November 2026) - 15GAMP 5 Guide, 2nd Edition: A Risk-Based Approach to Compliant GxP Computerized Systems, ISPE, July 2022. https:/
/ ispe. org/ publications/ guidance- documents/ gamp- 5- guide- 2nd- edition (read 6 November 2026)
AQuestions and answers
What modules should an eQMS have?
The ones your quality system runs. EU GMP and ICH Q10 expect a medicines manufacturer to manage deviations and CAPA, change control, documents, training, complaints, suppliers, internal audit and management review, so those are the usual starting set. A small company can start with the processes it has and add others as it grows, as long as each is validated for its use.
Does an eQMS need to be 21 CFR Part 11 compliant?
If it holds records that FDA’s regulations require, such as investigation records or complaint files, Part 11 applies to them. No software is compliant on its own: the system needs the right controls, and your company has to validate it and use it under procedures. In the EU, Annex 11 sets similar expectations.
Can we rely on the vendor’s validation package?
In part. FDA’s software assurance guidance lets you start from the vendor’s development and testing work and add what your risk assessment calls for, and for some low-risk functions that may be enough. PIC/S expects your own tests to show the system works for your intended use. The regulated company remains responsible.
What should the contract with an eQMS vendor cover?
EU GMP Annex 11 requires a formal agreement stating the vendor’s responsibilities. The draft revision adds detail: service levels and reporting, audit conditions, support during inspections, how security and quality issues are communicated, how new versions are released and tested, and an exit strategy for your data.
Should a small biotech buy the same eQMS as a large pharma company?
Not necessarily. EU GMP says the size and complexity of a company’s activities should shape its quality system. Choose for the processes you run and the products you make now, and check that the system can grow and change under control as you add products, sites or phases.