What is an eQMS (electronic quality management system), and what does it do?

1What a quality system must contain.

The quality system comes first; an eQMS is one way to run it. For medicines, ICH Q10, which reached Step 4 on 4 June 2008, describes “one comprehensive model for an effective pharmaceutical quality system” built on ISO quality concepts and GMP. Its four elements are a process performance and product quality monitoring system, a corrective and preventive action (CAPA) system, a change management system, and management review of process performance and product quality, with knowledge management and quality risk management as enablers.¹ Chapter 1 of the EU GMP guide, revised in 2013 to align with ICH Q10, says the pharmaceutical quality system “should be fully documented and its effectiveness monitored”.²

The US drug CGMP regulations in Part 211 set many of these processes as specific requirements, from the quality control unit’s responsibilities in 211.22 to complaint files in 211.198.³ For medical devices, the Quality Management System Regulation in 21 CFR Part 820, in effect since 2 February 2026, requires manufacturers to document a quality management system that complies with ISO 13485:2016, which it incorporates by reference.⁴⁵

2What an eQMS does.

An eQMS turns each quality process into a controlled workflow and keeps its records together. The processes, and what their records must show, come from the regulations.³¹²⁶

The point of holding these in one system is the links between them. ICH Q10 describes CAPA acting on the findings of complaints, deviations, audits and trend monitoring, and change management acting on the outputs of monitoring and CAPA.¹ EU GMP adds that the effectiveness of CAPAs “should be monitored and assessed”, and that after a change is implemented, an evaluation confirms the quality objectives were met with “no unintended deleterious impact on product quality”.²

3What the rules expect of the software.

An eQMS holds records the predicate rules require, such as complaint files, investigation records and approved procedures. FDA’s drug data integrity guidance says paper-based and electronic record-keeping systems “are subject to the same requirements”.⁷ When those records are kept electronically in place of paper, or relied on in electronic form, Part 11 applies.⁸ The system must then be validated, limit access, keep time-stamped audit trails and check authority, and each electronic signature must show the signer’s printed name, the date and time and its meaning, linked to its record.⁹ In the EU, Annex 11 applies to all computerised systems used in GMP-regulated activities and bases the extent of validation on a documented risk assessment.¹⁰

FDA’s computer software assurance guidance, written for medical device manufacturers and issued on 3 February 2026, places much of an eQMS in its lower-risk group. It lists software used “for Corrective and Preventive Actions (CAPA) routing, automated logging/tracking of complaints, automated change control management, or automated procedure management” among functions that generally are not high process risk, so assurance effort can follow the process risk rather than the device risk. Its worked example is a nonconformance management system: the manufacturer assesses the vendor, then uses exploratory testing for workflow steps and scenario testing with users for the electronic signature function.¹¹

4Drugs and medical devices.

The same software can serve both, configured to different rules. For drugs, ICH Q10 is reproduced in Part III of the EU GMP guide and can supplement Chapter 1.² For devices, ISO 13485 is the international standard for quality management systems in the design and manufacture of medical devices; ISO lists the 2016 edition as reviewed and confirmed in 2025 and still current.¹² Since 2 February 2026, FDA inspects device manufacturers under the QMSR using Compliance Program 7382.850 instead of the Quality System Inspection Technique.⁵ Part 820 adds requirements of its own, such as what a complaint record must contain when the complaint is reportable or investigated: the device, the date received, any UDI or UPC, the complainant, the nature and details of the complaint, any correction or corrective action, and any reply.⁴

5What stays with people.

An eQMS records decisions; it does not make them. Under 21 CFR 211.22 the quality control unit has the responsibility and authority to approve or reject materials and products and to review production records.³ In the EU, medicinal products are not sold or supplied before a Qualified Person has certified each batch.² ICH Q10 makes senior management responsible for the quality system’s governance through management review.¹

6How it runs in Seal.

Seal’s QMS covers deviations, CAPA, change control, documents, training, audits, suppliers, complaints and risk. Each event opens with its evidence, read from Seal or from the ERP, LIMS, MES and training systems you already run, and a corrective action can become a control in the workflow, released through change control with its own verification. Neil, Seal’s AI agent, assembles the evidence for an investigation and drafts the corrective change for your team to review; approvals, dispositions and signatures stay with your team.

On the Seal platform, laboratory, manufacturing and quality work run on one record, and you can start with one quality workflow alongside the eQMS you have. The eQMS comparison lists what to check when choosing.