Updated 27 September 2026

Quality and regulatory buyer guide

Change Control Software for Regulated Quality Systems

Change control is the quality-system process that assesses, approves and verifies a change to a product, specification, process, document or validated system before it takes effect, and checks afterwards that it worked. This guide is for quality and regulatory teams working to ISO 9001, ISO 13485 and the FDA's QMSR, or EU GMP. If you mean process-safety management of change for plant, equipment and operating changes, see MOC software.

Jump to the 13 products

Editorial responsibility: Dimitris Mitsios (Founder of The QHSE Standard; product marketing at Tekmon) · Tekmon pays for sponsored placements on this site (disclosure) · How pages are made · LinkedIn

On this page (8 sections)

What the standards and regulations ask a change-control process to cover

ISO 9001:2015 addresses change in several clauses. ISO/TC 176/SC 2, the committee responsible for the standard, groups them as 6.3 planning of changes to the quality management system, 8.1 control of planned changes and review of the consequences of unintended ones, 8.3.6 design and development changes, and 8.5.6 control of changes for production or service provision. ISO published ISO 9001:2026 on 16 September 2026 and now lists the 2015 edition as withdrawn; see the quality management guide for the certification transition, and check clause numbers against the edition you are certified to.

For medical devices sold in the United States, the Quality Management System Regulation took effect on 2 February 2026. 21 CFR Part 820 now incorporates ISO 13485:2016 by reference, and its design and development clause 7.3 applies to class II and III devices and to the class I devices listed in 820.10(c). In the final rule's preamble, FDA says a successful QMS requires a manufacturer to document design changes made after the initial design inputs are approved, and changes that correct design deficiencies once the design has been released to production. Whether a device change also needs a new 510(k) is a separate decision, which FDA's October 2017 guidance on changes to an existing device addresses.

For medicinal products in the EU, Chapter 1 of the EU GMP guide (in operation since 31 January 2013) expects the pharmaceutical quality system to evaluate planned changes prospectively and approve them before implementation, taking regulatory notification and approval into account where required, and to evaluate each change after implementation for any unintended effect on product quality. It also expects significant changes to the manufacturing process to be validated.

Annex 15 (in operation since 1 October 2015), section 11, adds the detail: written procedures for planned changes to starting materials, components, processes, equipment, premises, batch size, methods of production or testing and design space; quality risk management to evaluate the impact on product quality, the quality system, documentation, validation, regulatory status, calibration and maintenance, and to plan any process validation, verification or requalification; approval by the responsible persons after the supporting data have been reviewed; and, where appropriate, an evaluation of effectiveness after implementation. Where design space is used, the guideline says a change should be considered against the design space registered in the marketing authorisation and the need for regulatory action assessed.

This section summarises the texts to help you evaluate software; it is not regulatory advice. Your quality and regulatory specialists decide which requirements apply to your products and how your procedure meets them.

Change-control evaluation checklist

Requirement	Ask the vendor to demonstrate	What the record should hold
Planned change to the QMS, ISO 9001:2015 6.3	Raise a process change with a reason and a planned date	Reason, owner, affected processes and the implementation plan
Control of changes, ISO 9001:2015 8.5.6	Change a controlled specification used in production	The review of the change and how continuing conformity was confirmed
Unintended changes, ISO 9001:2015 8.1	Record a deviation that changed a process without approval	Consequences reviewed and the actions taken, linked to the deviation
Impact assessment, Annex 15 11.4	Assess a change to a starting material	Impact on quality, documents, validation, regulatory status, calibration and maintenance
Validation impact, Annex 15 11.4 and Chapter 1 1.8(ii)	Change a critical process step	Validation, verification or requalification linked and complete before release
Regulatory filing impact, Chapter 1 1.4(xii) and Annex 15 11.3-11.4	Propose a change that may need notification or prior approval	Recorded regulatory assessment, with implementation held until any approval
Design changes, ISO 13485 clause 7.3 (QMSR) and ISO 9001:2015 8.3.6	Change a design after its inputs were approved	Change linked to the design file with its review and verification
Documents and training	Revise an SOP and assign retraining for affected roles	Approved revision, effective date, superseded version withdrawn, training complete
Approval, Annex 15 11.5-11.6	Submit for final approval with supporting data missing	Approval by responsible persons only after the data are reviewed
Effectiveness, Annex 15 11.7 and Chapter 1 1.4(xiii)	Close a change	Post-implementation evaluation scheduled, performed and recorded

Profiles documenting a quality change workflow

The same rule applies to every researched profile. Check the named quality module, product scope and plan before treating document revision as a complete regulated change-control process.

Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

Same rule for every product: tagged “Quality Management”, “Document Management”, “Change Control” or “CAPA Management”, with a sourced quality change-control capability in its record, or one the vendor stated to us, labelled as vendor-stated. 13 qualify; the first 8 are shown, then the other 5.

SimplerQMS
Documented: Risk-based change control. Source: simplerqms.com
Greenlight Guru
Documented: Controlled documents and change. Source: greenlight.guru
isoTracker
Documented: Document control and version history. Source: isotracker.com
QT9 QMS
Documented: Controlled document lifecycle and revision-triggered training. Source: qt9software.com
SafetyDocs by SafetyCulture
Documented: Legislative update notices (conditional). Source: safetydocs.safetyculture.com
Scilife
Documented: Change control. Source: scilife.io
AssurX
Documented: Product and process change control. Source: assurx.com
MasterControl
Documented: Training connection (conditional). Source: mastercontrol.com

Also meet the rule, in the same order (5)

Change-control candidates: pricing and offline scope
Product	Published price	Free trial	Offline workflow
SimplerQMS	Yes	Free trial documented	Not classified
Greenlight Guru	Yes	Trial or demo on request	Not classified
isoTracker	Yes	Trial or demo on request	Not classified
QT9 QMS	No	Free trial documented	Partial
SafetyDocs by SafetyCulture	Yes	Not established	Not applicable

Status labels from each profile's sourced record; open the profile for the evidence and dates.

The table shows the first 5 products of the list, in the same order; every profile carries the same fields.

A regulated-product demo scenario

Demonstrate a specification change to a starting material that affects two sites, an open purchase order, one validated process step and an SOP with a training assignment. Ask the vendor to record the regulatory assessment as needing prior approval, and show that implementation cannot go ahead until it is recorded. One site should reject the proposed effective date. Then show the revised approval, the requalification task, the records requiring updates, what a worker sees before and after release, and the effectiveness check once the change closes.

Pricing: quote validation, documents and signatures

Request a quote covering change requests, document control, training links, required signatures, validation deliverables, test environments and release maintenance. Ask who rechecks configured workflows after upgrades. Where electronic-record rules apply, have your responsible specialist define the validation evidence and intended use before reviewing the vendor response.

Questions to include in your RFP

Can the impact assessment carry separate fields for validation, regulatory status, documents, training, calibration and maintenance?

Can a change be held after approval until a regulatory approval or requalification is recorded?

Can the same person request and approve a change, and is that configurable?

Are linked documents, training and CAPAs updated automatically, manually or through a separate integration?

Can a change be withdrawn or reopened without erasing its review history?

Sources and evaluation method

15 sources

Standards, regulations, guidance and vendor change-control pages opened 25 September 2026. Each linked profile carries its own review date for pricing and offline evidence. ISO 9001:2015 clause titles are taken from ISO/TC 176/SC 2's public paper, not the standard's full text. This guide uses primary documents and vendor documentation, not hands-on testing or customer testimony. The checklist and demo tests are editorial judgements, not verified product performance.

We have not assigned numerical scores here. AI-assisted explanations may be incomplete and do not replace primary documentation or a demo. Evaluation methodology.

Audit Trail and Document Control Gaps in QHSE Software
Article on audit trail and document control gaps.
SOP (Standard Operating Procedure) — definition, software & FAQs
Definition of a standard operating procedure.
Nonconformance Report (NCR) Template
Free template for a nonconformance report.

Frequently Asked Questions

Does a change to a validated process need requalification?

It depends on the change. EU GMP Chapter 1 expects critical manufacturing steps and significant changes to the process to be validated, and Annex 15 section 11.4 asks for quality risk management to evaluate each planned change and plan any necessary process validation, verification or requalification. Your quality unit decides what a given change needs; the software should link that work to the change and show whether it was complete before release.

Which ISO 9001 clauses cover change?

In ISO 9001:2015, ISO/TC 176/SC 2 groups the change requirements as 6.3 planning of changes, 8.1 control of planned and unintended changes, 8.3.6 design and development changes and 8.5.6 control of changes. ISO 9001:2026 was published on 16 September 2026; check the clause numbering in the edition your certificate refers to.

Does every change need a regulatory submission?

No single rule applies. EU GMP Chapter 1 expects planned changes to be evaluated taking regulatory notification and approval into account where required, and FDA publishes separate guidance on when a device change needs a new 510(k). Have your regulatory team make that call, then test how the software records it and holds implementation where needed.

Does change-control software guarantee regulatory compliance?

No. Define applicable requirements, intended use and configuration with the responsible specialists. Vendor documentation can support evaluation, but a signature feature or compliance claim is not proof that your deployed process meets every obligation.