Skip to main content
    QHSEtech
    Updated 25 September 2026
    Workflow buying guide

    QMS Document Control Software

    Evaluate a controlled procedure as part of a quality decision: who changes it, who approves it, when it becomes effective, which people need follow-up and how a worker retrieves the current copy. Storage, controlled revision and field access are different requirements, and a software signature or completion flag does not itself establish validation or competence.

    Jump to the 18 products

    Editorial responsibility: Dimitris Mitsios (Founder of The QHSE Standard; product marketing at Tekmon) · Tekmon pays for sponsored placements on this site (disclosure) · How pages are made · LinkedIn

    Regulatory text read on 25 September 2026; vendor workflow sources checked 19 September 2026, and product profiles keep their own research dates. Proposed demonstrations are editorial exercises, not hands-on results or legal advice. Evaluation methodology.

    Which text governs your documents

    FrameworkWhere document control sitsWhat we could verify, and what it means for the software
    ISO 9001Clause 7.5, Documented information (the 2015 numbering and the harmonized-structure clause; confirm it in the 2026 text)ISO 9001:2026 (edition 6) was published on 16 September 2026 and replaced ISO 9001:2015, which ISO now lists as withdrawn. ISO says certified organisations transition within the timeframe set by their certification cycle. The clause text is sold by ISO and was not reproduced here: ask the vendor to map its controls to the edition you are audited against, and check the mapping yourself.
    ISO 13485:2016Clause 4.2.4 (documents) and 4.2.5 (records)FDA's final rule restates that clause 4.2.4 requires documents required by the QMS to be controlled, and that records are a special type of document controlled under 4.2.5. The system has to treat an SOP and the completed record it produces differently.
    21 CFR Part 820 (QMSR, US medical devices)§ 820.10(a): document a QMS that complies with ISO 13485, incorporated by reference in § 820.7(b)Since 2 February 2026, § 820.40 Document controls reads [Reserved]. Document control for US device manufacturers now runs through ISO 13485, plus the record content § 820.35 adds for complaints, servicing and UDI.
    21 CFR Part 11§ 11.10 controls for closed systems; § 11.50 and § 11.70 signaturesApplies to electronic records kept under FDA record requirements (§ 11.1(b)). It sets the audit-trail, access, copy and signature properties the document system must demonstrate.

    What changed on 2 February 2026, and what the old § 820.40 still teaches

    FDA's Quality Management System Regulation became effective on 2 February 2026. It amends Part 820 to incorporate ISO 13485:2016 by reference; the eCFR (current to 23 September 2026) lists § 820.40 as reserved. A vendor slide that still maps its document module to '820.40 Document controls' is describing a regulation that no longer exists in that form, which is itself a useful test of how current their regulatory content is.

    The withdrawn text remains a precise checklist of what a document-change record should show. Until 1 February 2026 it required designated reviewers to approve documents before issue with the date and signature documented; documents available wherever they are used; obsolete documents promptly removed from points of use or otherwise prevented from unintended use; changes reviewed and approved by the same function unless designated otherwise and communicated in a timely manner; and change records with a description of the change, the affected documents, the approver's signature, the approval date and when the change becomes effective. Use it as a demo script, not as the legal basis.

    On signatures, the final rule's preamble (printed page 7514) says that where ISO 13485 uses 'approved' it means an approved document, or a record of a type requiring approval, has a signature and date, and that electronic methods of approval are acceptable when they meet FDA's electronic signature requirements. In the same response FDA dropped the proposed § 820.35 wording that would have required the signature of each individual who approved or re-approved a record.

    Part 11 controls, turned into document-control tests

    RequirementText (21 CFR Part 11)What to make the system do
    § 11.10(a)Validation of systems to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered recordsShow the vendor's validation package and what remains yours: intended use, configuration and change after each release
    § 11.10(b)Accurate and complete copies in human-readable and electronic form suitable for inspectionExport one SOP with every revision, approval and audit entry, readable without the vendor's application
    § 11.10(c)Protection of records for accurate and ready retrieval throughout the retention periodRetrieve a superseded revision and its approval trail after the document has been retired
    § 11.10(d), (g)Access limited to authorised individuals; authority checks for signing and altering recordsTry to approve your own draft and to edit an effective revision with an author-only account
    § 11.10(e)Secure, computer-generated, time-stamped audit trails; changes must not obscure previously recorded informationChange a field after approval and show that the earlier value and the time of the change remain visible
    § 11.10(f)Operational system checks to enforce permitted sequencing of stepsAttempt to release a revision before its review is complete, or to set an effective date before approval
    § 11.50Signed records show the signer's printed name, date and time, and meaning such as review, approval, responsibility or authorship, including on printoutsPrint or export a signed page and read the signature block
    § 11.70Signatures linked to their records so they cannot be excised, copied or transferred by ordinary meansCopy an approved document into a new draft and check that the approval does not travel with it
    § 11.100(a)Each electronic signature unique to one individual, never reused or reassignedDeactivate a departed approver and confirm the account cannot be reassigned to a successor

    What the documented scope establishes

    Ask every product to reject a revision, control its effective date and preserve the document version used for a quality decision. The commercial records do not line up either: per-user subscriptions, annual tailored quotes and scoped proposals price different things, so compare the same users, document volume, validation support and term.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    Same rule for every product: tagged “Document Management”, with a sourced document control capability in its record, or one the vendor stated to us, labelled as vendor-stated. 18 qualify; the first 8 are shown here. The directory below continues with the other 10 tagged profiles, 10 of which also meet the rule.

    Define the record and decision

    StageEvidence to retainAcceptance question
    Change impactReason, affected process and linked recordsWho decides whether training or other changes are necessary?
    Release gateReviewer, approval and effective dateCan an unapproved or future-effective revision be used?
    Draft versus effective copyOwner, reviewer and effective revisionCan an ordinary reader distinguish a draft from the approved instruction?
    Field copyDevice, preparation and sync statusWhat happens to a downloaded copy when the instruction changes?
    Training consequenceAssigned audience and revision-specific completionCan the reviewer distinguish acknowledgement from demonstrated ability?
    Historical recordRevision identifier and retained evidenceCan a reviewer reproduce what was available when the work occurred?

    Proposed demonstration with your own records

    1

    Create a consequential revision

    Change a procedure after a quality finding and identify affected roles, linked forms and existing records. Give author, approver and reader separate accounts.

    2

    Reject and resubmit

    Have the approver return the draft with a reason. Demonstrate the next revision and retained review evidence, and print the signature block to check name, date, time and meaning.

    3

    Challenge access

    Attempt to retrieve the draft as the reader, approve your own document, export a copy and, where supported, open a prepared document without connectivity. Record the actual restrictions.

    4

    Release with controlled follow-up

    Approve the revision, return online and inspect any field copy. Assign the approved training requirement and show an overdue learner. Export the change, approval and training records and identify the owner of any printed-copy recall.

    Resolve these conditions before selecting a plan

    Define document owners, audiences and review intervals for each document type.
    Name the standard edition and regulation you are audited against, and ask for the vendor's mapping to it.
    Define intended use and validation responsibilities before relying on vendor test documents.
    Confirm what signature meaning, identity, timestamps and history the configuration records.
    Ask how downloaded, printed and translated copies are identified and controlled.
    Review integrations and external document links for version ambiguity.
    Name migration, search/OCR, storage, signature and offline entitlements in the proposal.
    Test access removal, request a complete record export and evaluate retention and access to archived evidence after termination.

    Official sources and evaluation limits

    11 sources, checked 19–25 Sep 2026

    Regulations and standards (read 25 September 2026):

    Vendor documentation (checked 19 September 2026):

    Vendor documentation establishes advertised scope, not a tested implementation, legal conclusion or assured outcome. The ISO clause texts are sold by ISO and are cited by number only. AI-assisted explanations may be incomplete; review primary documentation and your own demo evidence.

    Keep the evidence with the buying decision

    Record the demonstrated result, unresolved gap and application or service required. Confirm a complete quote before judging value.

    Prepare a scoped demo scorecard

    More researched products for this process (10)

    The rest of the list above: every other catalogue profile meeting the same tag-and-capability rule, in the same order, checked against the vendor's own documentation on the date shown. Not a recommendation or a complete market map; confirm the module and workflow with the vendor.

    Software categories to explore

    Use this Process to define the work, then explore these software types. Confirm the exact workflow and module with each vendor.

    See all software categories

    Related Guides

    Quality managementPolicy managementChange controlSafety and procedure trainingAudit comparison

    More related guides

    Frequently Asked Questions

    Does a shared folder equal document control?
    A folder can store files, but the required control process needs demonstration. Test approval, revision status, distribution and retrieval in the configuration you would purchase.
    Does 21 CFR 820.40 still apply?
    No. Since FDA's Quality Management System Regulation took effect on 2 February 2026, § 820.40 is reserved and Part 820 requires a quality management system that complies with ISO 13485:2016, incorporated by reference. Document control for US medical device manufacturers now follows ISO 13485 clause 4.2.4, with records under 4.2.5 and § 820.35.
    Does vendor validation replace customer work?
    No. Part 11 requires validation of systems (§ 11.10(a)), and Qualio explicitly describes customer supplier qualification, planning and intended-use assessment. Review the support package against your process and document the remaining responsibilities.
    Must every revision trigger retraining?
    Have the responsible owner determine the impact of the change and required follow-up. Demonstrate how that decision controls assignments instead of assuming every editorial correction has the same consequence.
    Does offline access keep every copy current?
    No universal guarantee is established. Prepare the device and test how a changed or withdrawn document is handled when connectivity returns.
    Are electronic signatures automatically compliant?
    No. Part 11 sets properties such as the signer's printed name, date, time and meaning on the signed record (§ 11.50) and a link between signature and record (§ 11.70). Assess the configured workflow and your own procedures against them rather than relying on a vendor label.
    Is manufacturing QC the same as document control?
    No. Part measurements and process statistics answer different questions from document review and release. Name the QMS and QC applications separately in the proposal.
    When does specialist document-control software fit?
    When revision errors, uncontrolled copies or retrieval effort are a demonstrated problem, or when an FDA-regulated process needs Part 11 controls a general file store cannot show. Compare the complete implementation and administration cost with the controls you actually need.