Define the operating boundary
A useful definition names the triggering event, required inputs, governing source, accountable owner, decision or action, exception path, evidence retained, and downstream handoff. Buyers should adapt those elements to their own population, jurisdictions, policies, systems, and control model before writing requirements.
The most important distinction is between a label and an operational capability. A provider may document complaints and post-market quality while depending on customer-supplied policy, licensed content, third-party data, integration partners, manual review, or services. The demonstration should expose those dependencies rather than hiding them behind a completed interface.
What a demonstration should prove
- Begin with representative source records and a named policy, standard, or controlled rule.
- Show the normal path, an ambiguous case, missing data, an exception, an override, and a material source change.
- Identify who can change rules, who can approve or reject, and how accountability is preserved.
- Trace every output back to inputs, versions, timestamps, user actions, and governing evidence.
- Export the resulting record and reconcile it with downstream systems and retained obligations.
Authority and operating context
FDA QMSR
The QMSR amends FDA's device current good manufacturing practice requirements in 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, while retaining FDA-specific statutory and regulatory requirements. FDA began using a new device inspection process when the rule became effective. QMSR changes the inspection and record context in which U.S. device manufacturers operate. Buyers need systems that can preserve the organization's controlled processes and evidence; no vendor can make the organization compliant by configuration alone.
FDA drug CGMP
Parts 210 and 211 establish current good manufacturing practice requirements for drug manufacture, processing, packing, and holding, including organization, facilities, equipment, components, production controls, laboratory controls, records, reports, returned products, and complaints. eQMS products organize records supporting drug CGMP processes, but software boundaries must align with manufacturing, laboratory, ERP, MES, and supplier systems. A feature list alone cannot establish that regulated processes are controlled.
ISO 13485:2016
ISO 13485 specifies quality-management-system requirements for organizations involved in one or more stages of the medical-device lifecycle and emphasizes regulatory requirements, risk-based processes, supplier control, documentation, and product realization. The standard is a central organizing reference for medical-device QMS design and is incorporated into the U.S. QMSR. Buyers need systems that can express their own processes and evidence without treating a vendor template as the standard itself.
EU MDR
The MDR establishes rules for placing medical devices on the EU market and covers economic operators, conformity assessment, quality systems, clinical evidence, technical documentation, UDI, registration, vigilance, post-market surveillance, and market surveillance. MDR work crosses QMS, product lifecycle, regulatory registration, UDI, technical documentation, clinical evidence, and post-market systems. Buyers need explicit system boundaries and reliable traceability across them.
EU IVDR
The IVDR establishes rules for in vitro diagnostic devices, including classification, conformity assessment, quality systems, performance evidence, technical documentation, UDI, registration, vigilance, post-market surveillance, and performance studies. IVD quality and regulatory records require device-specific classification, evidence, registration, and post-market workflows. Generic pharma or medical-device templates may not cover performance-study and IVD data needs.
Operating domains
Audit, inspection, and evidence readiness
Risk that the organization cannot retrieve a coherent, accurate, and reviewable evidence chain for an auditor, inspector, certification body, notified body, or internal governance review without manual reconstruction.
Complaints, post-market quality, and safety handoffs
Risk that complaints, adverse-event indicators, product-quality complaints, vigilance, field actions, recalls, post-market surveillance, and regulatory reporting are delayed or fragmented across quality, safety, medical, regulatory, and commercial systems.
Evidence and comparison limits
Official provider documentation can establish product positioning. Provider confirmation can clarify package or availability. Independent observation requires a disclosed scenario, environment, date, inputs, and reproducible result. None of those sources alone establishes buyer-specific legal, clinical, regulatory, quality, or operational fitness.
Buyer questions
- What exact outcome and evidence should complaints and post-market quality produce?
- Which source, version, and customer facts govern the workflow?
- Which decisions remain human and who is accountable for them?
- What is native, configured, integrated, service-delivered, or planned?
- How does a changed source affect open and historical records?
Recent changes
FDA Quality Management System Regulation takes effect — Device manufacturers must align their controlled quality systems and inspection evidence; software alignment can support but cannot establish organizational compliance.