IndustriesMedical devices and IVDs
Medical device QMS software for the QMSR era
QMSdesk™ is medical device QMS software that keeps complaints, risk, CAPA, suppliers and management review in one linked record. When FDA or a notified body asks how a complaint reached its fix, you open the chain and show them.
Usual profiles for this work
Regulations they carry
ISO 9001; ISO 31000:2018; 21 CFR Part 11; ALCOA+ data-integrity principles; ISO 13485:2016; FDA QMSR (21 CFR Part 820); EU MDR 2017/745; ISO 14971:2019
- Retention floor
- 15 years
- Event workflows
- 9, including MDR vigilance and Post-market surveillance event
A typical starting set. You choose your own profiles, and can add more at any time.
What a device manufacturer needs from an eQMS
Every complaint, hazard and supplier issue traced to a verified fix, with reporting deadlines in plain sight.
Monday
A user reports that a device alarm failed to sound. The complaint is acknowledged inside 3 business days, and the reportability review is a signed decision. The MDR profile has already set the clock: 30 days for a US MDR report, 15 for an EU serious incident. Your team links the complaint to its risk in the register, and a signed CAPA decision raises the CAPA.
What the rules ask of you, and how QMSdesk supports it
Device rules ask you to prove that every complaint was assessed for reporting on time, every risk was weighed against the design, and every supplier issue and fix was checked. FDA now inspects US device makers against ISO 13485 through the QMSR, and a certificate alone doesn't exempt a site, so your records have to tell the story on their own. QMSdesk keeps complaint, risk, CAPA and supplier records in one linked chain.
| Regulation | What it asks of you | How QMSdesk supports it |
|---|---|---|
| FDA QMSR (21 CFR Part 820) | FDA's quality system rule for devices sold in the US, built on ISO 13485. | Complaint, supplier, audit and management review evidence kept as linked records. |
| ISO 13485:2016 | The quality management standard for medical devices. | Built to support organizations working to ISO 13485:2016. |
| EU MDR 2017/745 | The EU rules for devices on the market, including vigilance reporting. | MDR vigilance events on the complaint workflow, with the 15-day clock for an EU serious incident and 30 days for a US MDR report. |
| ISO 14971:2019 | Risk management across the device's life. | Complaints linked to risks in the register, and each CAPA records its impact on the design. |
| EU IVDR 2017/746 | The EU rules for in vitro diagnostics. | Add the IVDR profile. Your IVD work runs on the MDR profile, with the same retention. |
| 21 CFR Part 11 | Electronic records and signatures you can trust as much as paper. | A hash-chained audit trail and re-authentication at every signature. |
| Computer Software Assurance | A risk-based way to show the software is fit for use. | A validated core platform, and a written scope for the validation that stays yours. |
Every customer also holds BASE, the quality baseline, which carries 21 CFR Part 11, ALCOA+, ISO 9001 and ISO 31000.
ISO 13485 QMS software: what the MDR profile turns on
A device manufacturer holds the MDR profile, alongside BASE.
Event types
MDR vigilance, on the complaint workflow. Post-market surveillance events, on the incident workflow.
Device identification
Every nonconformance carries its UDI and serial number.
CAPA
Each CAPA records its impact on the device's design.
Reporting deadlines
30 days for a US MDR report. 15 days for an EU serious incident.
Roles
PRRC, Design Engineer, Product Safety Officer, UDI Manager and Post-Market Surveillance Manager, next to the nine standard roles every organization gets.
Retention
Device lifetime plus 15 years, with 15 years as the enforced minimum.
IVD QMS: the IVDR profile
Make in vitro diagnostics? Add the IVDR profile. The IVDR profile states your IVD position accurately. It adds EU IVDR to your bundle, with retention as MDR, and brings no event types or roles of its own. Your IVD work runs on the MDR profile and the base platform.
Medical device QMS software modules that matter most
Complaint management
Acknowledgment tracked against a 3-business-day deadline, a signed reportability review, a signed CAPA decision and a recorded customer response.
Risk management
Controls follow the ISO 14971 taxonomy: inherent safety, protective measures and information for safety. The person who implements a control never verifies it, and residual risk is scored only after verification. A maximum-severity risk never scores below High.
CAPA
A CAPA can start from a complaint, an audit, a trend or a management review. After closure, an effectiveness check confirms the fix held. If it didn't, a new linked CAPA is raised, and the signed record stays as it was.
Supplier quality
Risk tiers set qualification gates and reviews every 6, 12 or 24 months. Certificate alerts go out at 90, 60 and 30 days, and an expired certificate opens a risk. Suppliers answer a SCAR through a single-use link, with no account.
Document control
Author, reviewer and approver are always different people. Existing files come in under a signed migration attestation and carry a permanent "Migrated" badge.
Management review
The review works from a frozen, signed snapshot of your quality system, so the minutes and the evidence always agree. Internal audits run in audit management, where auditors never audit their own department.
Every tier includes every module: document control, quality events, CAPA, change control, training, risk, audits, supplier quality, management review and reporting. See the whole platform
Build your regulatory profile
Start from Medical devices, add IVD, and see your event types, roles, reporting deadlines and retention.
Questions buyers ask
How does QMSdesk help with the QMSR?
The QMSR brings ISO 13485:2016 into FDA inspections. QMSdesk is built to support organizations working to ISO 13485:2016, and it keeps complaints, CAPA, suppliers, audits and management review as linked records, so the trail from a complaint to its fix is one you can open.
Does QMSdesk file MDR or vigilance reports?
QMSdesk records the signed reportability decision and its reasoning, and the MDR profile sets the deadlines: 30 days for a US MDR report, 15 for an EU serious incident. The report itself goes to the authority through its own channel.
We make devices and IVDs. Which profiles do we need?
MDR and IVDR together. You hold both profiles, and you'll see both bundles before you commit.
Is QMSdesk built for ISO 14971?
It's built on ISO 14971 and ICH Q9 principles. The MDR profile carries ISO 14971:2019, and the risk engine follows its control model, from verified controls to residual risk.
How is QMSdesk priced?
By organization tier, never per seat, and every tier includes every module. See pricing.
From complaint to proven fix, in one record
Bring a real complaint, from receipt to CAPA. We'll show you QMSdesk running it.