Companies regulated by the U.S. Food and Drug administration (FDA) need to establish current good manufacturing practices (CGMPs) as part of Title 21 CFR part 820 requirements. This includes creation of quality systems to ensure development of safe and effective devices. More specifically, medical device manufacturers must establish methods and procedures to design, produce, and deliver devices that meet the quality system standard.1

Cloud-based QMS software with multi-tenant architecture provides the best way to take advantage of ongoing advancements in technology. (Credit: Arena Solutions)

However, FDA does not require manufacturers to use software systems. But with increasingly complex products, supply chains, and evolving regulations in global markets, quality management systems (QMS) are the best way to ensure that everyone involved in developing and launching new products has access and visibility throughout the product life cycle. Although FDA does not require use of software systems, it does encourage the use of automated systems to design, produce, deliver, and service medical devices. With dispersed teams and more complex products, medical device companies can simplify regulatory compliance with automated QMS software, especially when it is cloud based.

This article reviews technological advancements, explores quality management challenges and explains why cloud-based QMS software provides a better way to comply with regulations while reducing traditional burdens and costs.

Greater Device Complexity

With the advent of the Internet of Things (IoT) and the desire to connect devices to people, systems, and data, many devices, including medical devices, have become highly complex. These devices are often composed of electrical, optical, software, and mechanical parts that continue to shrink the product footprint (or form) with technological advancements in miniaturization. Ensuring that these products work as designed is challenging and critical because they impact patient health and can result in harm, or even death, when they don't work properly.

As devices become increasingly complex, the need for interoperability between systems requires greater visibility and traceability throughout the new product development cycle. Having a single system to collaborate around the product design and related quality records and processes is key, and cloud-based QMS solutions that are product-centric can remove traditional blind spots that lead to device issues. Removing blind spots is necessary to meet and speed the time to compliance.

Embracing Automation to Streamline Compliance

It can be quite cumbersome to navigate FDA regulatory requirements, especially for software that touches so many parts of the organization, from engineering to quality and operations. QMS processes span many areas of the organization, including those involved with designing, testing, auditing, manufacturing, packaging, and servicing of finished devices. Understanding the intended use of the software solution can be difficult if left to the medical device manufacturer to figure out and determine how to best validate the solution.1

There can be “shades of gray” when considering and interpreting how to best comply with International Organization for Standardization (ISO) standards, Sarbanes-Oxley, FDA regulations, and other regulatory body regulations. For instance, the latest medical device quality management system standards set forth in ISO 13485:2016 provided for a three-year grace period before mandating that all device manufacturers be in compliance.2 To aid in this initiative, FDA embraced new technologies and digital data — and encouraged device makers to do the same. As a result, FDA reported that there has been greater adoption of solutions that automate quality management processes.3

With dispersed teams and more complex products, medical device companies can simplify regulatory compliance with automated, cloud-based QMS software. (Credit: iStock)

Five Key Considerations for Cloud-Based QMS

Quality and product teams responsible for meeting regulatory and safety compliance, while delivering innovative products to market rapidly, should consider these key capabilities:

  1. Support for quality processes throughout the product life cycle. Since quality issues can arise any time before or after delivery to customers, make certain the QMS tracks the entire design from concept through sustaining. This includes a way to view, approve, and trace the history of changes.

  2. Dispersed team support. Unless teams are in a single building or location, it's important to have a way for all internal teams, distributed teams, and supply chain partners to be on the same page at all times. To do this, a QMS must have role-based access to protect IP and provide data sharing based on individual roles. There cannot be barriers to access information by any impacted team member, so the cloud QMS should have an access model that allows everyone to access the right data from anywhere via a web browser without the use of custom code, portals, or VPN protocols.

  3. Closed-loop corrective action preventative action (CAPA) processes. To ensure patient safety and resolve quality issues quickly, companies need a well-defined CAPA process. It should allow for easy creation of issues stemming from customer complaints, audits, or non-conformances. The CAPA process should enable all key stakeholders the ability to gather information quickly about a problem and conduct root cause analyses. That requires connection to the product design record and the assembly (or bill of materials/BOM). By managing the entire design and BOM in a single system with connected quality and CAPA records, everyone can more easily determine issue causes to speed the time to resolution. And the resolution can be linked directly to the engineering change orders (ECOs) that make final corrections to the design, procedures, or manufacturing processes.

  4. Connected to product record. As mentioned in the prior point, connecting quality and product provides a single source of truth for a product-centric QMS approach. The foundation of a good QMS is the product record, and it's layered with quality processes to ensure devices work as designed and safely. The product and quality record should span all related documents, parts, assemblies (BOMs), standard operating procedures (SOPs), design history files (DHF), device master records (DMRs), and all quality records.

  5. Ease of validation. Validation is made easier with multitenant cloud QMS. QMS vendors can provide expertise and do much of the heavy lifting for installation qualification (IQ) and operational qualification (OQ), while helping minimize the effort required for customer-specific performance qualification (PQ). It is important to have a QMS vendor that supports validation internally with in-house, seasoned validation experts.

Why Multi-Tenant Cloud QMS Software Simplifies Validation

Expanding on the fifth point above, it is critical to understand why multi-tenant cloud QMS is the key to simplifying software validation.

Companies must establish current good manufacturing practices (CGMPs) as part of Title 21 CFR part 820 requirements. (Credit: Arena Solutions)

Unlike on-premises QMS software or hosted single-tenant QMS solutions, multi-tenant cloud-based software lets all customers run the latest software version at all times. In general, multi-tenant software has a significant advantage over traditional, on-premises software because it allows companies to quickly scale from a few users to thousands of users — without adding infrastructure — and greatly reduces time spent upgrading software.

Cloud-based QMS software with multi-tenant architecture provides the best way to take advantage of ongoing advancements in technology, while providing the lowest total cost of ownership (TCO) with a simplified validation experience. With a multi-tenant cloud solution, medical device companies can leverage software enhancements regularly, without the traditional validation “heavy lifting” required by older on-premises or single-tenant QMS solutions.

In software validation, cloud-based software has all those advantages with the added bonus of greatly easing the validation process, including leveraging validation commonality (based on every customer's use of the latest software version on shared, secure infrastructure). In other words, since multi-tenant software shares some of the underlying infrastructure, the software vendor can leverage commonality across all customers to speed the time to validate.

For companies using document-centric or legacy QMS software, validation tends to be such a huge hurdle that companies often avoid implementing software upgrades. Improvements to product quality, delivery, and/or training are forgone in favor of the status quo. The process to validate these upgrades is so difficult and time consuming that many companies stay with the current version of software.

Cloud-Based QMS in Action

Here is an example of how a cloud-based QMS works for device manufacturers.

IntraOp Medical Corporation is a pioneer in portable electron-beam intraoperative radiation therapy. The IntraOp Mobetron has transformed cancer treatment by bringing radiation technology into the operating room, uniting radiation oncology and surgery. For patients and their families, this means markedly shorter treatment and recovery times, improved outcomes, and greater comfort and quality of life. This helps ensure that teams execute on product realization at the highest levels of quality and adhere to regulations.

As an FDA-regulated company, IntraOp not only designs and produces complex products with electro, mechanical, and software components, it does so while meeting all FDA 21 CFR 820, EU Medical Device Directive (MDD), ISO 13485, Health Canada, and other regulations. The IntraOp team needed more than a system to manage all the product details, changes to product, and collaboration efforts with the teams. They also needed a QMS solution to ensure absolute regulatory compliance and chose Arena Solutions to manage both product and quality management.

Relying on Arena's QMS solution, IntraOp was able to leverage an integrated product and quality management system. An Nguyen, director of regulatory affairs and quality assurance, shared that “information from the Arena Quality module, such as CAPA and non-conformances visualized through the Arena Analytics dashboard, allowed us to monitor the up-to-date performance of our product process, see the areas and suppliers which have unfavorable quality trends, and plan for our improvements or preventive actions.”

In the end, IntraOp gained immediate benefits with immediate visibility and access by their teams and dashboards that provide up-to-date performance. Nguyen further noted that “monitoring and measuring product and process performance are key requirements of medical device regulations.”


Medical device manufacturers must contend with more product, supplier, and team complexity than ever. Getting quality products to market fast is not sufficient. Companies must be able to navigate regulatory compliance and validation to meet FDA, ISO, and other regulatory mandates.

Cloud solutions, and more specifically, product-centric QMS solutions, provide maximum control, visibility, and traceability throughout the entire product life cycle. The ability to automate the review of designs, address quality issues quickly, and validate systems work as designed is simplified with cloud-based QMS solutions.

So, device manufacturers do not need to choose between great QMS capabilities or the ability to meet regulatory compliance and validation requirements. Rather, the cloud can ensure that the company develops safe and effective devices.


  1. Quality System (QS) Regulation/Medical Device Good Manufacturing Practices”.
  2. ISO 13485:2016, “Medical devices — Quality management systems — Requirements for regulatory purposes ”.

  3. General Principles of Software Validation: Final Guidance for Industry and FDA Staff ”.

This article was written by Ann McGuire, Product Marketing Manager at Arena Solutions, Foster City, CA. For more information, visit here .