Document control software for medical devices

HAVGATE document control is the library for the procedures, forms and records your QMS depends on. People find the current revision, approvers sign, obsolete copies are obvious, and a CAPA that changes a procedure does not die in a shared folder.

Why document control fails in small device companies

ISO 13485 clause 4.2.4 is unforgiving in a way that has nothing to do with style. Documents required by the QMS must be approved before issue, reviewed and updated, identified with the current revision, available where they are used, and legible. Obsolete documents must be prevented from unintended use. Clause 4.2.5 requires records to remain legible, readily identifiable and retrievable, and to be retained for a defined period. Small teams usually meet this with a network drive, a naming convention and a promise. The promise breaks the week someone prints the previous SOP, or the week a CAPA updates the form and training still points at the old file.

HAVGATE stores the controlled document with its number, revision, status and history. Approval is a workflow, not a signature scanned onto the last page after the file has already been copied three times. Electronic signatures are described on the product pages as 21 CFR Part 11 compliant: the signer is identified, the meaning of the signature is clear, and the time is kept. Use that only for the records where you have decided electronic signatures replace handwritten ones, and validate that use. Part 11 is not a logo. It is a set of controls on systems you rely on for regulated records.

Revisions, change control and training

A revision that nobody was trained on is a finding waiting for the next audit. Document control in HAVGATE is meant to sit next to training management. When a procedure changes, the training matrix should assign the new revision to the roles that use it. The CAPA that caused the change should point at the new revision so effectiveness is not 'we updated the SOP' with no evidence anyone opened it. Item and bill-of-materials records in the product follow the same change-control idea: a draft, a revision and a history, rather than a spreadsheet with an ambiguous filename.

External documents belong in the same discipline. Standards, regulatory guidance you have chosen to follow, and customer specifications need an owner and a way to know when they change. MDSAP task 1.8 asks specifically whether documents are approved, changes are identified, and obsolete copies are controlled. An auditor will ask to see the procedure that was in force on the day a batch was released, not the procedure that is in force today. History is the feature that answers that question.

Clause and regulation mapping

EU MDR Annex II describes the technical documentation. Document control does not write the technical file for you. It keeps the procedures and the controlled quality records that the technical documentation depends on: the SOP for design change, the list of applicable standards, the complaint procedure, the vigilance procedure. If those procedures are uncontrolled, the technical file is standing on sand. QMSR does not invent a new document-control theory. It points US manufacturers at ISO 13485, so the same 4.2.4 and 4.2.5 evidence is what an FDA investigator will recognize.

Design history files, device master records and device history records are still the manufacturer's records. HAVGATE's published document module is controlled documents, revisions, approvals and related item records. It is not marketed as a full design-control authoring system. If you need a requirements-to-verification trace matrix as a product feature, treat that as a gap. What is included is the quality-system documentation auditors ask to see first: the procedures, the changes, and the proof of approval.

How teams run the library

Give every controlled document a number and an owner. Decide which document types require training on change and which only require notification. Keep drafts out of the effective set. When a CAPA or a change request edits a document, the effective date should be after approval, not after the author finished typing. Periodic review can be a simple rule: procedures that touch sterile processing or complaint handling reviewed more often than a facilities SOP. The software should make the overdue review visible. It should not auto-approve a document because a timer elapsed.

External auditors and notified bodies will ask for a list of procedures and a sample of records. A library with status, revision and an export of the approval history answers that request in the meeting, which is the operational definition of audit-ready. Pair it with the sample audit report if you want to see how findings against document control are written, and with the data-security page if the question is about encryption and access. Role-based access is how you stop a trainee from editing an effective SOP.

Retention is your decision, written in a procedure. Device records often follow the lifetime of the device plus an additional period defined by the regulation you sell under. The software retains the history. You define how long that is required and what happens at the end. Export still matters. You own the content, which is also stated in the security and privacy material: export is available, and cancellation does not instantly destroy the library.