Regulatory Copilot
Login Join the founding cohort

Learn · free, no account

Quality-system template outlines

These are the 22 starting points a workspace gets in Regulatory Copilot: the sections each standard actually asks for, deliberately an outline rather than finished prose. Use them freely. In the app, each one becomes a controlled document you can draft from your device's records, route for approval and sign.

Starting points, not compliant documents. Customise each for your device and verify it before use; nothing here is a compliance claim until you have reviewed it, filled in the device-specific detail and approved it.

Quality Manual

ISO 13485 §4.2.2

  1. Scope of the quality management system, and any clause you exclude (with the justification).
  2. The processes of the QMS, their sequence and how they interact.
  3. Reference to the documented procedures that support each process.
  4. The structure of the documentation, including the medical device file per §4.2.3.

Document & Record Control Procedure

ISO 13485 §4.2.4

  1. How documents are reviewed and approved before issue, and who approves what.
  2. How changes are reviewed and approved (by the original approver unless you say otherwise).
  3. How the current revision is identified and made available at the point of use.
  4. Retention periods, and how obsolete documents are prevented from unintended use.

CAPA Procedure

ISO 13485 §8.5.2

  1. Sources of nonconformity that can open a CAPA, and how they are triaged.
  2. Investigation and root-cause determination, with the depth scaled to the risk.
  3. Action planning, including whether the action needs design or process change.
  4. Verification that the action did not adversely affect the device, and the effectiveness check that closes the record.

Complaint Handling & MDR Procedure

21 CFR 803

  1. How complaints are received, logged verbatim, and acknowledged.
  2. The reportability assessment: death, serious injury, or malfunction likely to cause one, and who decides.
  3. MDR timelines (30 days; 5 days where remedial action is required) and the filing route.
  4. When a complaint escalates into a CAPA, and how the two records stay linked.

Management Review Procedure

ISO 13485 §5.6

  1. Review frequency, attendees and the documented agenda.
  2. Inputs: audits, feedback and complaints, process and product conformity, CAPA status, regulatory changes.
  3. Outputs: improvement decisions, resource decisions, and changes to the QMS.
  4. How actions are assigned, tracked and closed before the next review.

Design & Development Plan

ISO 13485 §7.3.2

  1. What is being designed, and the development stages with their entry and exit criteria.
  2. Responsibilities and authorities, including who performs independent review.
  3. The verification, validation and design-transfer activities planned at each stage.
  4. How the plan is updated as the design evolves, and where the records live.

Risk Management Plan

ISO 14971

  1. Scope of the risk management activities and the lifecycle phases they cover.
  2. Risk acceptability criteria, including the severity and probability scales used.
  3. Responsibilities, review requirements, and verification of risk-control implementation and effectiveness.
  4. How production and post-production information feeds back into the risk file.

Software Development Plan

IEC 62304

  1. The software safety classification (A / B / C) and the rationale for it.
  2. Lifecycle model, deliverables and the traceability approach from requirement to test.
  3. Configuration management, problem resolution and change control.
  4. SOUP inventory, and how SOUP anomaly lists are reviewed.

Master Test Protocol

Design V&V

  1. Purpose, the requirements under test and the acceptance criteria for each.
  2. Test articles, equipment and calibration state.
  3. Sample size with its statistical rationale, and the method step by step.
  4. Deviation handling, and what the report must contain to close the protocol.

Software Requirements Specification

IEC 62304

  1. Functional and performance requirements, each stated so it can be verified.
  2. Inputs and outputs, interfaces, and alarm or error behaviour.
  3. Requirements arising from the risk file, including risk-control measures implemented in software.
  4. Traceability to system requirements and to the verification that covers each item.

Usability Engineering / HF Plan

IEC 62366-1

  1. Intended users, use environments and the user interface in scope.
  2. Use-related hazards and the critical tasks derived from them.
  3. Formative evaluation activities and how findings feed the design.
  4. The summative (validation) study design, including participant numbers and acceptance criteria.

510(k) Cover Letter

eSTAR

  1. Submitter and correspondent details, and the device trade name.
  2. The submission type, the predicate cited, and the regulation and product code.
  3. A short statement of the purpose of the submission and any prior interactions (Q-Sub numbers).
  4. The list of what is enclosed, matching the eSTAR sections.

Substantial Equivalence Comparison

510(k)

  1. Side-by-side table: intended use, indications, technology, materials, performance.
  2. For each difference, whether it raises a new question of safety or effectiveness.
  3. The performance data that supports each difference.
  4. The substantial-equivalence conclusion, stated as your argument, not as a foregone outcome.

Indications for Use (FDA 3881)

FDA form

  1. Device trade name and the indications-for-use statement, word for word.
  2. Prescription use or over-the-counter use: tick exactly one.
  3. Keep this statement identical everywhere it appears in the submission and in the labeling.

Clinical Evaluation Plan

PMA · 21 CFR 814

  1. The clinical question, the endpoints and the benefit-risk framing.
  2. Study design, population, sites, and the statistical analysis plan.
  3. IDE status and the monitoring and data-management arrangements.
  4. How the clinical evidence maps to the design validation element of the DHF.

Manufacturing & Process Validation Plan

21 CFR 820.70

  1. The processes whose output cannot be fully verified by inspection, and why.
  2. IQ / OQ / PQ approach, with acceptance criteria and sample sizes.
  3. Process monitoring, control limits and revalidation triggers.
  4. Readiness for the pre-approval inspection: records, training and equipment qualification.

Establishment Registration & Listing SOP

21 CFR 807

  1. Who registers, when, and the annual registration window (1 October – 31 December).
  2. Device listing entries and how they are kept current as products change.
  3. The establishment-registration fee and how payment is evidenced.
  4. Who holds the owner/operator account, and how official correspondent details are maintained.

Labeling & UDI Procedure

21 CFR 801 / 830

  1. Required label content and the labeling review and approval route.
  2. UDI construction: device identifier, production identifiers, and the issuing agency.
  3. GUDID submission and how records are kept current.
  4. Label change control, including when a change needs a new UDI-DI.

Post-Market Surveillance Plan

ISO 13485 §8.2.1 · 21 CFR 820.198, 803

  1. Scope: the devices, markets and data sources the plan covers.
  2. Sources of post-market data: complaints, MDRs, service records, MAUDE and recalls for comparable devices, literature.
  3. How often each source is reviewed, by whom, and the trend criteria that trigger action.
  4. Links to risk management (ISO 14971 production and post-production information) and to CAPA.
  5. Reporting: MDR timelines (21 CFR 803) and the periodic summary this plan feeds.

Post-Market Surveillance Report

ISO 13485 §8.2.1

  1. The period covered and the data sources reviewed.
  2. Complaints and adverse events: counts, trends and the threshold each was judged against.
  3. Comparable devices: MAUDE and recall signals for the product code.
  4. Conclusions for risk management and any CAPA opened.

Biocompatibility Evaluation Plan

ISO 10993-1 · FDA guidance on ISO 10993-1

  1. Each patient-contacting component: material, contact type and duration category.
  2. The biological endpoints ISO 10993-1 calls for, given those categories.
  3. For each endpoint: existing data, a rationale, or the test planned (with the standard and lab).
  4. Chemical characterisation (ISO 10993-18) and toxicological risk assessment where used.

Software Validation Plan

IEC 62304 · FDA guidance on software in a premarket submission

  1. The software, its safety class (IEC 62304) and its documentation level.
  2. Verification activities: unit, integration and system testing, with acceptance criteria.
  3. Validation against user needs, and how anomalies are evaluated and resolved.
  4. Configuration management, SOUP, and cybersecurity testing where applicable.