The device file assembles itself as the work happens
Design control, production and post-market surveillance on one record, with the device file assembling itself as the work happens. Validation-ready for 21 CFR Part 820 as amended by the Quality Management System Regulation, ISO 13485:2016 and EU MDR, and kept current with regulatory change as part of the product, at no extra cost.
Your quality system is the regulation now
Since 2 February 2026 the FDA no longer maintains a separate quality system rulebook. Part 820 incorporates ISO 13485:2016 directly, and the vocabulary the industry used for thirty years went with it. Device master records, device history records and design history files are no longer regulatory terms. What replaced them are the ISO 13485 medical device file and design and development file, plus a short list of FDA-specific record content that ISO does not cover.
Two changes matter more than the renaming. Management review, internal audit and supplier audit records are now inspectable, having been explicitly shielded under the old rule. And Section 820.35 still requires complaint record data elements, servicing records and the UDI recorded for each device or batch, which a system built to ISO 13485 alone will miss.
The controls below run on the same compliance engine every industry uses.
What's tailored for medical devices
Not just compliance mapping — here's where the modules themselves work differently for this industry.
The medical device file and design & development file assemble continuously from specification, manufacturing, packaging and labelling records already in the system.
UDI recorded per device or batch, with GUDID and EUDAMED attribute changes tracked automatically on a 30-day clock.
Complaint intake carries the prescribed data elements and reporting clock from the moment it's logged; nonconformities need an effectiveness review before they can close.
Servicing records are held to the same controls as production records, not tracked in a separate spreadsheet.
20 controls, 6 standards
Select a standard to filter
Working draft, not a certified mapping — our own reading of each framework's published scope, not a legal determination.
Coverage by geography
We watch the regulations so you don't have to
Standards don't stay still. The Compliance Engine tracks every one that applies to you: when a rule changes, it tells you what it affects, updates the system, and re-validates before anything goes live. You don't file a change request. It's already handled.
QMSR merger absorbed on day one
The ISO 13485 medical device file and design & development file replaced the old device-master-record vocabulary in the pack the same month FDA's rule took effect.
EUDAMED legacy device registration closes
Devices placed on the EU market before 28 May 2026 and still sold must be registered in the UDI and device module.
Notified body application gate
For Class B and Class A sterile in vitro diagnostics.
EU MDR legacy certificates expire
For Class III and implantable Class IIb devices.
EU MDR legacy certificates expire
For Class IIa, non-implantable Class IIb and the remaining Class I categories.
Every update runs through the same validation discipline as the platform itself — tested against the workflows it touches before it reaches a single client's floor. Nothing ships because a regulation changed; it ships because the change passed.
Reporting clocks the system runs
The same event carries a different deadline in each market. The pack starts the right timer, names an owner and escalates before it expires.
| Jurisdiction | Trigger | Clock |
|---|---|---|
| United States, 21 CFR Part 803 | Death, serious injury or reportable malfunction | 30 calendar days |
| United States, 21 CFR Part 803 | Event requiring remedial action to prevent unreasonable risk | 5 working days |
| EU MDR Article 87 | Serious public health threat | 2 calendar days |
| EU MDR Article 87 | Death or unanticipated serious deterioration in health | 10 calendar days |
| EU MDR Article 87 | Other serious incidents | 15 calendar days |
India licensing, built in
Class A and B devices are licensed by the state authority on Form MD-5, Class C and D centrally on Form MD-9, and since October 2025 Class A and B applicants need central risk classification before applying to the state. The pack holds the Fifth Schedule quality management system, the plant master file and the device master files in the shape an audit reads them, whether that audit comes from a CDSCO-registered notified body or from CDSCO directly.
Validation readiness
The controls above are enforced in the architecture, not configured on top of it.
- Validation packs (URS, IQ, OQ, PQ, RTM, GAMP 5) are available on the Dedicated tier.
- ISO 27001 certification is in progress.
- Inspection readiness is scored continuously by the Compliance Engine, not assembled the week before an audit.
For the technical detail behind these controls — encryption, access control, audit trail mechanics and backups — see Infrastructure & Security. For what sits in each workspace, see Modules.
Have a compliance requirement to walk through?
Tell us about your regulatory environment and we'll show you exactly how Factro fits.