Home / Quality Management Systems
Medical device QMS consulting · ISO 13485 · EU MDR · FDA QMSRBuild a quality system from scratch, remediate Notified Body findings, or strengthen a system that has grown faster than its procedures. Eclevar works from gap assessment through procedure remediation, CAPA, internal audit and ongoing quality management, against ISO 13485, EU MDR Article 10(9) and FDA QMSR.
Eclevar is a specialist medical device CRO. The quality function sits alongside the clinical operations, medical writing, data and regulatory teams that produce clinical evaluations, post-market surveillance inputs and clinical investigation records. That is the material an assessor asks to see, and it is why a quality system built in isolation can break down at the evidence interfaces even when the procedures look complete.
Eclevar's operating scope varied between these programs, from full clinical operations delivery to defined workstreams. The figures describe programs supported, not audit, certification or regulatory outcomes.
Medical device manufacturers that work with Eclevar across clinical, regulatory and quality programs.
Most QMS conversations start from one of four situations. They require different scopes, priorities and levels of urgency.
For a startup, a spinout, a first device, or a development organization that now has to operate as a regulated manufacturer and is preparing for first certification.
A practical ISO 13485 system built around how the company actually operates, rather than a procedure library it cannot follow.
Build my QMSFor nonconformities from a Notified Body or certification body, CAPAs that are open or overdue, and a follow-up audit with a response deadline already running.
Root-cause investigation, systemic impact assessment and remediation of the underlying quality-system weakness, with the objective evidence assembled to support the response and the closure assessment.
Review our findingsFor surveillance, recertification, an initial certification audit, a deferred internal audit, a management review that has not happened, or FDA inspection readiness.
The weaknesses identified before the assessor finds them, and the critical gaps closed in order of risk rather than in order of convenience.
Assess audit readinessFor organizations without enough internal QA capacity: quality manager support, internal audits, CAPA management, complaints, supplier quality, document control, management review, vigilance interfaces and inspection preparation.
Senior quality capability without building a full internal department.
Discuss outsourced QANone of these is unusual, and none means the company did something reckless. They are what happens when a quality system is built once, then asked to carry a growing portfolio, a new regulation and a second market.
Build an ISO 13485 QMS around your organization.
For a first certification, a new manufacturing or specification-developer role, or a system that has to be created rather than repaired.
Scope typically covers process architecture and the quality manual, a controlled procedure framework, document and record control, design and development controls, ISO 14971 risk management interfaces, supplier qualification, CAPA, nonconformity and complaint handling, post-market surveillance and vigilance interfaces, training, internal audit, management review, and a certification readiness assessment.
The number of procedures is not the deliverable. It depends on scope and product type, and a procedure count is not what carries a system through an audit.
Close systemic gaps, not just audit findings.
For findings from a Notified Body, a certification body, an internal audit or an inspection, and for CAPA systems that are not producing durable corrections.
Scope typically covers review of the findings and the evidence behind them, containment where needed, root-cause investigation, systemic impact assessment, CAPA strategy, procedure remediation, retrospective record review where the finding requires it, training, implementation evidence, effectiveness verification, and a readiness review before the response is submitted.
How a finding is worked, end to end
Rewriting the procedure that produced the finding is the fastest way to receive the same finding again. The work is to establish why the quality system allowed it.
Senior quality capability without building a full internal department.
For companies that need the function performed rather than advised on.
Scope can include quality manager support, the internal audit program, management reviews, CAPA oversight, supplier quality, the training matrix, change control, document control, complaints, post-market surveillance and vigilance coordination, quality indicators and audit preparation.
Engagements run project based, fractional, or as an ongoing retainer.
What exists at the end of the engagement, in your hands and in your document control system.
Since February 2, 2026, FDA's quality system requirements in 21 CFR Part 820 have been the Quality Management System Regulation, which incorporates ISO 13485:2016 by reference while retaining FDA-specific requirements. That creates substantially greater structural alignment and can reduce duplicative quality-system work for manufacturers operating in both markets.
It does not make the two the same. An ISO 13485 certificate is issued against ISO 13485, not against FDA requirements, and it should not be presented as evidence of complete FDA compliance. One change matters commercially more than the terminology: under the QMSR inspection framework, FDA investigators may review management review, quality audit and supplier audit reports that had previously been exempt from routine FDA review under the former QS Regulation. Readiness now means being comfortable not only with your procedures, but with the internal quality evidence behind them.
Eclevar can assess a quality system against ISO 13485, against the EU MDR obligations that apply to your role, and against the applicable FDA QMSR requirements.
Quality policy, responsibilities and authorities, management review, and the interface with the Person Responsible for Regulatory Compliance.
Design and development controls, change control, ISO 14971 risk management, and the interfaces with technical documentation.
Supplier evaluation and control, production and service provision controls where they apply, nonconformity handling and CAPA.
Complaint handling, post-market surveillance, vigilance and field safety corrective action, and trend reporting interfaces.
Document and record control, training and competency, the internal audit program, and the electronic systems the records live in.
Clinical evaluation and post-market clinical follow-up inputs, and the records that move between evidence programs and the quality system.
EU MDR Article 10(9) requires manufacturers to establish, document, implement, maintain, keep up to date and continually improve a quality management system. It also requires that system to address, among other areas, regulatory compliance strategy, risk management, clinical evaluation including post-market clinical follow-up, supplier controls, product realization, UDI, post-market surveillance, vigilance, CAPA and effectiveness monitoring. Related obligations are further detailed elsewhere in the MDR, including Article 15 for the Person Responsible for Regulatory Compliance, Articles 27 and 29 for UDI and registration, and Articles 83 to 87 for post-market surveillance and vigilance, as applicable to the manufacturer and the device.
Our review is written against how those requirements operate across your actual processes, not as a clause-by-clause commentary on the standard.
Certification, a finding, surveillance, FDA readiness, growth or a capacity gap. The trigger determines what is looked at first.
Procedures, records, objective evidence, and how the system is used in practice rather than how it is documented.
Immediate audit exposure separated from structural improvement, with the reasoning written next to each one.
Processes, records, responsibilities and training, updated together. A procedure changed without training and records is a finding waiting to happen.
A readiness review against the applicable requirements, effectiveness verification and an evidence review before the audit or the response.
Ongoing quality support where the function needs to be carried rather than rebuilt.
Duration is set per engagement. It depends on the state of the system, the certificate scope you are seeking, how much implementation evidence has to accumulate, and the certification body's schedule, which is outside Eclevar's control.
A QMS is not finished when the procedures are written. It has to be implemented, evidenced and usable by the people responsible for operating it.
Head of Quality and Compliance
Quality engagements are run out of this function, alongside the clinical, data and regulatory teams whose records the quality system has to control.
Former positions are stated for biographical context only. Eclevar MedTech is independent and is not affiliated with or endorsed by any notified body or certification body. Meet the full leadership team.
Written with the Notified Body BSI, a practical reading of what the EU MDR expects of post-market clinical follow-up and real-world evidence, and of where quality processes have to carry it. Useful if your quality system and your clinical evidence are currently managed by different people.
The whitepaper is co-authored work. It is not an endorsement of Eclevar's consulting services.
Eclevar designed and is managing RegenLab's post-market clinical follow-up program on chronic wound devices, a randomized program across five European Union countries. The records it generates, protocol-controlled data capture, deviations, monitoring records, vendor oversight and post-market surveillance inputs, are exactly the records a quality system has to control. Running clinical evidence programs gives Eclevar direct visibility into the records, interfaces and controls a QMS has to govern across the evidence lifecycle.
This is a clinical evidence engagement, not a QMS certification or remediation engagement. No audit, certification or regulatory outcome is claimed.
Yes, it is one of the three standard engagements. The system is built around your product scope, your role under the regulation and the way your organization works, then implemented, evidenced and internally reviewed before you go to a certification body.
Yes. The sequence above is the method: finding, root-cause investigation, systemic impact, CAPA, implementation evidence, effectiveness verification. Closure is decided by the body that raised the finding, not by Eclevar.
Usually yes, and it is normally the better answer. A working system carries organizational memory and is worth repairing. A rebuild is proposed only when the structure cannot support the scope the company now has.
Yes, project based, fractional or as an ongoing retainer, covering as much of the function as you need carried.
Yes. Eclevar can assess a system against ISO 13485, the applicable EU MDR obligations and the applicable FDA QMSR requirements. What that means under QMSR is set out above, including the internal quality reports FDA investigators may now review.
Yes. Readiness work covers a review against the applicable requirements, verification that corrections have been effective, and a review of the evidence an assessor is likely to sample. Eclevar helps organize and prepare that evidence and can support your team during the audit. It cannot influence the outcome.
Yes, and it is one of the most common requests. The problem is rarely the CAPA form. It is that the investigation stopped at the immediate cause, so the correction does not prevent recurrence.
Your quality manual and procedure list, your certificate scope or target scope, the last audit or inspection report with any open findings, the CAPA log, and the internal audit and management review records. If some of that does not exist yet, that is itself part of the assessment.
It depends on the severity of the finding, the number of processes affected, how much implementation evidence has to accumulate before effectiveness can be demonstrated, and any response deadline already set. A planning range is agreed after the gap assessment. Eclevar does not quote one before seeing the findings.
Yes, the engagement is not tied to a platform. Where the system is electronic, the assessment covers validation status, access control, audit trail and record retention alongside the processes.
No, and it cannot. Eclevar is a consulting and support provider. Certification is performed by an independent certification body, and conformity assessment under the EU MDR by a notified body. Keeping those roles separate is a requirement on them as much as a statement about us.
Bring your upcoming audit, your current findings, your certification objective or the part of the system you already know is weak. We will tell you what should be reviewed first, and whether the right engagement is a build, a remediation or ongoing quality support.
