A quality system set up for a company's first GMP and clinical work
Sized for the stage you're at, and ready for the next one.
Most life-science startups hit their first quality system requirement earlier than they planned. It might be a partner audit, an investor doing due diligence, the first batch of investigational product or the first clinical trial. The usual reaction is to start with shared folders and spreadsheets and sort it out later. This piece covers when the obligation really begins, what to put in place first, and what to check in an electronic QMS before you choose one.
When it stops being optional
It depends on what you do, not on how big you are. In the EU, if you manufacture investigational medicinal products, Delegated Regulation (EU) 2017/1569 requires you to establish, implement and maintain a pharmaceutical quality system. If you sponsor trials, ICH E6(R3), adopted in January 2025, expects you to have an appropriate system for managing quality through every stage of the trial. In the US, Phase 1 investigational drugs are exempt from Part 211. They aren't exempt from the statutory requirement for current good manufacturing practice, though, and the exemption ends once the product moves into Phase 2 or 3. ICH Q10 ties this together with the idea of proportionality: your quality system should fit the stage your product is at.
What to set up first
You don't need every register on day one, but some are painful to add later. Start with controlled documents and training, since every other process points back to an approved SOP and to the people trained on it. Deviations and CAPA come next, as soon as there's work that can go wrong, which usually means your first GMP or clinical activity. Change control matters once you release anything. Supplier qualification is the one founders tend to need sooner than they expect, because most startups outsource manufacturing, testing or trial operations. Your CDMO or CRO is part of your quality system, and you're still responsible for it.
The trouble with spreadsheets
Spreadsheets and a shared drive work fine until someone asks who changed a record, when, and why. Electronic records kept to meet FDA requirements fall under 21 CFR Part 11, which expects secure, computer-generated, time-stamped audit trails. The draft revision of EU GMP Annex 11 calls shared accounts, other than read-only ones, a violation of data integrity. A shared folder behind a team login meets neither standard. Moving a year of records into a proper system later costs more than starting in one, and it tends to happen at the worst possible moment, right before a partner audit or an inspection.
What to look for in the software
Start with the controls an inspector will check. An electronic signature should be bound to the record it was applied to, and if that record changes afterwards, it shouldn't still look signed. Every change should leave an audit trail that nobody can switch off. Access should be based on roles, with no shared accounts. After that, look at how the system gets set up. Can you start with a few modules and add more later? Does it give you sensible defaults for numbering, review intervals and retention that you confirm, or do you start from nothing? Can you model your own sites, processes and products?
Vet the vendor too
Whoever supplies your eQMS becomes a supplier you have to qualify. The draft Annex 11 is explicit that the regulated user stays fully responsible for a system no matter who provides it, and it expects an audit or a thorough assessment depending on the risk. Ask the vendor what documentation they can give you to support that assessment and your own validation. Ask where the data is hosted and how customers are kept separate from one another. And ask what happens to your data if you leave. The draft wants that last one written into supplier contracts as an exit strategy that keeps your data under your control.
Buy for the next three years
Enterprise systems are built for companies with a validation team and an IT department, and a startup that buys one often spends its first year configuring it instead of using it. The opposite mistake is a tool you outgrow, which forces you to migrate the whole quality system just as it gets busy. Look for a system that covers every register you'll eventually need, lets you switch each one on when the work calls for it, and is priced for where you are now.
How we approach it at Comeply
We built the Comeply Quality System with this path in mind. All twelve registers are live, from controlled documents and training to CAPAs, change requests, audits, risk files, suppliers and equipment, and you switch them on one at a time. Setup starts from defaults you confirm, so you're not staring at a blank page. Approvals, releases and closures are signed electronically and bound to the record they were signed on. The regulatory intelligence Comeply monitors is built in, so when a regulation changes you can trace it to the documents, change requests, training and CAPAs it affects. If you'd like a hand with SOPs or setup, our team and trusted quality professionals can help.
Starting out
A quality system that grows with you.
See how the Comeply Quality System is set up for a company putting its first QMS in place.
See the startup path