All terms
Quality & RiskQuality System
Document Control
Procedures ensuring approved, current documents are used and obsolete copies removed.
Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026
Definition
Document control under 21 CFR 820.40 and ISO 13485 clause 4.2.4 requires review and approval of documents before issue, identification of revisions, availability at points of use, and prevention of unintended use of obsolete documents. Controlled documents typically include procedures, work instructions, specifications, drawings, forms, labeling and software. Changes must be reviewed and approved by the original function or a designated one with access to background information, and at least one copy of obsolete documents must be kept for the device's lifetime or as required. Electronic document systems should meet data integrity expectations, including 21 CFR Part 11 where electronic records are used. What the regulation says
Document control, as mandated by regulations like 21 CFR 820.40 and standards such as ISO 13485:2016 clause 4.2.4, is a foundational element of a quality management system (QMS). It ensures that all documents critical to product quality and safety are systematically managed throughout their lifecycle, from creation and approval to distribution and obsolescence. Regulators expect manufacturers to demonstrate control over document access, revision, and use to prevent errors and ensure consistent operations, which is often audited during inspections by bodies like the FDA, as well as during notified body audits for EU MDR compliance.What this means in practice
Most QMS-driven inspection findings touch document control. Electronic QMS (eQMS) systems with versioning, e-signatures, and access control are standard for scaling manufacturers.Examples
- A manufacturer implements a robust document control system that ensures all engineering drawings are reviewed and approved by at least three qualified personnel before release for production, directly addressing 21 CFR 820.40.
- An audit finding identifies that manufacturing instructions at a workstation are an outdated revision, leading the company to revise its document distribution process to ensure current versions are always available at the point of use, aligning with ISO 13485:2016 clause 4.2.4.
- A MedTech company uses an eQMS to manage its quality records, with automated workflows for document review and approval, electronic signatures compliant with 21 CFR Part 11, and restricted access controls.
Common pitfalls
- •Failing to establish a clear, documented process for document review and approval can lead to non-conformance.
- •Not maintaining traceability of document revisions can make it difficult to demonstrate compliance or investigate issues.
- •Allowing unauthorized access to or modification of controlled documents creates significant regulatory risk.
- •Inadequate training on document control procedures can result in incorrect document usage and QMS breaches.
- •Retaining obsolete documents at points of use without clear segregation can lead to the use of incorrect procedures or specifications.
Frequently asked questions
The primary goal is to ensure that all personnel have access to the correct, approved versions of documents necessary to perform their work, thereby maintaining product quality, safety, and regulatory compliance.
Cross-references
Part of
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsQuality & Risk
Quality Management System Regulation(QMSR)
FDA's harmonized successor to the QSR, incorporating ISO 13485:2016 by reference.
Quality & Risk
Quality System Regulation(QSR / 21 CFR 820)
FDA's current good manufacturing practice (cGMP) requirements for medical devices.
Standards
ISO 13485
International standard for medical device quality management systems.
More in Quality & Risk
· Same categoryQuality & Risk
Biocompatibility
Ability of a material to perform with an appropriate host response in a specific application.
Quality & Risk
CAPA Effectiveness Check
Verification step confirming a corrective or preventive action actually fixed the problem.
Quality & Risk
Change Control
Formal QMS process for evaluating, approving, and implementing changes that could affect product quality or compliance.
Quality & Risk
Complaint Handling
Process for receiving, evaluating, and responding to device complaints.
Cited by
Where this term appears across MedTech Terms.
Ecosystems (1)
Sources
3 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 1Tier 4Trade press and expert commentary· 1
Link health: 3 verified· last checked 2026-06-20
eCFR·1MDIC·1FDA·1
- 121 CFR 820.40Tier 1 VerifiedeCFRecfr.gov
- 2MDIC Case for QualityTier 4 VerifiedMDICmdic.org
- 3FDA - Quality SystemsTier 2 VerifiedFDAfda.gov
Inline markers like [1] jump to the matching reference above.