Best design control software for medical devices

Design controls, risk management and the software lifecycle, ranked by whether requirements, risks and tests are linked records or a folder of documents.

By · Updated

What design controls require

ISO 13485 clause 7.3 sets out design and development for medical devices: planning, design inputs, design outputs, design reviews, verification, validation, design transfer, control of design changes, and a design and development file that holds the records for each device.1 The FDA’s Quality Management System Regulation (QMSR) has incorporated ISO 13485:2016 by reference since 2 February 2026, so the same structure applies in the US.2

Two standards sit next to it. ISO 14971:2019 sets out risk management for the whole device life cycle, including software as a medical device.3 It expects a risk management file in which each hazard can be traced to its risk analysis, risk controls and the verification of those controls.3 IEC 62304 (edition 1.1, 2015) defines life cycle requirements for medical device software, scaled by a software safety class.4 In the EU, Annex I Section 17.2 of the MDR requires device software to follow the state of the art for development life cycle, risk management, information security, and verification and validation.5

In practice this is a traceability problem. Every user need should lead to design inputs, outputs and tests, and every hazard to a risk control and to the test that shows the control works. When a requirement changes, you need to see which risks and tests it touches.

What to look for in design control software

  • Linked records, not linked documents. Requirements, risks and tests should be items with trace links, so the system can show a missing test or an orphaned risk control. A folder of Word files with a trace matrix template is document control, not design control.
  • Risk inside the design. Hazards, hazardous situations and harms as records, with risk controls that are themselves requirements and get verified.
  • Change impact. Flags on linked items when something upstream changes, and versioned baselines per release.
  • IEC 62304 features if you build software: safety class per product, software items, SOUP tracking, and traceability from software requirements to tests and risk controls.
  • Engineering tool links. If your developers work in Jira, GitHub, GitLab or Azure DevOps, check which integrations are documented and which cost extra.
  • Generated outputs. The trace matrix, risk management file and design history file should come out of the data, not be assembled by hand before each audit.

Common gaps we found

Documents dressed as design controls. In several systems, design control means organising documents. SimplerQMS groups the design history file and technical file as document collections, with risk files and the trace matrix as controlled documents.6 Cognidox uses Document Holders as phase gates.7 MasterControl’s design pages describe managing design control, DHF and DMR documents.8 Qualityze’s design control module isn’t released yet.9 Ideagen’s design controls appear only on a marketing page.10

Risk not linked to design. Scilife’s risk module supports only FMEA for processes, equipment and systems, and risk items don’t exist in its design module.11 Arena has requirement trace links but no documented link from requirements to risks or tests.12 Ideagen’s and Qualityze’s documented risk modules are general risk registers.109

Thin IEC 62304 support. Qualio’s design controls documentation doesn’t cover software safety classes, software items or SOUP lists.13 Only five of the systems we had reviewed by October 2026 fully cover the IEC 62304 software lifecycle; for the rest, support is generic, a marketing claim, or not found.14

Generated files that are claimed, not shown. Greenlight Guru says you can generate trace matrices, the DHF and the risk file, but we found no documentation showing it.15 Scilife says you export and compile the design history file yourself.11

Integrations as add-ons or workarounds. Qualio includes Jira but sells GitHub, GitLab and Azure DevOps links through its Integration Hub add-on.13 Orcanos connects Jira through Zapier.16 Formwork has no development-tool integration.17

How we ranked design control software

The list below uses three rows of our clause matrix: design and development, risk management file (ISO 14971) and software lifecycle (IEC 62304). A system gets a full point for a row when its documentation, a demo or an independent source shows the workflow, and half a point when the feature is limited, document-based or only named on a marketing page.18 Systems with the same coverage are ordered by their overall score, which also includes our design controls criterion for traceability, engineering tool integrations and generated files.19 Our ranking method explains every criterion.

  1. ISO 13485:2016 Medical devices: Quality management systems: Requirements for regulatory purposes, clause 7.3. ISO, checked 1 Oct 2026. ↩︎

  2. FDA: Quality Management System Regulation (QMSR). FDA, updated 2 Feb 2026, checked 1 Oct 2026. ↩︎

  3. ISO 14971:2019 Medical devices: Application of risk management to medical devices. ISO, checked 1 Oct 2026. ↩︎ ↩︎

  4. IEC 62304:2006+AMD1:2015 CSV. IEC Webstore, checked 1 Oct 2026. ↩︎

  5. Regulation (EU) 2017/745 on medical devices, Annex I Section 17.2. EUR-Lex, checked 1 Oct 2026. ↩︎

  6. SimplerQMS review, features section, checked 4 Oct 2026. ↩︎

  7. Cognidox review, features section, checked 4 Oct 2026. ↩︎

  8. MasterControl review, features section, checked 4 Oct 2026. ↩︎

  9. Qualityze review, features section, checked 4 Oct 2026. ↩︎ ↩︎

  10. Ideagen Quality Management review, features section, checked 4 Oct 2026. ↩︎ ↩︎

  11. Scilife review, features section, checked 4 Oct 2026. ↩︎ ↩︎

  12. Arena QMS review, features section, checked 4 Oct 2026. ↩︎

  13. Qualio review, features section, checked 4 Oct 2026. ↩︎ ↩︎

  14. Clause matrix across our reviews, data as of 4 Oct 2026. ↩︎

  15. Greenlight Guru review, features section, checked 4 Oct 2026. ↩︎

  16. Orcanos review, features section, checked 4 Oct 2026. ↩︎

  17. OpenRegulatory Formwork review, features section, checked 4 Oct 2026. ↩︎

  18. How we rank QMS software: compliance coverage. ↩︎

  19. How we rank QMS software: design controls and traceability. ↩︎

The design control software we reviewed, ranked

Ranked by how fully each system covers Design and development, Risk management file and Software lifecycle in its documentation, then by overall score. How we check features

  1. 1

    OpenRegulatory Formwork 7.8/10

    Design and development: documentedRisk management file: documentedSoftware lifecycle: documented

    Requirements link to failure modes, risk controls and tests, each product records its IEC 62304 safety class, and an audit export produces trace matrices per release, but there’s no Jira or Git integration (the vendor says by design) and no REST API.

    $7k/yr · Review · Pricing

  2. 2

    Matrix Requirements (Matrix One) 7.5/10

    Design and development: documentedRisk management file: documentedSoftware lifecycle: documented

    Traceability rules per category flag broken or outdated links, the risk module exports FMEA tables, and Jira, GitHub, GitLab and Azure DevOps connect natively, but the IEC 62304 template package is only on the Company and Enterprise plans.

    from $22k/yr · Review · Pricing

  3. 3

    Greenlight Guru 7.4/10

    Design and development: documentedRisk management file: documentedSoftware lifecycle: documented

    A design control matrix links user needs, inputs, outputs, verification and validation, with an ISO 14971 risk matrix and Jira and GitHub references, but the generated DHF, trace matrix and risk file are claimed without documentation we could check.

    from $12k/yr · Review · Pricing

  4. 4

    Orcanos 6.7/10

    Design and development: documentedRisk management file: documentedSoftware lifecycle: documented

    The ISO 14971 FMEA runs from hazard to mitigation to verification test, the risk file and design documents generate to Word, and IEC 62304 checks use the software safety class, but Jira connects only through Zapier and GitHub and Azure DevOps links aren’t documented.

    Pricing on request · Review · Pricing

  5. 5

    Ketryx 6.5/10

    Design and development: documentedRisk management file: documentedSoftware lifecycle: documented

    Requirements, software items, tests and risks sync from Jira, Git and test tools into a generated DHF, trace matrix and risk file, with SOUP tracked through a software bill of materials, but Ketryx describes itself as a bridge between engineering tools and an existing eQMS.

    Pricing on request · Review · Pricing

  6. 6

    Qualio 6.8/10

    Design and development: documentedRisk management file: documentedSoftware lifecycle: partly

    Up to three requirement levels link to verification and validation tests and to ISO 14971 risk, with generated trace matrices, but there are no software safety classes or SOUP lists, and GitHub, GitLab and Azure DevOps need the paid Integration Hub add-on.

    est. $12–30k/yr · Review · Pricing

  7. 7

    Arena QMS 6.6/10

    Design and development: documentedRisk management file: partlySoftware lifecycle: partly

    Requirements trace to other requirements and to items, with suspect flags when something upstream changes, and users build the DHF in Projects, but there’s no documented link from requirements to risks or tests and no risk register or IEC 62304 features.

    est. $12–25k/yr · Review · Pricing

  8. 8

    Scilife 6.3/10

    Design and development: documentedRisk management file: partlySoftware lifecycle: partly

    The Design and Development module (since 2025) links user needs through to verification and validation in a matrix that flags unlinked items, but risk is an FMEA for processes and equipment that isn’t linked to design items, and you compile the DHF yourself.

    Pricing on request · Review · Pricing

  9. 9

    Cognidox 7.2/10

    Design and development: partlyRisk management file: partlySoftware lifecycle: partly

    Document Holders act as phase gates that can’t be approved until every document in them is, but traceability is only claimed on a product page, and we found no risk register, ISO 14971 tool or IEC 62304 features.

    from $8k/yr · Review · Pricing

  10. 10

    SimplerQMS 7.1/10

    Design and development: partlyRisk management file: partlySoftware lifecycle: partly

    The design module groups the DHF, DMR and technical file as document collections, and risk files and the trace matrix are controlled documents, with no linked requirements, risks or tests.

    from $17.5k/yr · Review · Pricing

  11. 11

    Qualityze 4.9/10

    Design and development: partlyRisk management file: partlySoftware lifecycle: partly

    There’s no design control module yet (it’s planned for Release 17.0 with FMEA), the risk module is a general risk register, and IEC 62304 support is only a marketing claim.

    Pricing on request · Review · Pricing

  12. 12

    Ideagen Quality Management 6.4/10

    Design and development: partlyRisk management file: partlySoftware lifecycle: not found

    Design controls, design history files and ISO 14971 risk management are promised on a marketing page but don’t appear in the help centre, where the risk module is a general business risk register.

    est. $22–29k/yr · Review · Pricing

  13. 13

    Dot Compliance 5.9/10

    Design and development: partlyRisk management file: partlySoftware lifecycle: not found

    A Design Control module exists but its manual is customer-only, FMEA with hazard traceability is described only on product pages, and we found no documented trace from requirements to risks to tests.

    Pricing on request · Review · Pricing

  14. 14

    ETQ Reliance (Octave Reliance) 5.1/10

    Design and development: partlyRisk management file: partlySoftware lifecycle: not found

    There’s no design controls app, only APQP project control, specifications and an FMEA with a hazard analysis, with no ISO 14971 risk management file or DHF export.

    Pricing on request · Review · Pricing

  15. 15

    MasterControl 5.1/10

    Design and development: partlyRisk management file: partlySoftware lifecycle: not found

    Development Excellence manages design control, DHF and DMR documents rather than linked requirements and tests, and the risk module describes no ISO 14971 risk file.

    est. $25–72k/yr · Review · Pricing

Frequently asked questions

What is design control software?
Software that holds the design of a medical device as linked records: user needs, design inputs, design outputs, verification and validation, plus the risk analysis and design reviews. Good tools show gaps in the links and generate the trace matrix and design history file from them.
Do we need a separate tool for ISO 14971 risk management?
Not if the design control tool has a real risk module. Look for hazards, hazardous situations and harms as records, with risk controls linked to requirements and to the tests that verify them. Several systems we reviewed only offer an FMEA for processes or a general business risk register, which doesn’t give you a risk management file.
What does IEC 62304 support mean in a QMS?
IEC 62304 defines life cycle requirements for medical device software. In a tool, look for a software safety class per product, software requirements and items linked to tests and risk controls, and a list of SOUP (third-party software). Only a few systems we reviewed document these features; see the IEC 62304 pills in the list above.
Should design controls live in Jira?
Many software teams keep work items in Jira or Git and sync them into a QMS. Ketryx and Matrix Requirements document those integrations; Qualio includes Jira and sells other developer-tool links as an add-on, and Formwork has no Jira or Git integration.
What is the difference between a DHF and a design and development file?
They hold the same kind of record. ISO 13485 calls the collected design records the design and development file (clause 7.3.10); many US teams still say design history file (DHF). Since 2 February 2026 the FDA’s QMSR incorporates ISO 13485 by reference.