QMS Integration: Embedding DHT Controls across Sponsor and Vendor Quality Systems
Why the seam between GCP, ISO 13485 and software-lifecycle quality systems is where DHT control is won or lost.
REGULATORY OPERATIONSThree quality systems govern one DHT trial; each is complete within its own scope, and none of them governs the handoffs between them.
A control that exists in two systems but is owned by neither at the boundary is covered by neither — and an inspector follows one control end to end. Map the systems, name every seam, assign one owner on each side in a written quality or technical agreement, and evidence each transfer in the Trigger Register.
Five seams carry the control, and each needs a named owner on both sides
| Seam | Failure mode if unowned | Evidence of successful handoff |
|---|---|---|
| 1 · Manufacturer → sponsor (change) | An update disturbs the validated state with no one assessing it | Dated change notice in the Trigger Register, with impact assessment |
| 2 · Vendor → sponsor (issue) | A defect never reaches the sponsor's issue management | Vendor defect record traceable to the sponsor's issue record |
| 3 · Sponsor → vendor (risk) | The vendor validates to its own scope, not the trial's risks | Validation plan references the trial risk assessment |
| 4 · Vendor ↔ manufacturer (interface) | Neither party owns a fault that lives between them | One accountable party named in the quality or technical agreement |
| 5 · All → Trigger Register | Changes accumulate with no single controlled record | A Trigger Register entry per change, linked to its disposition |
Obligations stack at the seam, and the sponsor owns the structure that carries them
Sponsor GCP under ICH E6(R3), the manufacturer's system under MDR Art. 10(9) and the FDA QMSR, and vendor software validation each govern a part; DHT control depends on actions that cross them.
No certificate exists for a sponsor's GCP quality system, and an ISO 13485 certificate is not evidence of US quality-regulation compliance. The quality agreement is what connects the systems.
Qualifying a vendor (QPP-12) is necessary but different from designing how systems interlock. ICH E6(R3) s.3.6.6 keeps ultimate responsibility for data reliability with the sponsor.
Change control, issue management, validation and risk management recur in all three systems; each party keeps its own, but an event in one must trigger the right response in the others.
Five steps, from mapping the systems to an end-to-end trace an inspector can follow
- 1Map the quality systems in play — sponsor GCP, manufacturer QMS, vendor validation controls — and what each governs.
- 2Find the seams — every point where control passes between systems: validation evidence, change notification, deviation handling.
- 3Assign seam ownership explicitly, in a written quality or technical agreement, with how conformance is evidenced across it.
- 4Reconcile the four processes — change control, issue and CAPA handling, validation, risk management — so they connect, not collide.
- 5Evidence end to end so an inspector can follow a control from sponsor accountability through to vendor execution without a gap.
ICH E6(R3) s.3.6.6, s.3.10, s.4.3.4 and Annex 2 · MDR Art. 10(9) · 21 CFR Part 820 (QMSR) · ISO 13485:2016 · IEC 62304:2006 + A1:2015 · ISO 14971:2019 · ISO 14155:2020 · EMA/INS/GCP/112288/2023 Annex 2 · MDSAP
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call