A compliant QMS belongs to the whole team, not the RA inbox

One CAPA review taught me that the fastest team was not necessarily the team with the fewest approvers. It was the team where the person closest to the problem could put it into the quality system without asking someone else to retype it.

A process engineer had spotted recurring variation in a forming step. They discussed it with supplier quality, attached photographs, and suggested a possible cause. By the time the monthly CAPA review happened, the useful context was scattered across a spreadsheet, a chat thread and somebody’s inbox.

Nobody had ignored the issue. The workflow had failed.

We had made quality assurance the gatekeeper without making it the owner of every fact. That is not sustainable, particularly when compliance is already a team issue rather than one person’s burden.

Broad access does not mean broad authority

When I say “broad access”, I mean that the whole team can see how to contribute, report evidence and follow the status of an issue. I do not mean that everyone should be able to edit the same controlled record or approve its closure.

The distinction matters.

Article 10(9)(h) and (i) of the MDR place performance monitoring and corrective and preventive action within the manufacturer’s quality management system. ISO 13485:2016 similarly expects defined responsibilities and authorities, including for corrective action.

The regulation does not prescribe a particular software permission model. In practice, this means separating three things:

• Everyone affected by a quality issue can raise it or contribute relevant evidence.
• The nominated process owner can investigate, draft actions and maintain the record.
• Only appropriately authorised reviewers can approve investigation, risk decisions or closure.

Broad participation with controlled decision rights is not a weakening of control. It is how control becomes usable.

Put the facts next to the people who can act

The previous workflow made quality assurance the routing layer. An engineer sent an email, QA copied it into a tracker, supplier quality supplied evidence, and the CAPA owner tried to reconstruct the sequence.

Every handoff created another place for context to disappear.

A better workflow connects the record to the work:

1. An engineer identifies a change affecting a purchased component.
2. The change is linked to its impact assessment, including affected processes, risk controls and controlled documentation.
3. QA assesses whether the issue also requires a non-conformance or CAPA.
4. The CAPA owner develops the root-cause analysis with input from engineering, manufacturing and supplier quality.
5. Evidence and approvals remain attached to the same record.
6. The CAPA links back to the risk management file and any required Technical File updates.

That is what connected workflow integration should mean. The records are not merely stored in the same system; their relationships remain visible.

The practical benefit is speed without losing traceability. In practice, this means fewer messages asking, “Which version is current?”, “Where is the evidence?”, or “Has anyone closed this already?”

A CAPA should not depend on institutional memory

During one notified body audit, we were asked to demonstrate that a corrective action had been effective. We had the investigation, action, owner and approval. What we did not have was a clean link from the approval to the supporting evidence.

The activity had happened. The traceability had not.

That gap is difficult to explain because nothing looked dramatically wrong. The spreadsheet said “closed”, the training record existed and the email confirmed completion. But reconstructing the chain took long enough to expose an obvious weakness.

This is where ISO 13485 expectations around documented information become more than a documentation exercise. A reviewer needs to see not only that a record exists, but how it demonstrates control.

The same principle applies to post-market activities. A complaint, PMS trend, supplier issue and CAPA may originate in different systems, but their relationship should not depend on a quality engineer remembering an informal discussion from three months earlier.

AI assistance needs the same discipline

AI-assisted CAPA assistance can make this broader model more practical. It can classify incoming reports, suggest potentially related records, summarise an investigation chronology and flag missing closure evidence.

It can also make a controlled process look less controlled.

AI should not decide the root cause, approve a risk acceptability decision or close a CAPA. The output must remain reviewable, with a clear human decision and traceable source material. Otherwise, faster drafting simply produces faster ambiguity.

The useful principle is controlled assistance: the tool helps people identify, connect and explain information, while accountable roles retain authority over the decision.

That also affects intake design. If reporting an issue requires ten fields before anyone can submit it, teams will work around the system. Faster input produces better data only when the data remains structured enough to analyse later.

Team messaging belongs near the record

I am not convinced that important quality discussions should live only in social chat apps. Chat is useful for quick collaboration, but it is a poor system of record when evidence needs to be retrieved, connected to a CAPA and reviewed months later.

Purpose-built team messaging can sit alongside the controlled workflow. Relevant discussion stays close to the issue, without requiring every conversation to become a formal record. When a decision affects the CAPA, change assessment or risk management file, that decision can be captured with clear authorship and approval.

The distinction is important: not every message needs to be retained, but the message containing the decision should not be trapped in a separate application.

What I would put in place now

For a medical device SME, I would make broad participation concrete through a small set of workflow rules:

• Give affected teams a visible route to report issues without requiring them to draft a CAPA themselves.
• Allow subject-matter experts to attach evidence and comment while preserving ownership of the formal record.
• Link changes, CAPAs, risk management files, PMS information and supplier records where their relationship is established.
• Define approval rights explicitly, including where independent review is required by the organisation’s procedures.
• Keep regulatory assessment with competent roles, but do not make them responsible for reconstructing every fact.
• Require human review, traceability and source evidence for AI-generated assistance.

That emphasis on including the whole team makes sense. The aim is not to remove gates. It is to put information close enough to the people who can act that the gates arrive at a useful point rather than at the end of a long email chain.

A mature QMS is not the one with the fewest users or the fewest permissions. It is the one where the right person can contribute at the right moment, and every significant decision remains reviewable and traceable.

Where does your organisation draw the line between broad contribution and controlled approval, and what has that boundary helped or hindered?