ISO 9001 Doesn't Require QMS Software — but Here's Why eQMS Still Matters

2026-10-04

Executive Summary

• ISO 9001:2015 does not require software. Clause 7.5 sets requirements for how documented information is controlled, not the medium it lives in (paper or electronic).
• Two common misreadings point in opposite directions: “ISO requires software” and “ISO doesn’t require it, so eQMS is unnecessary.” Both ignore what the standard actually says.
• The standard itself says the extent of documented information depends on organization size, process complexity and people’s competence. That is why eQMS becomes more practical as a company grows — not because ISO demands it.
• Moving to electronic files doesn’t automatically meet the requirements: an uncontrolled folder of PDFs can still fall short.
• The decision should rest on the operating cost and risk of your current system, not on whether “ISO makes us.”

A deceptively simple question

It comes up at nearly every ISO preparation meeting: “Does ISO 9001 require us to use software?”

The short answer is no. But if the conversation stops there, people tend to draw one of two conclusions, and both can lead to poor decisions.

First conclusion: “Not required, so stay on paper and save money.” That holds for some companies, but it overlooks that the cost of running a paper system rises with scale.

The second goes the other way: “I hear ISO is going digital, so we probably need software.” There is no basis for that in the standard.

This article walks through what the standard actually requires, then explains why an eQMS can still be the practical choice even though ISO doesn’t demand it.

What ISO 9001:2015 actually requires

The statements here are based on ISO 9001:2015, clause 7.5 (Documented information). In practical terms:

The quality management system must include two kinds of documented information: what the standard itself requires, and what the organization determines is necessary for the system to be effective (7.5.1).

When creating and updating, the information must be identified and described (for example title, date, author, reference number), have an appropriate format and medium (the standard names both paper and electronic), and be reviewed and approved for suitability and adequacy (7.5.2).

When controlling it, the information must be available and suitable for use where and when needed; adequately protected (from loss of confidentiality, improper use or loss of integrity); and the organization must address distribution, access, retrieval and use, storage and preservation (including legibility), control of changes (for example version control), and retention and disposition (7.5.3). Documents of external origin needed for the system must also be identified and controlled, and information kept as evidence must be protected from unintended alteration.

Notice that this list describes control outcomes, not tools. Not a single line demands software.

One change from the earlier edition is worth knowing: ISO 9001:2008 required a quality manual and specific mandatory documented procedures. The 2015 edition merges “documents” and “records” into the general idea of “documented information” and no longer requires a quality manual. The organization decides what it needs, based on what its system needs.

What “documented information” actually means

The term is often read as “documents,” but it covers more.

In ISO 9001:2015, documented information includes what the organization must maintain (typically procedures, instructions, policies — formerly “documents”) and what it must retain (typically evidence that something was done, such as inspection results, audit reports, training records — formerly “records”). How the standard uses “maintain” and “retain” is explained in its Annex A.

The distinction matters in practice. Information you maintain has to be updated when processes change, and the main problem is the current version. Information you retain is evidence of something that happened, and the main problem is integrity and traceability: was it altered, who created it, when.

The two create different kinds of operational risk. And they explain why “paper or software?” has no single answer for every part of the system.

Why paper and PDF can meet the minimum

Because the standard doesn’t prescribe a medium, a well-controlled paper system can comply: documents with reference numbers, effective dates and approval signatures; a register showing which version is current; a process for withdrawing obsolete copies; records stored under conditions suited to their retention period.

Likewise, a system of electronic files (Word, PDF on a shared drive) can comply, provided the controls above are actually carried out: who may edit, who may only read, which version is current, how changes are approved, whether backups exist.

And here is a common trap: converting paper to files does not equal meeting the requirement. A PDF folder that anyone can edit, with no version register and no approval process, is harder to defend as “controlled” than a paper record with a tracking log. An electronic medium doesn’t solve the control requirement; it creates control requirements of its own, such as access rights, backup and integrity protection.

In other words: the standard asks whether you have control, not which tool you use.

When eQMS becomes the more practical choice

If paper and files can both comply, why do many companies still move to an eQMS?

The answer sits inside the standard: the extent of documented information depends on the size and type of the organization’s activities, the complexity of its processes and their interactions, and the competence of its people. In other words, the standard acknowledges that volume and complexity are the deciding variables. When they rise, the cost of maintaining control manually rises with them.

Below are signals that often show paper or a shared drive becoming less practical. They are not hard thresholds, and no number is “big enough”:

• Several sites or shifts working from the same documents, making it laborious to ensure everyone uses the latest version everywhere.
• Frequently changing documents, so issuing, withdrawing and confirming receipt becomes repetitive work.
• More users than the records owner can follow closely, with a key quality person as a single point of dependency.
• Customers, regulators or other standards requiring detailed traceability or specific rules on electronic records. For GMP, HACCP or customer-specific requirements, check case by case, since these sit outside ISO 9001.
• Audit preparation and trace time growing faster than the number of real problems.
• Related records that can’t be connected (nonconformance, corrective action, training, process change), forcing the chain of actions to be assembled by hand.

An important point: every one of these signals is an operational reason, not a compliance reason. You move to an eQMS because the paper system is costing more effort and carrying more risk, not because ISO demands it.

Scale and complexity as the deciding factors

From there, a more useful question than “does ISO require it?” is:

1. Does our current system control what the standard requires? If yes, and the cost is reasonable, there’s no pressure to change.

2. Is the cost of keeping that control growing faster than the company? Cost includes audit preparation effort, trace time, incidents from outdated versions, and dependence on a few people.

3. Do any requirements beyond ISO 9001 call for traceability or electronic records? Customers, sector rules, other standards.

4. If we move, where do we begin? Most small and mid-sized companies start with document control, not the whole system. See also eQMS for Small Manufacturers: Why It Doesn’t Have to Be Complex.

One more point: many cases of “failed the audit because we had no software” are really audits that found control problems (wrong version, missing records, evidence that couldn’t be traced), and software is simply how some companies choose to fix that. Diagnosing the problem correctly matters more than picking the tool.

Conclusion

ISO 9001:2015 does not require QMS software. It requires controlled documented information, whatever its form.

But the standard also acknowledges that the volume and complexity of a system determine how much control is needed. As a company grows, maintaining that control by hand gets more expensive, and an eQMS becomes a practical option — not because ISO makes you, but because it can help you keep what ISO asks for with less effort and less risk.

The real issue isn’t “does ISO require it.” It’s whether your current approach is still worth what it costs to maintain.

A note on ISO 9001 editions

This article refers to ISO 9001:2015. According to certification bodies, a revised ISO 9001:2026 was scheduled for publication in September 2026, with a transition period expected to run about three years and 2015 certificates remaining valid during it. The structure and wording of clause 7.5 may change; check against the edition your organization is certified to.

Where does your current control system stand?

→ Take the Digitalization Level Assessment to identify your current digitalization level and the next economically sensible step.

Further reading:

• From Paper QMS to eQMS: What Changes, What Doesn’t, and What to Prepare (previous)
• eQMS for Small Manufacturers: Why It Doesn’t Have to Be Complex (next)
• ISO and GMP in the Context of Digitalization (related)
• eQMS for Manufacturing SMEs: A Practical Guide (pillar)

Sources:

• ISO 9001:2015, clause 7.5 (documented information) and Annex A (explanation of “maintain” and “retain”): iso.org/standard/62085.html
• LRQA, ISO 9001 revision update: Publication date confirmed (certification body source; verify with ISO): lrqa.com

ISO 9001:2015 clauses are summarized in practical language and do not replace the text of the standard; compliance decisions should be checked against the official edition. The signals described are general observations from common patterns in manufacturing, not thresholds or measured figures.