# DearAuditor Open eQMS — full project summary > Generated for LLMs and agents. Human version: https://qms.dearauditor.ch/ — structured index: https://qms.dearauditor.ch/llms.txt DearAuditor Open eQMS is an open-source, GitHub-native electronic Quality Management System baseline for medical device and regulated software teams. Fork it, tailor it to your organisation, validate it, and run it, entirely in Git. ## How it works The baseline uses GitHub as the canonical system of record. Every controlled document, every approval, every audit-trail entry lives in Git, not in a separate SaaS. - **Issues** drive planning and intake: CAPA, audits, risk items, training assignments. - **Pull Requests** form the controlled review and approval boundary. - **Actions** enforce policy: they assign signatory reviewers, gate merges, and orchestrate signature collection. - **Releases** publish immutable, versioned quality records. An adopting company mirrors the public baseline into a private repository, tailors it, validates it for intended use, and operates from there. A bootstrap script sets up that private repository: it derives code-owner review from the signer registry and copies the baseline's branch protection and merge rules. ## Adoption profiles — application scenarios by product type Every adopter operates the same product-independent core baseline. Optional adoption profiles answer "I am building X — which parts apply to me?" by layering the relevant SOPs, gap analyses, and record families on top of that core. Profiles are optional adoption aids, not regulatory advice. ### AI-based diagnostic software - **You are building:** Software with a medical purpose (diagnosis, screening, triage, decision support) that embeds AI/ML and qualifies as a medical device (SaMD + AI). - **Standards layered on the core (ISO 9001) baseline:** ISO 13485, ISO 14971, IEC 62304, IEC 62366-1, IEC 82304-1, ISO/IEC 42001, ISO/IEC 27001, GDPR / Swiss nFADP. ### App with AI features - **You are building:** A general software product that embeds AI/ML features but makes no medical claim and is not a medical device. - **Standards layered on the core (ISO 9001) baseline:** ISO/IEC 42001, ISO/IEC 27001, GDPR / Swiss nFADP. ### Digital health app - **You are building:** A consumer or professional wellness app that processes health-adjacent data but is not a medical device. - **Standards layered on the core (ISO 9001) baseline:** ISO/IEC 27001, IEC 82304-1 (good practice), GDPR / Swiss nFADP. ### In-house clinical software - **You are building:** Software built inside a clinic or hospital for its own patients, not placed on the market. - **Standards layered on the core (ISO 9001) baseline:** ISO 14971, IEC 62304 (tailored), IEC 62366-1, ISO/IEC 27001, GDPR / Swiss nFADP. ### Clinical-study support software - **You are building:** Computerized systems used in clinical research (data capture, study management, ePRO). - **Standards layered on the core (ISO 9001) baseline:** ISO/IEC 27001, GDPR / Swiss nFADP, plus the opt-in GAMP 5 / 21 CFR Part 11 / EU Annex 11 overlay. Source of truth: https://raw.githubusercontent.com/AliakseiT/dearauditor-qms-baseline/main/docs/adoption/profiles.md ## Electronic signatures and 21 CFR Part 11 GitHub authenticates users through its own identity provider, but FDA 21 CFR Part 11 requires that each electronic signature reflects a deliberate, attributable act of signing. The Signature Worker (a Cloudflare Worker) closes that gap: it intercepts the approval event and requires a secondary, time-limited PIN before recording the signature, producing a cryptographically bound record tying signer identity, intent, timestamp, and exact document revision into one verifiable artefact attached to the GitHub Release. ## The published library (release QMS-2026-07-09-R005) - 1 Quality Manual — top-level policy and scope - 23 SOPs — document control, CAPA, risk management, software lifecycle, supplier control, usability, information security (ISO/IEC 27001), AI management (ISO/IEC 42001), data protection (GDPR & nFADP) - 2 Work Instructions — V&V execution and release management - Gap analyses — ISO 9001, ISO 13485, ISO 14971, IEC 62304, IEC 62366-1, IEC 82304-1, ISO/IEC 27001, ISO/IEC 42001, GDPR, Swiss nFADP, plus the optional GAMP 5 / GxP overlay - Adoption profiles, record templates, training matrices, signer registries, tooling inventories ## Frequently asked questions ### Can GitHub be used as an electronic Quality Management System (eQMS)? Yes. The DearAuditor Open eQMS baseline uses GitHub as the canonical system of record: Issues drive planning and intake (CAPA, audits, risk items, training), Pull Requests form the controlled review and approval boundary, Actions enforce policy and signature collection, and Releases publish immutable versioned quality records. An adopting company mirrors the public baseline into a private repository, tailors it, and validates it for its intended use. ### Which standards and regulations does the baseline cover? The baseline ships gap analyses and controls for ISO 9001, ISO 13485, ISO 14971, IEC 62304, IEC 62366-1, IEC 82304-1, ISO/IEC 27001, ISO/IEC 42001, GDPR, and the Swiss nFADP, plus an optional GAMP 5 / GxP overlay covering 21 CFR Part 11 and EU Annex 11 expectations for clinical-research contexts. ### Is the baseline ISO 13485 certified or FDA-compliant out of the box? No QMS is compliant out of the box. The baseline provides the framework: a Quality Manual, 23 SOPs, work instructions, gap analyses, record templates, and workflow automation. Certification and compliance are properties of the adopting company's tailored, validated installation, not of the upstream open-source baseline itself. ### How does it meet FDA 21 CFR Part 11 electronic-signature requirements? A dedicated Signature Worker (a Cloudflare Worker) intercepts the GitHub approval event and requires a secondary, time-limited PIN before recording the signature. The result is a cryptographically bound record tying the signer's identity, intent, timestamp, and exact document revision into a single verifiable artefact attached to the GitHub Release. ### Which adoption profile fits my product? Five profiles map common product types to the standards and SOPs that typically apply: AI-based diagnostic software (SaMD + AI), an app with AI features but no medical claim, a digital health / wellness app, in-house clinical software, and clinical-study support software. See the adoption guide. ### What does it cost and how is it licensed? The baseline is open source with split licensing: code, scripts, and automation are Apache-2.0; SOPs, work instructions, templates, and documentation are CC BY-SA 4.0. Forking and adopting the baseline is free; DearAuditor separately offers paid validation documentation packages (IQ/OQ/PQ) for regulated installations. ### How do I adopt the baseline in my company? Mirror the public baseline into a controlled private repository, tailor it to your organisation, validate it for intended use, train your team, and approve it before use. A bootstrap script sets up the private repository: it derives code-owner review from your signer registry and copies the baseline's branch protection and merge rules. ## Links - Repository: https://github.com/AliakseiT/dearauditor-qms-baseline - Current release: https://github.com/AliakseiT/dearauditor-qms-baseline/releases/tag/QMS-2026-07-09-R005 - Landing page: https://qms.dearauditor.ch/ - DearAuditor toolset: https://dearauditor.ch - Contact: aliaksei@dearauditor.ch