What regulatory compliance management means
Regulatory compliance management is the system a company uses to know which regulatory requirements apply to it, put controls in place to meet them, check that the controls work, and prove it to regulators. In life sciences, the requirements come from many places at once: GMP and QMS regulations, marketing authorizations, guidance documents, standards, pharmacovigilance and vigilance rules, data integrity expectations and, increasingly, AI and data protection rules.
The term is used across industries, from banking to energy. What makes life sciences different is that the evidence matters as much as the behavior. Regulators judge compliance largely by the records a company can produce during an inspection.
Why it is under pressure now
The enforcement climate tightened through 2025:
- FDA announced on May 6, 2025 that it would expand unannounced inspections at foreign manufacturing facilities, according to Hogan Lovells.
- Reed Smith reported that FDA issued 327 warning letters between July 1 and December 3, 2025, a 73% increase over the same period in 2024, and 58 untitled letters in FY2025, up from 5 in 2024.
- Reed Smith also reported that FDA’s internal AI tool, Elsa, launched in June 2025, is used to help prioritize higher-risk facilities using adverse events, Form 483 history and other data.
- In FY2025 Form 483 data analyzed by GMP Insiders, the most cited drug GMP provision was 21 CFR 211.22(d), quality unit procedures not in writing or not followed, with 243 observations.
For medical devices, the QMSR took effect on February 2, 2026. NAMSA notes that management review, quality audit and supplier audit reports are no longer exempt from FDA inspection. Documents that used to be internal are now evidence.
The five building blocks of a compliance management system
1. An obligations register
You cannot comply with requirements you have not identified. An obligations register lists every applicable requirement, by product, site and market, with its source and owner.
| Field | Example |
|---|---|
| Requirement | Quality unit reviews batch records before release |
| Source | 21 CFR 211.192; EU GMP Annex 16 |
| Applies to | Site A, all commercial products |
| Owner | Head of QA |
| Control | SOP-QA-012; release checklist |
| Evidence | Signed batch record review; release record |
| Monitoring | Monthly self-inspection sample; annual internal audit |
For device makers, the Johner Institute notes that ISO 13485 requires manufacturers to systematically identify regulatory requirements (citing clause 5.2). The register is the practical form of that requirement.
2. Controls
Each obligation maps to one or more controls: procedures, system configurations, training, approvals or physical controls. A good control is specific enough to test. “QA reviews records” is not a control. “QA reviews every executed batch record against checklist QA-F-045 before release, and the review is signed in the batch record” is.
3. Monitoring and testing
Controls drift. Monitoring checks that they still work:
- Self-inspections and internal audits
- Trend review of deviations, complaints and CAPA
- Key indicators such as overdue CAPA, overdue training, open change controls
- Periodic review of computerized systems
ICH Q10 makes management review, process performance monitoring, CAPA and change management the core elements of a pharmaceutical quality system. Compliance monitoring feeds all four.
4. Change management
The obligations register changes whenever regulations change, products change or the company enters a new market. Regulatory change management (identifying new requirements and assessing their impact) and internal change control (assessing internal changes against existing requirements) are both needed. Our guide to regulatory change management covers the first.
5. Evidence and inspection readiness
Compliance that cannot be shown does not count during an inspection. Evidence must be complete, retrievable quickly and consistent across documents. The most damaging inspection moments come from documents that contradict each other: an SOP that says one thing, a record that shows another and a training matrix that does not include the person who did the work.
Common failures
- No single view of obligations. Requirements live in different departments’ heads and spreadsheets.
- Controls that exist on paper only. The SOP is approved, but nobody follows it the way it is written. This is exactly what 211.22(d) citations describe.
- Monitoring that measures activity, not effectiveness. Counting audits performed, not findings closed effectively.
- Slow reaction to regulatory change. A new guidance is known but its impact is never formally assessed.
- Evidence scattered across systems. Records exist, but nobody can assemble them during an inspection.
Software and tools
Compliance management in life sciences usually spans several systems: an eQMS for deviations, CAPA, change control and documents; a regulatory information management (RIM) system for registrations and commitments; a learning management system; and audit management tools. Integration matters more than any single tool. Ask any vendor how its system shows the link from a requirement to the control to the evidence.
Compliance management checklist
- Obligations register covers all products, sites and markets
- Every obligation has an owner, a control and a source
- Controls are specific enough to test
- Monitoring includes effectiveness, not just activity
- Regulatory changes are assessed and fed into the register
- Procedures match practice, confirmed by self-inspection
- Evidence can be retrieved quickly for any requirement
- Management review covers compliance status and trends
- Device makers: management review and audit reports are inspection-ready under QMSR
Test your compliance evidence with AskDona
The hardest compliance gaps to see are contradictions between documents. AskDona reads SOPs, records, training data and audit reports together, checks them against FDA, EU and ISO requirements and your own procedures, and flags mismatches and missing evidence with links to the source page. Run a sample compliance evidence assessment on one process area before your next inspection. AskDona shows the evidence; your quality and regulatory teams decide.
FAQ
What is regulatory compliance management? The system for identifying applicable regulatory requirements, implementing controls, monitoring them and proving compliance with evidence.
What is an obligations register? A list of every regulatory requirement that applies to the company, with its source, owner, control and evidence.
How is compliance management different from a QMS? A QMS is the main vehicle for compliance in life sciences, but compliance management also covers obligations outside the QMS, such as registrations, pharmacovigilance, data protection and market-specific rules.
What changed for device makers in 2026? The QMSR took effect on February 2, 2026, incorporating ISO 13485 and making management review and audit reports available to FDA inspectors.
What does FDA cite most often? In FY2025 drug GMP data, quality unit procedures not written or not followed (21 CFR 211.22(d)) was cited most, according to GMP Insiders.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| Hogan Lovells, FDA expands unannounced foreign inspections | Law firm analysis | May 2025 announcement |
| Reed Smith, FDA inspections in 2025 | Law firm analysis | Warning and untitled letter counts; AI targeting |
| GMP Insiders, FY2025 FDA inspection observations | Industry analysis of FDA data | 211.22(d) count |
| NAMSA, Industry Update: QMSR | CRO / consultancy article | QMSR effective date; inspectable reports |
| Johner Institute, Regulatory Intelligence | Consultancy article | ISO 13485 requirement capture |
| ICH Q10 (FDA) | ICH guideline | PQS elements |
| 21 CFR Part 211 (eCFR) | US regulation | 211.22, 211.192 |