The short answer
You control documents in Confluence by giving each controlled document its own page in a dedicated space, a clear status (draft, in review, approved, obsolete), a named owner and approver, and a recorded approval for every version. Confluence keeps the versions, permissions and page history. An approval workflow adds the recorded sign-off ISO 13485 asks for; if you sign FDA-required records electronically, 21 CFR Part 11 adds requirements for those signatures.
What does ISO 13485 document control ask for?
Clause 4.2.4 of ISO 13485:2016 lists what a document control procedure must cover. In short:
- documents are reviewed and approved before they’re issued;
- changes are reviewed and approved again, by the original approving function or another designated one;
- changes and the current revision status are identified;
- the right versions are available where they’re used;
- documents stay legible and identifiable;
- external documents, such as standards and supplier specifications, are identified and their distribution controlled;
- documents are protected against deterioration or loss;
- obsolete documents can’t be used by mistake, and are kept for at least the lifetime of the device.
Clause 4.2.5 adds the rules for records: approval records, review minutes and release reports must stay legible, identifiable and retrievable, and changes to them must stay identifiable.
How much of this does Confluence do?
Confluence covers versioning, permissions and page history well. Approval and obsolescence control need more: native page approvals are limited to higher Confluence plans, and on Standard you have page statuses only. The usual answer is an approval or document-management app from the Atlassian Marketplace.
| Need | Confluence on its own | With an approval or e-signature app |
|---|---|---|
| Version history | Yes, every page | Yes |
| Restricted editing | Yes, space and page permissions | Yes |
| Visible status | Page status or label | Enforced workflow states |
| Recorded approval per version | Limited by plan | Yes, with approver and date |
| Part 11 signature features | No | Signature meaning, re-authentication, audit trail (app-dependent) |
How do you set it up?
- One space for controlled documents. SOPs, work instructions and design documents live here, separate from team notes. Restrict who can edit; everyone can read. Some teams use two spaces instead: a working space for drafts and a read-only controlled space for approved versions.
- One page per document, one owner. The page title carries the document ID and name, for example “SOP-004 Design control”. The owner and approver are named on the page.
- A visible status. Draft, in review, approved, obsolete. A page status or a label is enough to start; an approval workflow makes it enforceable.
- Approval per version. Each approved version records who approved it and when. Obsolete versions stay in the history, marked as obsolete, not deleted.
- External documents listed. A page or a database that lists the standards and supplier documents you use, with the version in force.
- Documents linked to the work. Design documents link to the Jira requirements they describe, so a change to a requirement shows which documents to review. That’s good practice, not a requirement, and it’s what makes the traceability matrix hold together.
- The setup validated. Write down what Confluence and the app are used for, test that the configuration does it, and keep the evidence, per clause 4.1.6.
What usually goes wrong?
Documents are edited in place with no record of approval, so nobody can say which version was valid on a given date. Or approved documents are exported to PDF and stored somewhere else, and the PDF and the page drift apart. Whichever pattern you choose, one version must be the authoritative one, and everyone must know where it is.
Who decides what’s controlled?
Your quality lead decides which documents are controlled, who approves them, how, and whether Part 11 applies. We’re not a regulatory consultancy: we set up Confluence so that the procedure your quality lead wrote is easy to follow and easy to show.
The SaMD Traceability Check: 18 questions, about six minutes, your score right away.
Questions people ask
Is Confluence page history enough for document control?
Page history shows who changed what and when, which covers part of it. Document control under ISO 13485 also needs review and approval before release, re-approval of changes, a way to tell the current approved version from drafts, and control of obsolete versions. An approval workflow, native or from an app, covers that.
Is Confluence 21 CFR Part 11 compliant?
No tool is Part 11 compliant on its own. Part 11 covers the whole system: the software, how it's configured and validated, and your procedures for access, training and signature accountability. Confluence alone has no signature meaning or re-authentication at signing; Marketplace apps add those features. Your quality lead decides which records Part 11 applies to.
Do we need electronic signatures for ISO 13485?
No. ISO 13485 asks for documents to be approved, and for that approval to be recorded. Electronic signatures become a regulatory question when you keep FDA-required records electronically and sign them in place of handwritten signatures; that's 21 CFR Part 11.
Does Confluence need to be validated?
If it's part of your quality management system, yes. ISO 13485 clause 4.1.6 asks you to validate QMS software for its intended use before first use and after changes, with effort proportionate to risk. Because Confluence Cloud changes continuously, plan how you re-check it, not only the first validation.