Three things, one name
Document control systems
The oldest shape. A controlled place for procedures, revisions, approvals and who-read-what. Solid, unglamorous, and what most people picture.
It manages the documents you already wrote. If your problem is not having written them, this is the wrong tool and an expensive way to find out.
Compliance platforms
Grown out of the SOC 2 and information-security world. Continuous monitoring, evidence collection, dashboards showing you green.
Their evidence collection is API integrations — cloud accounts, identity providers, ticketing. Excellent for a software company. There is no API for a micrometer.
Preparation tools
Aimed at the gap between where you are and an auditable system: what does the standard require of us, what do we have, what has to be written.
The newest and least defined of the three. Judge it on whether it produces something an auditor would accept, not on how the dashboard looks.
What it costs
Established quality management platforms run roughly $360–$600 a month for a company of 10–30 people, and several add $5,000 or more in implementation before you have used it once. Newer AI-native entrants sit around $3,300 a year with unlimited users, cover a dozen standards, and give you a free trial — which has pulled the floor of this market down sharply in the last year.
Put that beside the rest of the bill. Certification itself is $8,000–$20,000 in year one for a company your size, of which $3,000–$5,000 goes to the certification body and cannot be avoided. Software is not the expensive part. The expensive part is usually your own people’s time, and the only reason to buy software at all is that it takes some of that back.
The question that sorts the field
Ask a demo this: what does it do about evidence that is not digital?
Most of what you will be asked to show an auditor exists on paper or in somebody’s head. A signed job card. A calibration certificate that arrived in an envelope. A heat-treatment cert stapled to a delivery note. The gauge in the drawer with a sticker on it. A platform whose evidence model assumes an API will find everything is not wrong — it is built for a different kind of company, and it will quietly leave the hardest half of your job exactly where it was.
Two follow-ups worth asking while you have them on the call:
- Does it handle suppliers and calibration as records with due dates, or as folders to file things in? Expired calibration and thin supplier control are among the most commonly reported audit findings, and they are both due-date problems before they are document problems.
- Can you get everything out? Ask to see the export before you put anything in. A quality system you cannot take with you is a quality system you are renting, and that is a bad position to be in three years later at recertification.
What software cannot do, whatever it costs
It cannot pass your audit. An auditor does not read your procedures and tick them off — they take one, walk out to the person doing the job, and ask them to describe it. If what they describe is not what the document says, that is not a documentation problem. It is evidence the system is not in use, and it is a serious finding.
Which is also the honest limit of this whole category. Software can get you to the audit with the right things written down, on time, with the records to back them. It cannot make the shop floor recognise them.
If you are earlier than this
Plenty of people searching for software have not yet decided whether to certify at all. If that is you: who is currently asking for the standard in public contracts, rebuilt daily; what it costs in full; how long it takes; and whether a consultant is a better buy than a tool, which for some shops it genuinely is.