1What computer software assurance is.
FDA defines computer software assurance as “a risk-based approach for establishing and maintaining confidence that software is fit for its intended use”. The effort follows the risk to device safety or quality if the software fails, and the guidance calls this “a least-burdensome approach, where the burden of validation is no more than necessary to address the risk”.¹ It lets manufacturers use risk-based testing, unscripted testing, continuous performance monitoring, data monitoring and validation work done by developers, suppliers and cloud service providers.¹
The guidance covers computers and automated data processing systems used as part of medical device production or the quality management system. It does not cover software that is itself a medical device.¹
2CSA and CSV are not alternatives.
Validation is still required. The guidance says manufacturers must validate software used as part of production or the quality management system for its intended use, under the clauses of ISO 13485:2016 that Part 820 now incorporates. CSA describes methods that “provide objective evidence to fulfill regulatory requirements, such as computer software validation requirements”.¹
It supplements FDA’s 2002 General Principles of Software Validation and replaces only its Section 6 on automated process equipment and quality system software; the rest of the 2002 guidance still reflects FDA’s current thinking.² That guidance defines software validation as “confirmation by examination and provision of objective evidence that software specifications conform to user needs and intended uses”, and already tied the level of effort to risk.² The CSA guidance’s background notes that software validation has often been done through testing and other verification at each stage of development, while, as the 2002 guidance explains, “software testing alone is often insufficient to establish confidence that the software is fit for its intended use”.¹
| Question | Under the CSA guidance |
|---|---|
| What is assessed? | The intended use of each feature, function or operation, not only the system as a whole.¹ |
| Which software needs assurance? | Software used directly in production or the quality system, and software that supports it. General business software such as email or accounting, and infrastructure such as networking or backup, generally falls outside.¹ |
| How is risk judged? | A feature is “high process risk” when its failure may result in a quality problem that foreseeably compromises safety; everything else is “not high process risk”.¹ |
| How much testing? | Scripted, or scripted and unscripted together, is suggested for high process risk; unscripted scenario, error-guessing or exploratory testing may suit lower risk. The guidance says neither is exclusive to its category.¹ |
| What can be reused? | Supplier development and validation work, existing process controls and in-use monitoring can reduce the testing needed. For some lower-risk functions, vendor evidence may be all the assurance needed.¹ |
| What is the record? | Enough objective evidence and no more. FDA recommends digital records such as system logs and audit trails over paper documentation and screenshots.¹ |
3What the record contains.
FDA recommends that the assurance record include the intended use of the feature, function or operation, the result of the risk-based analysis, and documentation of the assurance activities: a description of the testing, issues found, a conclusion on acceptability with any resolution, who performed it and when, and review and approval where appropriate.¹ For unscripted testing the record holds a summary of what was tested rather than step-by-step test cases. The guidance’s worked example is a spreadsheet that collects and graphs nonconformance data, checked by rapid exploratory testing; the one deviation found was fixed with a validation rule and the update retested.¹
Supplier assessment is risk-based too. FDA acknowledges that auditing a software vendor may not be feasible, and lists alternatives such as reviewing Service Organization Controls reports, ISO certifications, the vendor’s development and cybersecurity practices, and its data integrity controls for records, audit trails, access and electronic signatures.¹ On electronic records, the guidance points manufacturers to FDA’s Part 11 scope and application guidance to decide when Part 11 applies.¹
4Where CSA applies outside medical devices.
The guidance was prepared by FDA’s device and biologics centres, CDRH and CBER, in consultation with CDER, and its scope is medical device production and quality management system software.¹ Drug manufacturers remain under 21 CFR 211.68 and Part 11.³ FDA’s 2018 drug data integrity guidance already says each CGMP workflow on a computer system should be validated, with the extent of validation “commensurate with the risk posed by the automated system”.³ In the EU, Annex 11 bases decisions on the extent of validation on “a justified and documented risk assessment”.⁴
ISPE says its GAMP 5, Second Edition, published in July 2022, added discussion of FDA’s CSA work and emphasises critical thinking by experienced subject matter experts.⁵ The CSA guidance itself names GAMP 5, Second Edition among resources on testing methods.¹
5How the guidance got here.
| Date | Version |
|---|---|
| 13 September 2022 | Draft guidance, Computer Software Assurance for Production and Quality System Software (87 FR 56059).⁶ |
| 24 September 2025 | Final guidance under the same title, revised after comments with a definitions section and more examples.⁶ |
| 2 February 2026 | Amended 21 CFR Part 820, incorporating ISO 13485:2016, took effect.¹ |
| 3 February 2026 | Computer Software Assurance for Production and Quality Management System Software, superseding the September 2025 final.⁷ |
FDA’s guidance page lists the February 2026 document as the final guidance, so a description of CSA as a draft refers to the 2022 version, which has been superseded twice.⁷
6How it runs in Seal.
Seal’s computer system assurance workflow assesses risk at the level of functions and failure modes, and records which claim each piece of supplier evidence supports, with the gaps found. A test case can be automated where the system has an API, or run by hand with each step recorded; an exploratory charter records its mission, scope, risks and timebox, and its execution records observations, anomalies and the tester’s conclusion. A Check can require a passing run of every approved test case on the version being released before the change publishes.
The validation and AI assurance guide sets out how GAMP 5 and CSA shape assurance of Seal itself; your quality team still approves the intended use, assurance scope and release decision. Validation in Seal keeps executed results with the configuration version they were run on.
References
- 1Computer Software Assurance for Production and Quality Management System Software, Guidance for Industry and FDA Staff, FDA, 3 February 2026. https:/
/ www. fda. gov/ media/ 188844/ download (read 6 November 2026) - 2General Principles of Software Validation; Final Guidance for Industry and FDA Staff, FDA, 11 January 2002, with notice of the superseded Section 6. https:/
/ www. fda. gov/ media/ 73141/ download (read 6 November 2026) - 3Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 4EudraLex Volume 4, Annex 11: Computerised Systems, European Commission, revision 1, in operation from 30 June 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 5GAMP 5 Guide, 2nd Edition, ISPE, July 2022. https:/
/ ispe. org/ publications/ guidance- documents/ gamp- 5- guide- 2nd- edition (read 6 November 2026) - 6Computer Software Assurance for Production and Quality System Software; Guidance for Industry and Food and Drug Administration Staff; Availability, Federal Register, 24 September 2025. https:/
/ www. federalregister. gov/ documents/ 2025/ 09/ 24/ 2025- 18468/ computer- software- assurance- for- production- and- quality- system- software- guidance- for- industry- and (read 6 November 2026) - 7Computer Software Assurance for Production and Quality Management System Software, guidance page, FDA, 3 February 2026. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ computer- software- assurance- production- and- quality- management- system- software (read 6 November 2026)
AQuestions and answers
Does CSA replace computer system validation?
No. The obligation to validate software used in production or the quality system stays. CSA is FDA’s guidance on how to meet it in proportion to risk, and it replaces only Section 6 of FDA’s 2002 software validation guidance.
Does the CSA guidance apply to pharmaceutical manufacturers?
Its scope is software used in medical device production and quality management systems, and it was written by FDA’s device and biologics centres in consultation with CDER. Drug manufacturers remain under 21 CFR 211.68 and Part 11, and FDA’s 2018 drug data integrity guidance already asks for validation in proportion to the risk of the automated system.
Is unscripted testing acceptable evidence?
Yes, where it suits the risk. The record should still state the intended use, the risk-based analysis, what was tested, the issues found, a conclusion on acceptability, and who tested and when. Unscripted means the steps are not prescribed in advance, not that nothing is recorded.
Is the CSA guidance still a draft?
No. The September 2022 draft was finalised on 24 September 2025, and that final guidance was itself superseded on 3 February 2026 by a version titled for production and quality management system software.
Can a software supplier’s testing count towards assurance?
Yes. FDA expects manufacturers to assess the vendor in proportion to risk, using audits where feasible or alternatives such as SOC reports, ISO certifications and reviews of development and data integrity practices. For some lower-risk functions, the vendor’s work plus installation and configuration may be all the assurance needed.
Does CSA change what 21 CFR Part 11 requires?
No. The CSA guidance sends manufacturers to FDA’s Part 11 scope and application guidance to decide whether and how Part 11 applies to a system’s records and signatures.