Computer Software Assurance (CSA): risk-based testing instead of paperwork
What FDA's Computer Software Assurance guidance changes about validating production and quality system software, and how to record the assurance it asks for.
From validation paperwork to assurance
FDA's guidance on Computer Software Assurance for production and quality management system software was issued as a draft in September 2022; the version in the package was issued on 3 February 2026 and supersedes the September 2025 version. It addresses software used in medical device production or the quality management system, and many pharmaceutical and biotech companies apply its thinking to their CGMP systems as well. Its point: effort goes into testing what matters for product quality and patient safety, not into documentation for its own sake.
The four steps
The guidance describes a risk-based approach in four steps.
- Identify the intended use: is the software used directly in production or the quality system, or does it support them?
- Determine the risk: would a failure of this feature compromise safety or quality (high process risk), or not?
- Select assurance activities that fit the risk: scripted testing for high-risk features; unscripted testing such as ad hoc, error-guessing or exploratory testing where the risk is lower; and the supplier's own assurance where it can be leveraged
- Establish the appropriate record: enough to show what was tested, by whom, when, the result and any issues found
What stays the same
CSA doesn't remove validation; it scales it. Part 11 and the predicate rules still apply, the decisions still need a documented rationale, and the system still has to stay in a validated state through change control and periodic review.
With the GxP Validation Assistant
How the assistant supports CSA
Intended use first
Every system starts with its intended use and the functions that affect product quality, patient safety and data integrity.
Risk sets the approach
Criticality and software category suggest scripted, risk-based or unscripted testing; each test is marked scripted or unscripted.
Unscripted, documented afterwards
Exploratory tests are recorded with their objective, who ran them, when, the result and the issues found.
Rationale on record
Overridden suggestions keep their reason, so an investigator sees why the assurance was chosen.
The CSA guidance represents FDA's current thinking and is labeled as guidance. The assistant supports your validation; your company remains responsible for it.
See it with your own systems.
Watch the webinar, or install the assistant and try it for 14 days.