Computer Software Assurance (CSA)

What CSA actually changes

CSA does not remove the obligation to establish that software is fit for its intended use. It challenges the assumption that every function deserves identical scripted testing and identical documentation weight.

The shift is analytical: identify the intended use, determine whether a failure could compromise product quality or patient safety, then choose assurance activities proportionate to that determination. Low-risk features may be appropriately assured through unscripted or exploratory testing with lightweight records; high-risk features still warrant rigorous, scripted, pre-approved testing.

CSA is not a replacement for CSV

It is inaccurate to say CSA simply replaces CSV. Both are approaches to the same underlying objective: confidence that a computerized system performs as intended in its context of use. Many organizations operate a single assurance framework that scales its rigor by risk, and describe it using whichever terminology fits their quality system.

What matters to a regulator or auditor is whether the approach is justified, applied consistently, and supported by evidence — not the label on the SOP.

Assurance activities by risk

• Unscripted testing — ad hoc, error-guessing and exploratory testing, recorded proportionate to risk
• Scripted testing — robust or limited scripted tests with predefined steps and expected results
• Supplier leverage — assessed vendor testing, certifications and release evidence
• Production monitoring — post-release checks, error logs and performance signals

Making CSA work in a real quality system

• Update the validation policy and SOPs so the risk framework is authorized, not improvised
• Train reviewers and approvers, not just authors — approval culture is what re-creates paperwork
• Define what evidence unscripted testing must capture (who, when, what, result, defects)
• Keep traceability for high-risk requirements
• Do not use CSA as a justification to skip Part 11 or data integrity assessment

Current FDA CSA scope and quality-system context

FDA's final Computer Software Assurance for Production and Quality Management System Software guidance was updated on February 3, 2026, superseding the September 2025 version. Its scope is software used in medical-device production and quality management systems. It is not a blanket replacement for pharmaceutical computerized system validation or for validation of software that is itself a medical device.

The Quality Management System Regulation (QMSR) became effective February 2, 2026. Revised 21 CFR Part 820 incorporates ISO 13485:2016 by reference while retaining FDA-specific requirements. Determine the applicable regulatory scope before applying CSA terminology to a system.

• Document intended use and the consequence of a software failure
• Select and justify assurance methods by function and risk
• Capture objective results, issues, reviewer identity and the acceptance decision
• Maintain change, configuration and record controls after release