On 24th Sept  2025, the FDA published its final guidance on Computer Software Assurance (CSA) for production and quality system software.

What’s new?
CSA formalizes a risk-based approach to ensure software used in production and quality systems is fit for its intended use and remains in a validated state throughout its lifecycle:

• Risk drives validation: Identify intended use by feature/function. High-risk areas that could impact patient safety or product quality require more rigorous assurance.

• Digital over paper: System logs, audit trails, and automated outputs are preferred to paper-heavy documentation.

• Leverage vendor evidence: Certifications, SDLC documentation, cybersecurity practices, and service agreements can support your assurance activities.

• Lifecycle focus: For SaaS auto-updates, apply targeted regression testing instead of full revalidation.

CSA is not “less validation”  – it’s smarter, risk-based validation.

Full guidance here: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/computer-software-assurance-production-and-quality-system-software-0