CSV & Data Integrity

CSA: what the FDA guidance covers, and what it does not

4 min read

In February 2026 the FDA issued a final guidance on Computer Software Assurance. It is often cited in pharmaceutical projects — yet its scope is medical devices. The distinction changes what can be drawn from it.

Low riskSimple checkMedium riskTargeted testingHigh riskDocumented evidenceThe effort of proof follows the risk carried by the function
Three levels of risk, three levels of assurance effort

What the document says

The guidance is titled “Computer Software Assurance for Production and Quality Management System Software”. It is final, dated 3 February 2026, under docket FDA-2022-D-0795. It supersedes the final guidance of 24 September 2025, whose title referred to “Quality System Software” — the shift to “Quality Management System” follows the alignment of 21 CFR Part 820 with quality management system vocabulary.

It comes from the Center for Devices and Radiological Health and the Center for Biologics Evaluation and Research. Its object: computers and automated data processing systems used as part of medical device production or of the quality management system.

The scope, and why it matters

The text is tied to 21 CFR Part 820 — medical device regulation. Computerised systems on a pharmaceutical site fall, in Europe, under Annex 11 of EudraLex Volume 4, and in the United States under drug CGMP.

The confusion is common because both fields share a vocabulary — validation, qualification, data integrity — and because the risk-based approach CSA promotes is transposable in spirit. Transposable does not mean applicable as of right: invoking CSA to justify lighter testing before a European inspector on a pharmaceutical site means citing a text that does not govern the installation being inspected.

What remains useful outside its scope

The guidance describes a risk-based approach to establish confidence in the automation used for production or quality management systems. It helps identify where additional rigour may be appropriate, and describes various methods and testing activities that may be applied to establish that assurance.

The reasoning — scaling the effort of proof to the risk carried by the function, rather than testing uniformly — is sound engineering practice that depends on no particular text. It can inform a pharmaceutical validation strategy, provided that strategy remains argued on the texts that actually apply to the site.

This analysis is written automatically from the official documents cited below, whose factual elements it reports: title, date, status and scope. It is neither a regulatory opinion nor advice applicable as it stands. For any decision, refer to the original texts and to your quality assurance function.

Sources

All news