Regulatory guidance / GMP guideline
FDA computer software assurance (CSA)
Medical-device manufacturers assuring software used in production or their quality management system.
Open official sourceDoes this apply to my work?
This is not general guidance for all pharmaceutical or clinical software, or a substitute for device-product software lifecycle requirements.
Nonbinding recommendations; no separate legal effective date.
What does it address?
Recommends selecting assurance activities from intended use, risk and the evidence needed for confidence.
What does this mean in practice?
The controls and evidence below are practitioner examples. They are not mandatory document names or a complete list of obligations.
| Source provision | Requirement or recommendation | Practical control or activity | Example evidence | Applicability note |
|---|---|---|---|---|
| Risk-based assurance approach | Recommendation | Identify important configured paths and choose targeted assurance activities. | Failure analysis, test observations and a reasoned conclusion. | Medical-device production or QMS use. |
Illustrative example
A decision in practice
- Intended use
- An eQMS routes a device CAPA for approval.
- Risk
- A configuration change could allow an unqualified person to approve closure.
- Control
- Restrict approval roles and preserve approval history.
- Testing
- Challenge unauthorized approval, rejection, rework and the configured valid path.
- Evidence
- Configuration, observations, issues and reviewer rationale.
- Conclusion
- The illustrative team releases only when approval bypass is prevented and unresolved issues are assessed.
More practitioner context
Practical impact
Review risk-based assurance terminology, use of scripted and unscripted testing, and the basis for using supplier evidence.
Actions to consider
Perform a controlled gap assessment. Do not automatically rerun existing validation solely because the guidance was revised.
Practitioner interpretation
Use the guidance to improve how evidence is selected for the defined use. It does not authorize omission of required Quality System Regulation records or approvals.
Continuing context
The guidance remains nonbinding. The regulated manufacturer remains responsible for applicable requirements and sufficient evidence.
Source and review information
Source check: 21 September 2026. Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Citation, dates and editorial history
- Stable source ID
- fda-computer-software-assurance-guidance
- Official citation
- Computer Software Assurance for Production and Quality Management System Software
- Issuing organization
- U.S. Food and Drug Administration
- Edition
- February 2026
- Publication
- February 2026
- Application / transition
- Nonbinding recommendations; no separate legal effective date.
- Publication status
- Final / published
- Verification
- Verified — public source metadata and scope
- Editorial update
- 21 September 2026 · Version 2.0
- Source owner
- CSVtoCSA editorial
- Review needed
- Recheck when the source or intended use changes
- Independent review
- No independent regulatory review is claimed.
- Earlier publication
- FDA final CSA guidance issued 24 September 2025; superseded by the February 2026 publication.
- Prior editorial date
- 12 September 2026 (existing record or detailed guide)
21 September 2026: Source metadata checked, scope clarified, practical mapping and illustrative example added, and layout reorganized. Existing detailed guide content and its dated history are retained below its disclosure. This is an editorial update, not a regulatory amendment.
Questions and corrections
Contributor opinions are moderated and remain distinct from the source and site explanation. Comments do not update source metadata.
Suggest a source correction
Sent privately to the editorial moderation queue. Your account email and correction are not published as a comment. Do not include confidential or personal information.
Source: fda-computer-software-assurance-guidance
Loading sign-in status…
Ask a question or share a professional example
Questions and discussion
Ask a question or share a perspective. Contributions are reviewed before publication.
Loading contribution options…