Version 2.0 · Updated 2026-09-21 · Assessment
Evaluate whether the supplier, service controls, lifecycle practices, and available evidence are suitable for the intended use.
Adapt this template to your intended use, applicable requirements, and approved procedures.
When to use it
For purchased software, SaaS, cloud services, foundation models, managed platforms, and material supplier changes.
- Defined service and release model
- Supplier quality, testing and security information
- Local responsibilities, configuration and evidence gaps
Field instructions
- Supplier and service: Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.
- Intended use supported: Describe the specific task, users, outputs and decisions supported. Identify the assessed environment and limits of reliance.
- Service and release model: Identify the authoritative change, affected configuration and dependencies. Trace the impact to approved use, controls, evidence and the local change/approval process.
- Lifecycle and quality evidence: Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
- Security and availability evidence: Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
- Test and defect evidence: Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
- Change notification: Identify the authoritative change, affected configuration and dependencies. Trace the impact to approved use, controls, evidence and the local change/approval process.
- Data and record responsibilities: Identify the required record context, history, identity and relationships. Explain how integrity, attribution and retrieval will be preserved and checked.
- Evidence limitations: State what is outside the assessed use or evidence. Explain the consequence and any restriction; do not treat missing information as a pass.
- Assessment conclusion and actions: Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.
Define the service and customer-controlled configuration.
Review evidence relevance, credibility, and coverage.
Record customer and supplier responsibilities.
Identify gaps that require contract, control, monitoring, or local testing.
Completed fictional example
Fictional teaching example; this is not an executed or approved validation record.
Blank template
System / record ID: ____________________
Prepared by / date: ____________________
Required review / approval under local procedure: ____________________
Relevant regulations and guidance
These sources apply within their stated scope. The suggested worksheet fields, test designs and fictional decisions are practitioner recommendations, unless a source requirement is expressly identified. Completing a template does not establish compliance.
Regulatory guidance / GMP guideline · United States · February 2026
Scope: Medical-device manufacturers assuring software used in production or their quality management system.
Relevance: For medical-device production or QMS software, supports selecting assurance activities from intended use, risk and available evidence. It is nonbinding guidance and does not determine other sectors’ obligations.
Status: Final / published · Checked 2026-09-21
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Read source details and applicability →Regulatory guidance / GMP guideline · European Union · January 2011 revision
Scope: Computerised systems supporting activities in the applicable EU pharmaceutical GMP context.
Relevance: For computerised systems used in EU GMP activities, informs lifecycle, supplier and record controls. Confirm applicability to the actual activity; the example does not establish it.
Status: Final / published · Checked 2026-09-21
The Commission index confirms the January 2011 operative revision. The linked PDF could not be retrieved in this check; retained detailed section mappings need review against an authorized copy.
Read source details and applicability →