CSV vs. CSA

CSV (Computerized System Validation) and CSA (Computer Software Assurance) are not an either-or: CSA does not replace CSV. The final FDA guidance (2025) merely supersedes Section 6 of the FDA guidance “General Principles of Software Validation” and takes over the field of production and QMS software; for software that is itself part of a medical device, that guidance continues to apply unchanged. In substance, “Assurance” is the more precisely named object of the same demonstration: the fitness of the software for the Intended Use defined in the process – and keeping that fitness across the lifecycle. CSA changes none of the obligations; which records must be kept still follows from the Predicate Rules. The risk-based foundation holds independently of CSA: ICH Q9 has made risk-based decision-making a systematic process since 2005, and the European GMP framework tied the scope and depth of validation to risk and use even before 2002. GAMP 5 is the industry methodology that helps with implementation – the guidance itself mentions GAMP exactly once, in a footnote on testing methods as one of several possible sources (“such as, but not limited to”), and does not require it.

See also: Computer Software Assurance (CSA), Computerized System Validation.