What computer system validation is
Computer system validation (CSV) is the documented evidence that a computerized system used in GMP work does what it is intended to do, consistently, and protects the data it handles. It applies to manufacturing execution systems, LIMS, chromatography data systems, ERP modules used for GMP, QMS software, building management systems, spreadsheets used for GMP calculations, and, increasingly, cloud and AI-based tools.
The requirement comes from several places:
- 21 CFR 211.68 requires appropriate controls over computer and related systems, including restricting changes to authorized personnel and maintaining a backup of data entered (211.68(b)).
- 21 CFR Part 11 requires, for electronic records, “validation of systems to ensure accuracy, reliability, consistent intended performance” (11.10(a)), plus audit trails, authority checks and signature controls.
- EU GMP Annex 11 covers computerized systems. EU Annex 15 states that “computerised systems used for the manufacture of medicinal products should also be validated” according to Annex 11.
- Medical devices: since February 2, 2026, the QMSR incorporates ISO 13485:2016, which requires validation of computer software used in the QMS and in production.
For what GMP and GxP software must do and where automation fits, see GMP and GxP Software: Validation, Data Integrity and Automation in 2026.
Why the approach is changing
For two decades, CSV was often synonymous with heavy documentation: long scripted test protocols, screenshots of every step, and validation packages larger than the systems’ user manuals. Regulators and industry have spent the last few years moving away from that.
GAMP 5 Second Edition (July 2022)
ISPE published the second edition of GAMP 5 in July 2022. According to a summary in European Pharmaceutical Review by GAMP committee members, it puts “critical thinking” at the center (Appendix M12), supports agile and iterative development alongside the V-model, and recognizes exploratory, ad hoc and “day-in-the-life” testing with less documentation. ISPE says the new edition also reflects the increased importance of service providers and expands the appendices to cover topics such as AI and machine learning, cloud computing, blockchain and open-source software (ISPE).
The core message: validation effort should be proportionate to risk, and testing that does not reduce risk does not need to be done just to fill a binder.
FDA’s Computer Software Assurance guidance (September 2025)
On September 23, 2025, FDA issued final guidance, Computer Software Assurance for Production and Quality System Software. As RQA reports, it introduces “a risk-based approach to validate software” and supersedes Section 6 of FDA’s long-standing General Principles of Software Validation guidance. The steps: identify intended use, assess risk, choose proportionate assurance activities, and keep objective evidence.
Two points matter for scope:
- The guidance was written for medical device production and quality system software. Drug manufacturers are not formally bound by it.
- Many drug manufacturers still use it as a reference, because its risk-based logic aligns with GAMP 5 Second Edition and with how FDA’s drug investigators approach computerized systems. Its use for drug systems should be justified in your own validation policy.
EU Annex 11 revision
A revised Annex 11 went to public consultation from July 7 to October 7, 2025, alongside a new Annex 22 on AI. The draft expands requirements on audit trail review, including that it “should be conducted prior to batch release” for release-relevant data unless justified, and encourages tools to support audit trail review. The final text has not yet been published.
The risk-based validation lifecycle
Whatever framework you follow, a defensible lifecycle has the same parts.
| Phase | Activities | Key deliverables |
|---|---|---|
| Plan | Define intended use, GxP relevance, data criticality, supplier role | System inventory entry, validation plan |
| Specify | Requirements tied to intended use and regulatory needs (Part 11, Annex 11) | User requirements |
| Assess risk | Identify functions that could affect patient safety, product quality or data integrity | Risk assessment |
| Assure | Test high-risk functions rigorously (scripted, negative tests); use lighter methods for lower-risk ones; leverage supplier testing where justified | Test records, supplier assessment |
| Report | Summarize evidence and confirm fitness for intended use | Validation report |
| Operate | Change control, periodic review, access reviews, backup and restore testing, audit trail review | Periodic review reports |
| Retire | Data migration or archiving, with integrity checks | Retirement report |
The operate phase is where most findings now come from. A system validated in 2019 and never periodically reviewed is not in a validated state in 2026.
What FDA cites
- Laboratorios Jaloma, May 22, 2026. According to ECA’s summary of the warning letter, FDA cited 211.68(a) after finding a gas chromatograph whose “control system was not validated,” whose “audit trail was not activated,” and whose file creation and modification dates were inaccurate. Several data files could not be found.
- FY2025 Form 483 data. Section 211.68(b) was cited 87 times in FY2025, according to GMP Insiders’ analysis of FDA data.
- Data integrity guidance. FDA’s data integrity Q&A states that “when generated to satisfy a CGMP requirement, all data become a CGMP record,” which is why unvalidated systems generating GMP data are a finding even when the product is fine.
Common patterns: standalone lab instruments with audit trails off, shared logins, no backup or restore testing, spreadsheets used for release calculations without validation, and system changes outside change control.
CSV for AI and cloud systems
Two newer areas need extra care.
Cloud and SaaS. The supplier runs the infrastructure and releases updates on its own schedule. Validation depends on a strong supplier assessment, a clear quality agreement, and a process to assess each release before it reaches production use.
AI. Draft EU Annex 22 limits AI in critical GMP applications to static, deterministic models and says generative AI and large language models should not be used in critical applications. In non-critical uses, it expects a human in the loop. Validation for AI tools should define the intended use narrowly, measure performance against the process being replaced, and keep model versions under change control.
Computer system validation checklist
- System inventory lists every GxP system with its risk classification
- Intended use and data criticality documented for each system
- Requirements cover Part 11 / Annex 11 controls where applicable
- Risk assessment drives the depth of testing
- High-risk functions tested, including negative tests
- Supplier assessment supports any reliance on supplier testing
- Audit trails enabled and reviewed
- Unique user accounts; access reviewed periodically
- Backup and restore tested
- Changes controlled and assessed for validation impact
- Periodic review performed on schedule
Check your validation records with AskDona
Validation packages are long, and gaps hide between documents: a requirement with no test, a high-risk function tested only with a happy path, a periodic review that is two years late. AskDona reads validation plans, requirements, risk assessments, test records and SOPs, checks them against Part 11, 211.68, Annex 11 and your policy, and links each finding to the page it came from. Run a sample validation file assessment on one of your system validation packages. AskDona shows the evidence; your quality unit decides.
FAQ
What is computer system validation? Documented evidence that a GMP computerized system is fit for its intended use and protects data integrity, maintained across its lifecycle.
What is the difference between CSV and CSA? CSA (computer software assurance) is a risk-based approach to CSV that focuses testing on high-risk functions and reduces unnecessary documentation. FDA’s 2025 CSA guidance is written for medical device manufacturers.
Is GAMP 5 mandatory? No. It is industry guidance from ISPE, widely used as a framework to meet regulatory requirements.
Do spreadsheets need validation? Yes, if they are used for GMP calculations or decisions. The effort should match the risk.
How often should validated systems be reviewed? At a defined frequency based on risk, set in your procedures. Annex 11 section 11 says systems “should be periodically evaluated to confirm that they remain in a valid state.”
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| 21 CFR Part 211 (eCFR) | US regulation | 211.68 |
| 21 CFR Part 11 (eCFR) | US regulation | 11.10(a) validation |
| EU GMP Annex 11: Computerised Systems (2011) | EU GMP guideline | Sections 4, 9, 10, 11 (periodic evaluation) |
| EU GMP Annex 15 (2015) | EU GMP guideline | Computerized systems must be validated |
| RQA, FDA issues final guidance on Computer Software Assurance | Professional association news | CSA date, scope, supersession |
| European Pharmaceutical Review, GAMP 5 update | Trade journal (GAMP committee authors) | GAMP 5 Second Edition changes |
| ISPE, GAMP 5 Guide, 2nd Edition | Publisher | Expanded appendices (AI/ML, cloud), service providers |
| Draft revised Annex 11 (2025 consultation) | EU draft guideline | Audit trail review |
| Draft Annex 22 (2025 consultation) | EU draft guideline | AI scope |
| EC consultation page | EU consultation page | Consultation dates |
| ECA, Equipment qualification, CSV and audit trail in an FDA warning letter | Industry news | Jaloma warning letter |
| GMP Insiders, FY2025 FDA inspection observations | Industry analysis of FDA data | 211.68(b) citation count |
| FDA, Data Integrity and Compliance With Drug CGMP: Q&A | FDA guidance | All data become CGMP records |
| NAMSA, Industry Update: QMSR | CRO / consultancy article | QMSR effective date |