Paperless validation: risk-based assurance with records you can show
Classify each software feature by process risk, pick the lightest assurance that gives real evidence, and keep it in a trustworthy record.
In Short
- CSA final guidance: 3 Feb 2026.
- Effort follows process risk.
- Part 11 still governs the record.
Electronic Records & Inspection Readiness Buyer Guide
For quality, regulatory, validation and IT teams evaluating electronic records, signatures and inspection readiness. Use it with or without V5.
- See what a signature must show.
- Check corrections keep the original.
- Know where Part 11 applies.
We ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
Electronic Records & Inspection Readiness Buyer Guide
For quality, regulatory, validation and IT teams evaluating electronic records, signatures and inspection readiness. Use it with or without V5.
Paperless validation means planning, executing and approving software assurance in electronic records instead of signed paper protocols. FDA's final guidance Computer Software Assurance for Production and Quality Management System Software (issued 3 February 2026, superseding the September 2025 version) describes a risk-based approach for device manufacturers; 21 CFR Part 11 still sets the controls for the electronic records and signatures you keep. GAMP 5 itself was not opened for this review. This guide summarises the sources named here; it is orientation, not legal advice. Sources checked 5 Oct 2026.
What the February 2026 CSA guidance covers
The guidance applies to computers and automated data processing systems used as part of medical device production or the quality management system. It describes a risk-based approach to establish confidence in that automation, identify where extra rigour is appropriate and choose assurance activities.
More on what the February 2026 CSA guidance covers
It is nonbinding and written for device makers under 21 CFR Part 820, although drug and other GxP teams often borrow its logic. It does not change Part 11. Treat it as a way to spend effort where failure matters, not as permission to skip records.
High process risk versus not high process risk
FDA describes a software feature as high process risk when its failure to perform as intended may result in a quality problem that foreseeably compromises safety. Examples include software that maintains process parameters essential to device safety, or that determines product acceptability with limited or no additional human review.
Process Risk: Three Example Features
Choose a feature to see how a team might reason about it.
- Failure could foreseeably compromise device safety.
- Scripted testing with expected results.
- Quality approves the rationale.
More on high process risk versus not high process risk
Features used for CAPA routing, complaint logging, change control or procedure management are given as examples that generally are not high process risk. Your team records the reasoning for each feature; the classification is a documented judgement, not a vendor label.
Choosing Assurance Activities
For lower-risk features the guidance points to less burdensome methods such as unscripted or exploratory testing, supported by a record of what was tested, by whom, when and with what result. Scripted testing with predefined steps and expected results fits high process risk features.
More on choosing Assurance Activities
Vendor documentation and existing evidence can be used where appropriate. The aim is enough objective evidence to show the feature works as intended for its use, captured once, in a form a reviewer can follow without a stack of signed screenshots.
Part 11 controls that still apply to the electronic record
Where the validation records themselves are required records kept electronically, Part 11 applies. Section 11.10 asks for validation of the system holding them, accurate and complete copies for inspection, protected retrieval through the retention period, access limited to authorised people, and secure computer-generated time-stamped audit trails that do not obscure earlier entries.
More on part 11 controls that still apply to the electronic record
Electronic signatures need the controls in subparts B and C. A paperless approach therefore depends on the record system being trustworthy first, before any protocol moves out of paper.
Moving One System off Paper
Start with a single system that is due for change. List its features, record a risk rationale for each, and decide the assurance method per feature.
Worked Example: System LIMS-7 Moved off Paper
| Feature | Risk rationale | Assurance |
|---|---|---|
| Result entry and calculation | Feeds batch disposition | Scripted tests, expected values |
| Sample label printing | Errors caught at receipt check | Unscripted test, recorded |
| Report formatting | No effect on product quality | Vendor evidence plus spot check |
- Result entry and calculation
- Risk rationale
- Feeds batch disposition
- Assurance
- Scripted tests, expected values
- Sample label printing
- Risk rationale
- Errors caught at receipt check
- Assurance
- Unscripted test, recorded
- Report formatting
- Risk rationale
- No effect on product quality
- Assurance
- Vendor evidence plus spot check
More on moving One System off Paper
Execute tests directly in a controlled electronic record, attach evidence, route deviations into your normal deviation or CAPA process, and have the system owner and quality approve with electronic signatures. Review the result after the first change cycle and adjust templates. People own each decision; the record shows who decided what and why.
Questions
Does the CSA guidance replace computer system validation?
No. It is FDA's current thinking on how to establish confidence in production and quality system software proportionately; validation obligations in the regulations remain.
Which version of the CSA guidance is current?
The final guidance issued 3 February 2026. FDA states it supersedes the final guidance issued on 24 September 2025.
Is unscripted testing acceptable evidence?
The guidance describes unscripted and exploratory testing as appropriate for features that are not high process risk, provided the record shows what was done, the result and who did it.
Does Part 11 apply to electronic validation records?
Where those records are required by FDA regulations and kept electronically, Part 11 applies, including system validation, access control and audit trails under section 11.10.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
Keep reading
FDA Form 483 & Warning Letter Response Playbook
IQ, OQ, PQ and Process Validation Guide: FDA Stages and EU Annex 15
Medical Device Packaging Validation: Planning and Evidence
Microbiome & Postbiotic Supplement Formulation Playbook
Product Recall Response Timeline and Coordination Playbook
Sports Nutrition Dosage Forms: Protein, EAA and Creatine