USFDA Medical Devices Guidance: Computer Software Assurance for Production, Quality Management System Software & Cybersecurity, QMS Considerations and Content of Premarket Submissions

In February 2026, FDA issued an updated guidance titled Computer Software Assurance for Production and Quality Management System Software, superseding the September 2025 version. In parallel, FDA released an updated Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions guidance, reflecting the growing cyber risk associated with digital and connected medical technologies.

Together, these guidances signal a shift away from rigid, documentation-heavy validation toward a risk-based, least-burdensome, and lifecycle-focused regulatory approach.

Guidance: Computer Software Assurance for Production and Quality Management System Software What Is Computer Software Assurance?

Computer Software Assurance is defined as a risk-based approach to establishing and maintaining confidence that software performs as intended. Rather than validating every software function with the same level of rigor, CSA focuses effort where software failure could reasonably compromise product quality or patient safety.

Rather than treating all software the same, the guidance introduces a risk-based assurance model that focuses regulatory effort where software failure could meaningfully impact product quality or patient safety.

At its core, CSA is about building confidence that software is fit for its intended use.

The FDA makes it clear that not every software function requires the same level of testing or documentation. What matters is how the software is used, and what could happen if it fails.

The guidance applies to software used as part of:

• Production processes (for example, systems controlling manufacturing parameters), and

• The quality management system (such as software supporting CAPA, complaint handling, or batch release decisions).

A critical starting point under CSA is defining the intended use of the software. If a software function directly influences product acceptance, process control, or release decisions, it is considered high process risk. These functions require stronger assurance activities and more robust objective evidence. Conversely, software used for administrative tasks, reporting, or workflow management—where independent controls exist—may be classified as not-high process risk, allowing for lighter assurance activities.

Unlike traditional computer system validation, CSA allows manufacturers to use flexible testing approaches, including unscripted testing, exploratory testing, and automated testing, as long as the approach is scientifically justified. FDA also encourages reliance on digital evidence, such as system logs and automated test outputs, rather than excessive screenshots or paper documentation.

Importantly, CSA is not a one-time activity.

FDA expects manufacturers to maintain assurance throughout the software lifecycle, managing updates and changes using risk-based principles. This approach aligns with modern software development practices while maintaining compliance with quality system requirements. Guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions

While CSA focuses on confidence in understanding and controlling software behaviour, the FDA’s Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions guidance addresses a different but equally critical dimension—protection against cyber threats.

With increasing device connectivity, cybersecurity vulnerabilities can directly compromise device safety and performance. FDA therefore treats cybersecurity not as an IT concern, but as an integral part of the quality management system.

This guidance emphasises that cybersecurity risk management must span the entire device lifecycle, beginning at design and continuing through development, manufacturing, deployment, and post-market monitoring. Manufacturers are expected to identify potential threats, assess vulnerabilities, and implement controls to mitigate cyber risks in a systematic and documented manner.

For applicable premarket submissions, FDA expects manufacturers to include cybersecurity-related content such as:

• Threat modelling and risk assessments

• Secure software development practices

• Verification and validation of cybersecurity controls

• Plans for vulnerability monitoring, disclosure, and remediation after market entry

The guidance also reinforces the need for ongoing cybersecurity surveillance, recognising that new vulnerabilities can emerge long after a device is placed on the market. Manufacturers must therefore have processes in place to detect, assess, and respond to cybersecurity issues as part of their post-market quality system.

FDA’s updated guidances on Computer Software Assurance and Medical Device Cybersecurity represent a fundamental shift in regulatory thinking. By adopting a risk-based, least-burdensome, and lifecycle-focused approach, FDA is enabling manufacturers to modernise their software practices without compromising quality or patient safety.