In February 2026, the FDA released updated guidance Computer Software Assurance for Production and Quality Management System Software. It covers software used in medical device production or a related quality management system (QMS).
The guidance is available on the FDA website.
Computer software assurance approach
The guidance focuses on using the least burdensome approach to software validation.
This highlights a recurring problem we see in our advisory work. Some manufacturers investing unnecessary effort, treating all software at the same risk level. This misplaces focus away from higher-risk software, creating potentially higher device safety and security risk.
Manufacturers do not have to use the same processes for computer software assurance as used to validate medical device software.
Processes to consider
However, that does not mean no process. Manufacturers should consider several processes when applying the guidance:
Software development and deployment. The recommendation is to prevent defects during software development. Manufacturers should not rely on testing alone. This suggests that a development process should be in place for manufacturers doing their own development. However, it does not need to be the same process used for medical device software. Nor does it need to follow the same standards.
Software purchasing. Section V.A(5) recommends a risk-based review of software vendors if manufacturers use outside software. This suggests that the purchasing process covers software within the scope of this guidance. Manufacturers may need to update an existing process or create one if none exists.
Risk management. The guidance calls for a risk-based approach to software assurance. Manufacturers should:
- Identify software failures that could reasonably occur.
- Decide whether those failures pose a high process risk.
- Select assurance activities based on the level of risk to the medical device or process.
The FDA uses the word “systematically.” This implies that a defined risk management process is in place.
The guidance also states this risk analysis is different from ISO 14971:2019 medical device risk analysis. Manufacturers should keep this distinction clear in their processes.
See Section V.A, subsections (1), (2), and (5).
Configuration management and control. The word “configuration” appears about ten times in the guidance. Section V also states that software used in production or QMSs should remain under control throughout its life cycle. The FDA calls this maintaining a “validated state.” This implies manufacturers have processes to control the software and any changes. Configuration management and configuration control are therefore key parts of computer software assurance.
Problem reporting. Manufacturers usually have a process to investigate and resolve medical device or QMS problems. This process should also cover production and QMS software as part of the analysis.
The computer software assurance process itself. Manufacturers should document how they carry out computer software assurance. They also need to keep appropriate records (see Section V.A(6) for more information on records).
Recap
The main point is that the FDA supports a less burdensome approach. However, this does not mean working without defined processes. Manufacturers should use processes and records that fit intended use and risks.
