CSA and QMSR for medical device manufacturers: what changed

What CSA covers, and what it does not

The CSA guidance applies to software used as part of production or the quality system: the eQMS, a manufacturing execution system, an automated test station, a complaint handling tool. It does not apply to software in or as a medical device, which follows design control and its own guidance.

That distinction matters, because some teams have read CSA as permission to reduce testing of device software. It is not.

The core idea

CSA asks one question first: does this software feature, if it fails, create a high process risk, meaning it could lead to a quality problem that compromises safety? Features that could are tested with more rigour and more documentation. Features that could not are tested more lightly, often with unscripted or ad hoc testing and a short record of what was done.

The guidance is explicit that the value lies in the testing, not in the paperwork, and that records should be proportionate to the risk.

What changes under QMSR

QMSR incorporates ISO 13485:2016 by reference. For software validation, ISO 13485 already requires validation of software used in the quality management system and in production, proportionate to risk. The direction of travel is consistent with CSA, so the two fit together rather than pulling in different ways.

The practical effect for many companies is a procedure update: one approach to software assurance that satisfies both, rather than separate FDA and ISO streams.

Where teams go wrong

• Applying CSA to device software, where design controls still apply in full.
• Rating everything as high risk to be safe, which recreates the old paperwork under a new name.
• Dropping documentation entirely for low-risk features, when a short record of what was tested and by whom is still expected.
• Leaving old SOPs in place that contradict the new approach, so auditors find two conflicting rules.

What a CSA record looks like

A common question is what documentation is still needed. For a high-risk feature, much the same as before: a defined test, expected results, actual results, evidence and sign-off. For a lower-risk feature tested with unscripted or exploratory methods, the guidance suggests a short record: what was tested, the intended use, the testing approach, the date, who did it, any issues found and the conclusion.

That record can be a few lines. What matters is that it exists, that it is honest about what was done, and that the risk rating behind it is recorded and justified.

A sensible way to adopt it

Pick one system that is due for an upgrade or a periodic review. Assess each feature for process risk, apply the lighter approach where it fits, and record the reasoning. Use that as the worked example for your updated procedure. For the practical side, see the CSV to CSA transition plan, unscripted testing under CSA and defending CSA to an inspector. Our work with device makers is on the medical devices page.