GxP Copilot · Risk-based, least-burdensome

Test what matters. Prove what regulators actually asked for.

Built CSA-first: real per-requirement risk drives the test strategy, not the category label alone. You get a defensible reduction in low-value scripted testing and a validation posture that matches the direction the FDA is signalling.

Quick chat on WhatsAppPart of GxP Copilot

Anchored to requirementsLinked as it is drafted

Human reviewBefore anything is approved

In short

Computer Software Assurance sizes validation effort to the consequence of failure rather than applying uniform depth. GxP Copilot implements it per requirement: assess what happens if it fails, choose scripted testing, unscripted testing or assessed supplier evidence accordingly, and record the rationale — so the reduction is defensible rather than merely smaller.

The problem

CSA adopted on paper, not in practice

Most organisations that say they have moved to CSA have updated a policy and nothing else. The validation SOP still mandates scripted testing, the protocol templates only accommodate scripted steps, and QA has not agreed what an acceptable rationale looks like.

So teams keep scripting everything, now with a CSA heading on the document. The effort is unchanged and the organisation concludes CSA does not work, when what did not work was changing the words without changing the machinery.

The opposite failure is rarer but worse: testing reduced because CSA permits it, with no documented reasoning. That is not CSA, it is under-testing with a justification borrowed from a guidance document.

How GxP Copilot handles it

Per requirement, not per system

CSA is applied where the decision actually lives — at the individual requirement. Each one is assessed for the consequence of failure and whether a failure would be detected downstream, and that assessment determines its assurance activity.

A system is not high risk or low risk. It is a collection of requirements with very different consequences, and treating it as a single risk level is what produces uniform depth in the first place.

High riskFailure could affect patient safety or product quality

Scripted testingWritten steps, expected results, an independent reviewer

Step-by-step results, screenshots and signatures

Medium riskFailure is noticed and contained

Unscripted testingExploratory or ad-hoc testing against the intended use

A record of what was tested, by whom, and the result

Low riskStandard function, supplier-tested

Supplier evidenceThe vendor’s own testing, assessed and accepted

The assessment and the reason it is enough

Computer Software Assurance in one picture: test effort follows the risk of each requirement. Based on FDA’s Computer Software Assurance guidance.

Three activities, honestly matched

Scripted testing with full evidence where failure would reach a patient or corrupt a record. Unscripted testing with a session record — tester, scope, duration, findings — where it would not. Assessed supplier evidence where the vendor has tested it and you have a current assessment saying what you rely on.

Defects found during unscripted testing are still defects and still get recorded and resolved. Unscripted does not mean uncontrolled; it means the steps were not written in advance.

The rationale travels with the decision

The reason a requirement received the depth it did is captured when the decision is made, not reconstructed when someone asks. A rationale written after an audit question reads exactly like one.

That record is what gets the reduction through QA approval, and what makes it survivable at inspection. FDA finalised the CSA guidance on 24 September 2025 after three years in draft, so the approach is now settled rather than provisional.

Deliverables

What you get

Assurance activity chosen per requirement, driven by consequence of failure

Scripted, unscripted and supplier-evidence paths all supported with appropriate records

Session records for unscripted testing capturing tester, scope, duration and findings

Rationale captured at the moment of decision, not reconstructed afterwards

A reduction in effort that an approver and an inspector can both follow

Summary

What CSA Validation delivers

CSA Validation is part of the GxP Copilot platform — an AI-native, CSA-first validation system built for regulated Life Sciences. See how it fits with AI Classification Engine, Risk-Based Validation Scoping, AI Risk Assessment.

Computer Software AssuranceCSACSA validationFDA CSA guidance

FDA CSA-aligned test-strategy selection
Unscripted / exploratory support
Vendor-evidence as a first-class path
Effort scales to risk, not category alone

FAQ

Common questions

Prefer to talk first? Chat with us on WhatsApp or book a call with an expert.

Chat on WhatsApp Talk to an expert

Is FDA's CSA guidance final?

Yes. It was issued as a draft in September 2022 and finalised in September 2025 and reissued in February 2026, superseding the draft. It applies to computers and automated data processing systems used as part of production or the quality system, and it is now a settled position rather than a provisional one.

Does CSA mean we document less?

It means you test some requirements less deeply, with a recorded reason. The lifecycle documentation is unchanged — you still need a plan, requirements, risk assessment, protocols, executed records, a traceability matrix and a summary report. Teams expecting CSA alone to halve their documentation effort are usually disappointed.

What does unscripted testing need to produce?

A session record naming the tester, the scope covered, how long it took and what was found. Findings are recorded and resolved exactly as they would be from a scripted test. The difference is that the steps were not written in advance, not that the testing was informal or unevidenced.

Related capabilities

All capabilities

AI Classification Engine

A guided intake — accelerated by AI, decided by your team — produces GxP impact, GAMP category and composite risk, along with the exact reasoning behind each result. Instead of week-long assessments, you get a classification you can defend to an inspector on the same day. The AI accelerates the input; the classification itself is transparent and controlled.

Learn more about AI Classification Engine Risk-Based Validation Scoping

The Strategy Engine picks the applicable deliverable set for each GAMP category and scales test rigor to per-requirement risk under CSA — choosing between scripted testing, unscripted verification, and leveraged supplier evidence. The output is a validation plan sized to reality, easy to defend, and quick to execute.

Learn more about Risk-Based Validation Scoping AI Risk Assessment

Every requirement is scored against an ICH Q9 lens for severity, probability and detectability. That score drives the test strategy, the traceability coverage and the inspection-readiness view — so risk stops being a compliance formality and starts sizing your actual work.

Learn more about AI Risk Assessment Document Control & Versioning

Every document version is fingerprinted and tagged with its provenance and any AI assistance used. Data-driven sections stay canonical across every deliverable — so what you sign is what you keep, and what you keep is what you show an auditor.

Learn more about Document Control & Versioning AI Validation Document Drafting

The Documentation Engine drafts your validation deliverables in the style of the templates your organisation already uses — with confidence checks, review gates, and a fully functional fallback when the AI is unavailable. Your team stays in control; the platform removes the drudge work.

Learn more about AI Validation Document Drafting Live Traceability Matrix

The Live RTM is always up to date — coverage gaps, orphan tests and inspection-readiness are computed on the fly from the links between requirements, design, tests and results. No more spreadsheet upkeep, no more RTM-freshness debates before an audit.

Learn more about Live Traceability Matrix