FDA published the final computer software assurance guidance on September 24, 2025 under Docket FDA-2022-D-0795. It replaces Section 6 of the 2002 General Principles of Software Validation, the part covering automated process equipment and quality system software. The draft dated to September 13, 2022. The final version adds definitions, updates the testing examples and expands the scenarios in the appendix.
The method is risk-based. A manufacturer first asks whether the software is used directly in production or in the quality system, then whether a failure could compromise device safety or quality. High-risk uses get scripted testing and detailed records. Lower-risk uses can rest on unscripted or ad hoc testing, vendor documentation and prior use, with a short record of what was done and by whom.
The tools in scope at a startup are the eQMS, the requirements and test management system, the ERP, and any script driving a production test fixture. A one-page risk rationale per tool, kept current, costs far less than the full IQ, OQ and PQ binder that contract validators still sell by default.