It's worth making the switch now
The FDA CSA Guidance is final (2025, updated in 2026), and as of February 2026, the QMSR refers to ISO 13485. The uniform, risk-based validation approach is now in place.
Risk-Based Approach GAMP 5 · ISO 13485 Part 11 · QMSR · EU & FDA
Risk-Based Software Validation for Medical Devices
We validate computer-based systems as well as process, QM, and tool software using a risk-based approach: The effort is limited to what is truly necessary for the validation documentation—in accordance with ISO 13485, GAMP 5, and FDA computer software assurance (CSA). Lean, audit-ready, and maintained in a validated state.
25+
Years of Regulatory Experience
50+
Compliance Experts
EU + FDA
All from a Single Source
CSA + GAMP 5
Validated on a Risk-Based Approach
What It's All About
Validation with a Sense of Proportion—Lean Instead of a Mountain of Documents
Metecon takes a risk-based approach to the validation of computer-based systems: Instead of generating mountains of documentation, we determine the necessary scope of the validation for each system and the tools to be used, based on risk and usage and in accordance with computer software assurance (CSA), GAMP 5 (2nd Ed.), and ISO 13485. This ensures that process, QM, and tool software remain in a validated state—ready for audits by Notified Bodies and the FDA—and that effort is expended only where it is truly necessary for creating validation records.
Intended for: QM Management / QMR, validation and CSV managers, and the Head of Regulatory Affairs—as well as Quality IT, production/process managers, and executives at smaller manufacturers.
"Software validation rarely fails due to a lack of commitment, but rather due to a lack of focus: We validate in a risk-based manner—effort is directed to where it is truly necessary for validation documentation. This ensures that process, QM, and tool software validation remain streamlined, audit-ready, and manageable."
– Thorsten Stumpf · Principal Expert Software & AI · RAC Devices · Metecon GmbH
CSA & GAMP 5 • ISO 13485 · Part 11 • EU & FDA
Typical Challenges
Three Problems Caused by Traditional CSV
Mountains of documents with no added value
CSV with the wrong priorities ties up resources and delays releases without any discernible improvement in quality.
Unclear Scope of Validation
Which systems and tools need to be validated, and to which extent? This results in audit nonconformities with ISO 13485 clauses 4.1.6, 7.5.6, and 7.6.
Cloud/SaaS Not Under Control
Frequent updates and SaaS releases make it nearly impossible to maintain a validated state.
Classification at a Glance
What Needs to Be Validated—and to Which Extent
scope, risk-based approach, and regulatory framework—clearly organized
Scope of Application
Risk-Based Approach
Standards & QMSR
Scope: What Needs to Be Validated?
Software that affects product quality, safety, or the effectiveness of the QMS must be validated; the medical device software itself does not need to be validated.
Process & Production Software
software used in quality management processes and in production (ISO 13485, clause 7.5.6).
Quality Management Software
software that is used in the quality management system (ISO 13485, clause 4.1.6).
Monitoring & Measuring Equipment Software
software that is used for monitoring or measuring (ISO 13485, clause 7.6).
Important for Clarification
- This refers to non-product software—not medical device software (IEC 62304/82304-1)
- Triggers include impacts on product quality, data integrity, or QMS effectiveness
Software Validation: A Risk-Based Approach
Software validation requires critical thinking and consideration of software risks in order to produce lean documentation:
Testing what matters—rather than testing every feature of the software in question, even those that are irrelevant.
Critical Thinking
Determine the scope of validation based on the intended purpose and risk, not on the software's full range of functions.
Risk-Based Testing
High testing effort for high risk; low testing effort for lower risk.
Supplier Leverage
Use supplier documentation. Suppliers who provide documentation tailored to your needs reduce the testing burden.
Relevant Fundamentals
- FDA Computer Software Assurance (final 2025, updated 2026)
- 21 CFR Part 11
- GAMP 5 (2nd Ed.): risk-based categories, critical thinking, supplier leverage
Standards & QMSR
Validation is required multiple times in ISO 13485; ISO/TR 80002-2 and GAMP 5 specify concrete procedural models. With the QMSR, the EU and the FDA are moving closer together in terms of regulation.
ISO 13485 & ISO/TR 80002-2
Clauses 4.1.6, 7.5.6, and 7.6 require validation; ISO/TR 80002-2 and AAMI TIR36 provide best practices.
QMSR & Part 11
Since February 2026, 21 CFR Part 820 (QMSR) has referenced ISO 13485:2016—consistent with Part 11.
Relevant Fundamentals
- ISO 13485:2016 clauses 4.1.6 / 7.5.6 / 7.6 · ISO/TR 80002-2 · AAMI TIR36
- GAMP 5 (2nd Ed.) · FDA CSA · 21 CFR Part 11 · QMSR (Part 820 → ISO 13485) · Data Integrity (ALCOA+)
Risk-based does not mean negligent
ISO/TR 80002-2 is a best practice standard (not harmonized); audits are conducted against ISO 13485, clauses 4.1.6, 7.5.6, 7.6.
Software Validation Throughout the Product Life Cycle
From inventory to validated status
1
System Inventory
Software used in processes, in quality management, or as a tool (e.g., in product development or product V&V) must be documented.
2
Intended Purpose & Risk
The risk associated with each identified software for the use case must be determined—this determines the scope of validation for the corresponding software.
3
Manufacturer Information
Review and use of supporting documentation provided by the manufacturer.
4
Validation Plan, Testing, and Verification
Scope, test methodology (scripted vs. unscripted), risk-based testing, and transparent documentation of results.
5
Report & Approval
Document validation reports and approvals in an audit-proof manner (ISO 13485, QMSR). Approvals with restrictions are also possible.
6
Changes & Validated Status
Evaluate updates and patches and maintain the system in a validated state. If necessary, perform the checks specified in the validation plan.
Effort where it counts
We focus the depth and documentation - using a risk-based approch - on the key system characteristics and we use supplier documentation—this makes validation streamlined, fast, and still audit-ready.
Why Metecon
Validation Expertise that Meets Industry Benchmarks
Risk-Based Scope
Scope of validation per system according to ISO/TR 80002-2, AAMI TIR 36, and GAMP 5 categories. Lean but robust.
Plans & Reports: Audit-Ready
Validation plans and reports that successfully pass NB and FDA audits (ISO 13485, 21 CFR Part 11).
Supplier Leverage
Make strategic use of supplier documentation—less duplication of dffort, less work.
Tool & Process Validation
Validate test tools, measuring equipment, and processes (ISO 13485, 7.5.6, 7.6) – with clear justification.
EU & FDA from a Single Source
Considering ISO 13485, 4.1.6, 7.5.6, 7.6, and QMSR+Part 11 together—an approach for both markets.
Risk-based According to CSA ISO/TR 80002-2 AAMI TIR36 and GAMP 5
We translate complex regulations into actionable strategies. Our benchmarks are modeled after the strengths of leading providers: lean, risk-based validation, audit-ready documentation, and software/process validation.
Metecon meets these criteria and integrates them with product documentation and quality management.
Overlaps with Software Documentation & QMS
Software validation overlaps with quality management and the software life cycle. We cover these related topics on separate pages and link them together to form a coherent evidence structure.
What We Specifically Offer
Overview of Software Validation Services
GAP Analysis of Existing Validation
Review of existing validations and corresponding SOPs for gaps and suitability. Include a pragmatic roadmap for implementation.
Establishing a Validation Process & SOP
Establishing a streamlined, risk-based software validation process or optimizing an existing one.
System Inventory & Risk-Based Validation Approach
Identifying systems, determining their intended purpose and risks, and defining the scope of validation.
Requirements & Specifications
Clearly specifying the requirements (user/functional requirements) for each system—the foundation for targeted, risk-based testing.
Support for Conducting Software Validation
Validating test tools and measuring equipment software—with audit-ready justification.
Support for Software Change Assessment in the Context of Existing Validation
Risk assessment of the change, approval of the change, and assistance in determining and carrying out the necessary validation.
Workshops & Training Sessions
In-house training courses on CSV, CSA, GAMP 5, ISO/TR 80002-2, AAMI TIR36, and Part 11 for QM, RA, and IT.
Software Validation to Support IVD Products
The same risk-based validation strategy also applies to IVD manufacturers under the IVDR.
Clearly separate from Product Validation
Software validation applies to software that is not part of the medical device. We cover the validation of the medical device software itself on the V&V page.
Delimitation
Software Validation vs. Medical Device Software Validation
Software Validation
validation of non-product software: process, quality management, tooling, and measurement equipment software
Basis:
ISO 13485 clauses 4.1.6/7.5.6/7.6, ISO/TR 80002-2, GAMP 5, FDA CSA, Part 11.
Validation of Medical Device Software
verification and validation of the medical device software itself (IEC 82304-1) and of the product’s technical compliance.
The two are intertwined
Tools used in product development (e.g., testing tools) fall under software validation; testing of the medical device itself is part of V&V. We ensure consistency between these two areas of evidence.
Interfaces
What Software Validation Is Interrelated With
Quality Management
Software validation is a QM discipline defined in ISO 13485 and is an integral part of the QMS.
Risk Management
risk-based scope of validation, integrated with product risk management (ISO 14971)
Thorsten Stumpf
Principal Expert Software & AI · RAC Devices · Metecon GmbHThorsten Stumpf and the Metecon team implement a risk-based approach to software validation. This covers everything from system inventory and risk assessment to validation plans and testing, through to software release and maintaining the validated state, for both EU and international markets.
Frequently Asked Questions About Software Validation
Which software do I actually need to validate—and which not?
Software must be validated in QM-relevant processes, in production, or when used as a monitoring tool, measuring instrument, or testing tool that affects product quality, data integrity, or the effectiveness of the QMS (ISO 13485, 4.1.6 / 7.5.6 / 7.6). Medical device software itself is validated together with the medical device or as a standalone medical device—see the V&V section and the MDSW section for more details.
How do I determine the risk-based scope of validation (CSA instead of CSV)?
Regarding the intended purpose and risk of the system in its context of use (usually a process context): High risk typically requires more extensive validation, while low risk requires less. Certain regulatory documents (including CSA and GAMP 5) provide the framework—efforts are focused where the software could negatively impact the medical device itself or the associated regulatory activities.
How does the FDA CSA Guidance differ from the traditional CSV?
The FDA computer software assurance (final 2025, updated 2026) outlines a risk-based approach incorporating critical thinking, which, in the FDA’s view, requires the least amount of effort. This allows validation to be tailored to the FDA’s requirements. CSV is also a risk-based approach used in the context of the requirements of ISO 13485.
How do I ensure that systems that have already been validated remain in a validated state after updates?
Through a defined process for releasing software after changes: Software updates are assessed on a risk-based basis prior to release; only the functions affected by the change are retested, and supporting documentation is updated accordingly. This ensures that the system remains in a validated state without having to completely revalidate every release.
How can I use supplier documentation to save time and effort?
By incorporating the software vendor’s development and test documentation into one’s own validation process (supplier leverage). For qualified suppliers, this significantly reduces the company’s own testing effort—CSA and GAMP 5 (2nd Ed.) explicitly provide for this.
What does the QMSR (Part 820 → ISO 13485) mean for my software validation?
Since February 2026, 21 CFR Part 820 (QMSR) has included ISO 13485:2016 by reference. This brings EU and FDA requirements for software validation closer together—a consistent, risk-based approach covers both areas.
How does software validation differ from the V&V of medical device software?
Software validation (CSV/CSA) applies to software that is not the product itself but has an impact in the regulatory context—software used in relevant processes, in essential quality management tasks, or as tools employed in product development, (V&V) or production. The verification and validation of the medical device software itself (IEC 62304, IEC 82304-1) is a separate discipline and is addressed separately.
How much does software validation cost at Metecon?
The effort involved depends on the risk associated with the systems in the intended application area, as well as on existing evidence supporting their safe and effective use (EU/FDA). During a free initial consultation, we will assess your case, prioritize it based on risk, and then provide a robust framework.
Implementing Lean Software Validation
Start with a free initial consultation. We’ll then prioritize based on risk, review supplier documentation, and outline your audit-ready validation approach. We turn complexity into clarity.
Your contact:
Milan Weiß
Sales Manager
T: +49 621 123469-040
milan.weiss@metecon.de
