# Computer System Validation (CSV): Fundamentals, Regulatory Requirements and Validation of Cloud Software in the GxP Environment

> Computer system validation in GxP: Annex 11, 21 CFR Part 11, GAMP 5, CSA, the validation lifecycle, cloud and SaaS validation, pre-validated software and inspection findings. Status November 2026.

- Source: https://info-pharma.de/en/computer-system-validation/
- Language: English (UK)
- Last updated: 2026-11-06
- Section: Home › Regulatory Requirements › Computer System Validation
- Deutsche Fassung: https://info-pharma.de/computer-system-validation/index.html.md

---

*Status: 5 November 2026*

**Summary:** Computer system validation (CSV) is documented evidence that a computerised system is fit for its intended use and stays fit throughout its lifecycle. In the EU, the obligation follows from EudraLex Volume 4, Annex 11[1]. In the US, it follows from 21 CFR 11.10(a), among other provisions[2]. As of November 2026 the Annex 11 revision is still a draft. FDA's Computer Software Assurance (CSA) guidance has been final since September 2025. Cloud and SaaS vendors should deliver their systems pre-validated and share their IQ and OQ documentation with the user. Responsibility for the validated state in the user's own environment stays with the user.

## 1. What is computer system validation?

Under Annex 11, a computerised system must be validated. Where it replaces a manual process, product quality, process control and quality assurance must not decrease. Risk management applies throughout the lifecycle[1]. FDA defines software validation as confirmation by examination and the provision of objective evidence that software specifications conform to user needs and intended uses[5]. PIC/S sets out its expectations for computerised systems in PI 011[3].

CSV is mandatory in GxP environments for three reasons:

- **Data integrity:** data must be complete, consistent and accurate throughout its lifecycle[4].
- **Patient safety:** faulty systems can distort safety-relevant decisions.
- **Product quality:** release and manufacturing decisions rely on system-generated data.

**How the terms differ:**

- **Qualification** under EU GMP Annex 15 applies to equipment, infrastructure and system components. It is demonstrated in stages such as IQ, OQ and PQ[6].
- **Validation** shows that a process or system meets its requirements in actual use.
- **Verification**, in GAMP 5, means checking that individual specifications are met. It is one building block of validation[7].

For the wider GMP context see our article on [GMP](https://info-pharma.de/en/gmp/).

## 2. Regulatory framework

### EU GMP Annex 11 (2011) and the 2025 draft revision

The current Annex 11 has applied since 30 June 2011[1]. Three areas are central to CSV:

- **Suppliers (section 3):** where third parties are used, formal agreements with clear responsibilities are needed. Supplier competence and reliability are key factors. Whether an audit is needed depends on a risk assessment. The user must review the documentation supplied with commercial products.
- **Validation (section 4):** validation covers the relevant lifecycle steps and rests on a user requirements specification. The user should take reasonable steps to ensure the system was developed under an appropriate quality management system.
- **Periodic evaluation (section 11):** systems must be evaluated regularly to confirm they remain validated and GMP-compliant.

**Revision status:** the European Commission published a draft on 7 July 2025, together with a revised Chapter 4 and a new Annex 22 on artificial intelligence. The draft runs to 19 pages and 17 sections, including "Supplier and Service Management", "Periodic Review" and "Security"[8]. The consultation has closed[9]. On 5 November 2026 the EudraLex overview still lists Annex 11 as "revision January 2011". No final text or date of application has been published[6]. Everything this article says about the draft is therefore an expected direction, not a current requirement.

### 21 CFR Part 11 and other FDA requirements

21 CFR 11.10(a) requires systems to be validated to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records[2]. See [21 CFR Part 11](https://info-pharma.de/en/21-cfr-part-11/) for details.

For medical devices, the Quality Management System Regulation (QMSR) has applied since 2 February 2026. It incorporates ISO 13485:2016 by reference into 21 CFR 820. ISO 13485 clauses 4.1.6 and 7.5.6 require software validation proportionate to risk[10].

### ICH E6(R3) and the EMA guideline on computerised systems in clinical trials

The ICH E6(R3) principles and Annex 1 have applied in the EU since 23 July 2025, and Annex 2 applies from 15 January 2027[13][14]. E6(R3) gives data governance its own section 4. Under it, validation of computerised systems rests on a risk assessment (4.3), and the sponsor keeps a record of important systems with their validation status (3.16.1(x))[13]. EMA's Guideline on computerised systems and electronic data in clinical trials was published in March 2023 and has applied since September 2023. It sets out expectations on validation, responsibilities and service providers, explicitly including cloud solutions[15]. See also [GCP](https://info-pharma.de/en/gcp/).

### PIC/S and ISPE GAMP 5

PIC/S PI 041-1 on data management and integrity has been in force since 1 July 2021. Its section 9 covers computerised systems and refers to PI 011 for good practice[16][3]. ISPE GAMP 5 Second Edition (July 2022) keeps the risk-based framework. It stresses the role of service providers, iterative development and the "critical thinking" of experienced subject matter experts. It encourages regulated companies to involve suppliers as fully as possible so they can draw on supplier knowledge, experience and documentation[7].

### FDA Computer Software Assurance (CSA)

FDA finalised "Computer Software Assurance for Production and Quality System Software" in September 2025 and announced it in the Federal Register on 24 September 2025[11][12]. It supersedes section 6 of the "General Principles of Software Validation" and is formally addressed to medical device manufacturers[11]. In pharmaceutical practice it serves as orientation, not as a binding requirement.

## 3. The validation lifecycle

GAMP 5 sorts software into categories:

- Category 1: infrastructure software
- Category 3: non-configured products
- Category 4: configured products
- Category 5: custom applications

The higher the category and the risk, the more extensive the specification and testing[7]. The V-model pairs each specification level with a test level: URS with PQ/UAT, functional specification with OQ, design specification with IQ. GAMP 5 Second Edition stresses that the approach also supports iterative and agile development[7]. The draft Annex 11 requires documented traceability between requirements, specifications and test cases. Test cases that cannot be traced to a requirement do not meet the requirements for qualification and validation (9.5)[8].

**Phases of the CSV lifecycle**

| Phase | Purpose | Typical documents | Responsible |
| --- | --- | --- | --- |
| Validation planning | Define scope, strategy and roles | Validation plan | System owner, QA |
| Requirements | Describe intended use | User requirements specification (URS) | Process owners, users |
| Risk assessment | Scale testing to risk for patient, product and data | Risk assessment (e.g. FMEA) | System owner, QA, SMEs |
| Specification | Describe functions and configuration | Functional, design and configuration specifications | Supplier, IT, system owner |
| IQ | Show correct installation | IQ protocol and report | Supplier or IT |
| OQ | Show functions work as specified | OQ protocol and report | Supplier or user |
| PQ / UAT | Show fitness in the real process | PQ/UAT scripts and reports | User |
| Traceability | Link requirements to tests | Traceability matrix | Validation lead |
| Release | Confirm fitness for use | Validation report | System owner, QA |
| Operation | Maintain the validated state | Change control records, periodic review reports | System owner, QA |
| Retirement | Preserve data and readability | Retirement plan, migration and archiving records | System owner, QA, IT |

Annex 11 requires changes to be made in a controlled way (section 10) and systems to be evaluated periodically (section 11)[1]. Under the draft, the frequency of periodic review depends on risk, and a final review is required when a system is taken out of use (14.3)[8].

## 4. CSV and CSA: what changes in practice

CSA does not replace the duty to validate, but it shifts the emphasis:

- The starting points are the intended use and whether a software feature carries "high process risk" or not.
- That decides how much assurance is needed. For lower-risk features, unscripted methods such as ad hoc, exploratory or error-guessing testing are explicitly acceptable. Scripted testing concentrates on high-risk features.
- Records should be no more extensive than necessary and may be kept digitally[11].

GAMP 5 Second Edition takes the same approach and puts experienced experts' critical thinking ahead of the sheer volume of test documentation[7]. For users, this means fewer screenshots for low-risk functions. In return, risk rationales must be documented clearly, and test effort concentrates on functions that underpin data integrity and product quality.

## 5. Validating cloud and SaaS software

**Shared responsibility:** the vendor is responsible for development, infrastructure, release testing and operation. The user is responsible for intended use, configuration, PQ/UAT, processes and user management. The draft Annex 11 makes clear that the regulated user stays fully responsible when relying on a vendor's qualification or operation (7.1). For SaaS, the vendor may supply the requirements specification, but the user must review, approve and take ownership of it (6.3)[8].

**Supplier assessment and audit:** depending on risk and criticality, the user should run an audit or a thorough assessment. It should establish whether the vendor's procedures and documentation are adequate and whether they can be leveraged instead of repeating the activities (7.2)[8].

**Quality agreement:** the draft lists minimum contents (7.5):

- the activities and documentation to be provided
- service level agreements and KPIs
- conditions for audits
- support during inspections
- communication of quality and security issues
- an exit strategy so the user keeps control of its data
- a release process for new versions, including the option to test them beforehand[8]

**Frequent releases:** users must assess every release for its effect on their validated state. Useful inputs are release notes, the vendor's risk ratings and pre-release test environments. Regression testing should follow risk.

**Multi-tenant environments:** several customers share one platform, so configuration must be documented strictly per customer. The vendor's validation evidence covers the shared code base, not any individual customer's configuration.

**Data residency and data integrity:** the draft requires critical data to be replicated, where relevant, to a secondary data centre at a safe distance (15.6) and disaster recovery plans to be tested (15.7)[8]. PI 041 deals explicitly with data integrity in outsourced activities[16]. In clinical research, the 2023 EMA guideline and ICH E6(R3) section 4 apply[15][13]. On filing validation-relevant trial documents, see [TMF and eTMF](https://info-pharma.de/en/tmf-etmf/).

## 6. Pre-validated software: why it should be standard, especially for cloud solutions

**Pre-validation as standard:** software, especially cloud software, should be pre-validated. With SaaS, the user has no access to installation, infrastructure or code base and cannot meaningfully perform IQ or large parts of OQ itself. GAMP 5 Second Edition explicitly calls for supplier knowledge, experience and documentation to be leveraged as far as possible[7].

**The vendor's IQ and OQ reports:** comprehensive IQ and OQ reports from the vendor must exist and must be made available to the user. Annex 11 (2011) already requires supplier documentation to be reviewed and development quality to be assured (3.3, 4.5)[1]. Under the draft, qualification and validation documentation may come wholly or partly from the vendor. The user must review it, authorise its use and be able to explain it from its own site (9.9, 7.4)[8].

**PQ and UAT templates:** these are also very helpful. They structure and speed up the user-specific part of validation because they build on the URS and prepare traceability to the vendor's documentation.

**Ready for use sooner:** pre-validated software is therefore always ready for use sooner. The user builds on reviewed supplier documentation instead of testing core functions itself. This leverage "rather than repeating the activities" is exactly what the draft Annex 11 anticipates (7.2)[8].

**The user's responsibility:** to be fair, responsibility for the validated state in the user's own environment stays with the user[8]. That covers intended use, configuration, PQ/UAT, training, user management and the supporting processes.

### Examples of vendors providing validation documentation (alphabetical, no ranking)

The following examples come from different software categories and show that pre-validation matters across categories. The information is taken solely from vendor sources.

**Docuply (docuply.io), category: eQMS with integrated eTMF.** Docuply is a cloud-based electronic quality management system with an integrated trial master file and hosting in the EU cloud. According to its pricing page, the system is delivered pre-validated (IQ & OQ) for immediate use. Its paid plans include computer system validation (installation and operational qualification) and the effort for initial vendor qualification[18].

**Harbor (runharbor.com), category: EDC and data platform for clinical trials.** Harbor was founded in 2025 by Albert Cai and Nathan H. Leung, belongs to the Y Combinator Spring 2026 batch and now describes itself in its YC profile as an "AI-native CRO"[21]. According to its website, every licence includes a verification and validation package with risk and traceability matrices. The vendor says requirements, the traceability matrix and test reports are generated automatically for each release[19][20]. The vendor itself points out that the sponsor must validate the study-specific configuration, typically through UAT[20].

**Veeva Vault RIM (veeva.com), category: regulatory information management.** Vault RIM is a suite of applications, including Registrations and Submissions, on the multi-tenant Veeva Vault cloud platform[23][22]. According to the Validation Features Brief, Veeva performs and documents IQ and OQ for each major release. For each release it provides a validation package (validation plan, requirements documents, test protocol, IQ/OQ, traceability matrices, validation summary report) and UAT scripts that can be adapted for PQ. Veeva states that new versions arrive "approximately every four months", with a Release Impact Assessment and pre-release Vaults available beforehand[22].

## 7. Typical inspection findings on computerised systems

**EMA:** the GCP Inspectors Working Group's 2024 annual report records 335 major and critical findings from 67 CHMP-requested inspections. The "Computer System" category accounted for 14 major findings, 12 of them at sponsors. Under data management, the report lists "Inadequate data migration and system validation", among other issues[24].

**FDA:** warning letters under 21 CFR 211.68(b) regularly cite missing access controls and audit trails:

- Guangxi Yulin Pharmaceutical (30 September 2025): UV-vis and IR spectroscopy equipment had no audit trail function, and analysts could delete and alter data. This was a repeat observation from 2016[25].
- International Laboratories Corp (10 March 2025): analysts held administrative rights that allowed them to change data, including the date and time of tests[26].
- Wisconsin Pharmacal (22 August 2025): administrative privileges for modifying and deleting files in a chromatography data system were not adequately controlled[27].

FDA's data integrity guidance states that shared logins do not conform to CGMP because no unique individual can be identified[17]. In a guest column in Pharmaceutical Online (15 December 2025), Ajay Babu Pazhayattil, Marzena Ingram and Koti Reddy Bhimavarapu analysed 85 warning letters to drug manufacturers posted between 1 January and 9 December 2025. 15% cited data integrity concerns, rising to 60% for sites in India, compared with 21% in China and 10% in the US. This is an industry analysis, not an FDA statistic[28].

## FAQ

### What is computer system validation?

CSV is documented evidence that a computerised system is fit for its intended use and stays validated throughout its lifecycle. Its foundations include Annex 11 and 21 CFR 11.10(a)[1][2].

### What is the difference between IQ, OQ and PQ?

IQ shows correct installation, OQ shows the system works as specified, and PQ shows it is fit for purpose in the user's real process[6].

### What is the difference between CSV and CSA?

CSA is a risk-based approach within the duty to validate. Effort follows process risk, and unscripted testing is acceptable for lower-risk features. FDA's guidance has been final since September 2025 and is formally addressed to device manufacturers[11].

### Does cloud software have to be validated?

Yes. Annex 11 applies whether a system is developed in-house, bought off the shelf or provided as a service, and the draft revision says so explicitly (6.1)[8].

### What does pre-validated software mean?

The vendor has performed IQ and OQ on the standard product and provides the documentation. The user reviews and leverages it, then adds the user-specific validation such as PQ and UAT[7][8].

### Who is responsible for validating SaaS software?

The regulated user. It may rely on vendor documentation but remains fully responsible (draft Annex 11, 7.1 and 9.9)[8]. On overseeing service providers in clinical trials, see [CRO Sponsor Oversight](https://info-pharma.de/en/cro-sponsor-oversight/).

## References

1. European Commission: EudraLex Volume 4, Annex 11: Computerised Systems (revision 1, applicable from 30 June 2011). https://health.ec.europa.eu/system/files/2016-11/annex11_01-2011_en_0.pdf (accessed 5 November 2026)
2. eCFR: 21 CFR Part 11 – Electronic Records; Electronic Signatures, § 11.10(a). https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11 (accessed 5 November 2026)
3. PIC/S: PI 011-3, Good Practices for Computerised Systems in Regulated "GxP" Environments. https://picscheme.org/en/publications (accessed 5 November 2026)
4. MHRA: 'GXP' Data Integrity Guidance and Definitions, Revision 1, March 2018. https://assets.publishing.service.gov.uk/media/5aa2b9ede5274a3e391e37f3/MHRA_GxP_data_integrity_guide_March_edited_Final.pdf (accessed 5 November 2026)
5. FDA: General Principles of Software Validation; Final Guidance (2002). https://www.fda.gov/regulatory-information/search-fda-guidance-documents/general-principles-software-validation (accessed 5 November 2026)
6. European Commission: EudraLex Volume 4 – GMP Guidelines (overview including Annex 11 and Annex 15). https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en (accessed 5 November 2026)
7. ISPE: GAMP 5 Guide, 2nd Edition: A Risk-Based Approach to Compliant GxP Computerized Systems (July 2022). https://ispe.org/publications/guidance-documents/gamp-5-guide-2nd-edition (accessed 5 November 2026)
8. European Commission: Annex 11: Computerised Systems, consultation draft (July 2025). https://health.ec.europa.eu/document/download/40231f18-e564-4043-94de-c031f813d38b_en?filename=mp_vol4_chap4_annex11_consultation_guideline_en.pdf (accessed 5 November 2026)
9. European Commission: Stakeholders' Consultation on EudraLex Volume 4 – Chapter 4, Annex 11 and New Annex 22 (closed). https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en (accessed 5 November 2026)
10. Federal Register: Medical Devices; Quality System Regulation Amendments, Final Rule, 89 FR 7496 (2 February 2024; effective 2 February 2026). https://www.federalregister.gov/documents/2024/02/02/2024-01709/medical-devices-quality-system-regulation-amendments (accessed 5 November 2026)
11. FDA: Computer Software Assurance for Production and Quality System Software, Final Guidance (September 2025). https://www.fda.gov/regulatory-information/search-fda-guidance-documents/computer-software-assurance-production-and-quality-system-software (accessed 5 November 2026)
12. Federal Register: Computer Software Assurance for Production and Quality System Software; Availability, 90 FR 45945 (24 September 2025). https://www.federalregister.gov/documents/2025/09/24/2025-18468/computer-software-assurance-for-production-and-quality-system-software-guidance-for-industry-and (accessed 5 November 2026)
13. EMA: ICH E6(R3) Guideline for good clinical practice (GCP), Step 5. https://www.ema.europa.eu/en/documents/scientific-guideline/ich-e6-r3-guideline-good-clinical-practice-gcp-step-5_en.pdf (accessed 5 November 2026)
14. European Commission, ACT EU: Good clinical practice modernisation. https://accelerating-clinical-trials.europa.eu/our-work/good-clinical-practice-modernisation_en (accessed 5 November 2026)
15. EMA: Guideline on computerised systems and electronic data in clinical trials (EMA/INS/GCP/112288/2023). https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/guideline-computerised-systems-electronic-data-clinical-trials_en.pdf (accessed 5 November 2026)
16. PIC/S: PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (1 July 2021). https://picscheme.org/docview/4234 (accessed 5 November 2026)
17. FDA: Data Integrity and Compliance With Drug CGMP – Questions and Answers (December 2018). https://www.fda.gov/media/119267/download (accessed 5 November 2026)
18. Docuply: Pricing. https://docuply.io/en/pricing/ (accessed 5 November 2026)
19. Harbor: The intelligent EDC (website). https://runharbor.com/ (accessed 5 November 2026)
20. Harbor (A. Cai): Compliance Without Compromise: How Harbor Ships Fast and Stays Constantly Validated (19 September 2025). https://runharbor.com/blog/2025-09-19-software-validation (accessed 5 November 2026)
21. Y Combinator: Harbor – company profile. https://www.ycombinator.com/companies/runharbor (accessed 5 November 2026)
22. Veeva Systems: Veeva Vault Validation Features Brief. https://www.veeva.com/resources/veeva-vault-validation-product-brief/ (accessed 5 November 2026)
23. Veeva Systems: More than 200 Companies Select Veeva Vault RIM Applications (press release, 2020). https://www.veeva.com/wp-content/uploads/2020/06/More-than-200-Companies-Select-Veeva-Vault-RIM-Applications-to-Streamline-Regulatory-Operations.pdf (accessed 5 November 2026)
24. EMA: Annual Report of the GCP Inspectors' Working Group 2024 (EMA/INS/GCP/37608/2025). https://www.ema.europa.eu/en/documents/report/annual-report-good-clinical-practice-inspectors-working-group-2024_en.pdf (accessed 5 November 2026)
25. FDA: Warning Letter Guangxi Yulin Pharmaceutical Group Co. Ltd., MARCS-CMS 710422 (30 September 2025). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/guangxi-yulin-pharmaceutical-group-co-ltd-710422-09302025 (accessed 5 November 2026)
26. FDA: Warning Letter International Laboratories Corp, MARCS-CMS 698522 (10 March 2025). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/international-laboratories-corp-698522-03102025 (accessed 5 November 2026)
27. FDA: Warning Letter Wisconsin Pharmacal Company, LLC, MARCS-CMS 710329 (22 August 2025). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/wisconsin-pharmacal-company-llc-710329-08222025 (accessed 5 November 2026)
28. Pazhayattil, A. B.; Ingram, M.; Bhimavarapu, K. R.: What 2025 FDA Warning Letters Tell Us About GMP Compliance. Pharmaceutical Online, 15 December 2025. https://www.pharmaceuticalonline.com/doc/what-fda-warning-letters-tell-us-about-gmp-compliance-0001 (accessed 5 November 2026)