For most of the past three decades, validating a computerised system in a GMP facility has usually meant paper. Teams compiled binders of test scripts, wet-ink signatures and printed screenshots. That model is now under pressure, and digital validation in life sciences sits at the centre of the change.
Regulators on both sides of the Atlantic are revising their expectations. The US Food and Drug Administration (FDA) has finalised its Computer Software Assurance guidance. Europe is rewriting EU GMP Annex 11 for the first time since 2011. It is also drafting a new annex on artificial intelligence (AI).
Meanwhile, validation teams report rising workloads and uneven progress on digital validation. This article explains what the term means, what the new rules expect and where the industry stands in 2026.
What Is Digital Validation?
The term digital validation is used to mean two related things. The first is validating digitally. Teams plan, execute, review and approve validation work inside an electronic system instead of on paper. That work spans computer system validation (CSV), commissioning and qualification, cleaning validation and process validation.
The second meaning is validating digital systems. This is the discipline of showing that software is fit for its intended use. Examples range from manufacturing execution systems and laboratory information management systems to cloud platforms and AI models. This article covers both meanings.
A typical digital validation platform replaces handwritten protocols with electronic ones. Electronic signatures replace wet ink, and the system records an audit trail automatically. Requirements link directly to the tests that verify them, which gives reviewers traceability from end to end.
Supporters cite four benefits: faster audit preparation, stronger data integrity, shorter cycle times and easier reuse of supplier evidence. Regulators frame data integrity through the ALCOA+ principles. These expect records to be attributable, legible, contemporaneous, original and accurate. The plus adds complete, consistent, enduring and available.
In the United States, 21 CFR Part 11 governs electronic records and electronic signatures. In Europe, the corresponding expectations sit in EU GMP Annex 11 and Chapter 4.
From CSV to CSA: Why the FDA Changed Its Approach
Traditional CSV grew into a documentation-heavy exercise. In many organisations, teams applied the same scripted testing and evidence capture to every function, whatever its risk.
The FDA’s answer is computer software assurance (CSA). The final CSA guidance describes a risk-based approach. Its aim is “establishing and maintaining confidence that software is fit for its intended use”.
Under CSA, effort scales with risk. The guidance asks whether a software feature, function or operation poses a “high process risk”. That applies where a failure “may result in a quality problem that foreseeably compromises safety”. Assurance activities then range from unscripted methods, such as exploratory testing and error guessing, to scripted testing. The detail and evidence expected for each test depend on the risk.
The guidance also lets manufacturers build on supplier work. A manufacturer could take the vendor’s development practices and validation work “as the starting point”. It would then decide what further activity is needed.
The FDA published the draft in September 2022 and the final guidance on 24 September 2025. The final text superseded Section 6 of the agency’s 2002 guidance, General Principles of Software Validation. An updated version followed on 3 February 2026 under a revised title. It is now called Computer Software Assurance for Production and Quality Management System Software.
That update aligned the guidance with the Quality Management System Regulation, which took effect on 2 February 2026. The regulation incorporates the international standard ISO 13485:2016 by reference into 21 CFR Part 820.
The scope is narrower than some industry commentary suggests. The guidance comes from the FDA’s device and biologics centres. It covers software used in medical device production or the quality management system. It does not cover device software functions, meaning software that is itself a medical device or part of one.
Nor does the guidance extend to drug manufacturers. Pharmaceutical quality teams often cite its risk-based thinking, but adoption there is voluntary good practice. The table below summarises the main differences.
| Aspect | Traditional CSV (typical practice) | CSA (FDA guidance) |
|---|---|---|
| Starting point | Documentation and scripted test evidence | Intended use and process risk |
| Testing | Mostly scripted, applied uniformly | Scripted or unscripted, scaled to risk |
| Supplier evidence | Often repeated in house | Used as the starting point |
| Records | Extensive evidence for every function | Evidence proportionate to risk |
| Formal scope | Any regulated computerised system | Device production and quality management system software |
Annex 11 Rewritten: What Europe’s Draft Rules Expect
The European Commission published a draft revision of Annex 11 on 7 July 2025. Drafts of a revised Chapter 4 on documentation and a new Annex 22 appeared alongside it. The stakeholder consultation closed on 7 October 2025.
The scale of change is considerable. The current Annex 11 runs to about five pages, while the draft runs to 19. It contains 17 sections and a glossary. Chapter 4 has grown from nine pages to 17, according to the ECA Academy.
The draft says quality risk management should be applied “throughout all lifecycle phases” of a computerised system. Requirements should be “updated and maintained throughout the lifecycle of a system”. The same principles apply whether a system is built in house, bought commercially or provided as a service. They also apply whether development follows a linear or an iterative process.
The draft is firm on outsourcing. Qualification and validation documentation may come from a vendor or service provider. However, “the regulated user is fully accountable”. Depending on risk and criticality, the user should audit or thoroughly assess the supplier.
Several proposals are specific. All users should have “unique and personal accounts”. Audit trail functionality “should be enabled and locked at all times”. Remote authentication on critical systems from outside controlled perimeters should include multifactor authentication. Critical systems facing the internet should undergo penetration testing at regular intervals. These proposals arrive as the sector confronts a wider life science cybersecurity gap.
None of this is final. As of 7 October 2026, EudraLex Volume 4 still lists the January 2011 revision of Annex 11. The EMA inspectors’ work plan for 2026 to 2028 sets a target of the fourth quarter of 2026. That target is for giving the European Commission a final text, not for publication. No date of operation or transition period has been announced.
The reach of the revision extends beyond the EU. The EMA’s GMP/GDP Inspectors Working Group prepared the drafts in cooperation with PIC/S. That body, the Pharmaceutical Inspection Co-operation Scheme, lists more than 50 participating authorities. They include the FDA and the UK’s Medicines and Healthcare products Regulatory Agency (MHRA). That gives the revision relevance for UK sites as well.
Annex 22: The First GMP Rules for Artificial Intelligence
Annex 22 is entirely new. The Commission says it covers AI and machine learning “in the manufacturing of active substances and medicinal products”. The six-page draft applies to AI models used in critical applications. These are uses with a “direct impact on patient safety, product quality or data integrity”.
The draft annex proposes controls that validation specialists will recognise. The intended use of a model should be documented. Acceptance criteria should be set for defined test metrics. Test data should be representative and kept independent of the data used for training. The draft also addresses explainability, confidence scores, change control and performance monitoring.
The emphasis on data quality mirrors a wider argument that AI in life sciences depends on its data foundations.
The draft’s limits have drawn the most attention. It applies only to static models with deterministic output. Dynamic models that keep learning during use “should not be used in critical GMP applications”. The draft uses the same wording for generative AI and large language models. In non-critical applications, it says qualified personnel should remain responsible for model outputs. The draft calls this a human-in-the-loop approach.
That position may yet change. The EMA held a two-day expert workshop on 30 June and 1 July 2026. The agency says the 2025 consultation showed support for potentially enabling generative AI and large language models.
The EMA published the workshop report on 2 October 2026. It says the drafting group has discussed widening the scope of Annex 22. That would allow dynamic models, generative AI and large language models under a “robust, risk-based control strategy”. The report adds that “concerns remain” about what such a strategy needs. It sets no date, and until a final text is published, Annex 22 remains a proposal.
Where Digital Validation Stands: The Adoption Data
The most widely cited adoption figures come from the annual State of Validation study. Readers should note its provenance. Kneat, a vendor of digital validation software, publishes the study. A sponsored summary published by the International Society for Pharmaceutical Engineering (ISPE) describes the 2026 edition as independently authored. It names the author as Donncadh J. Nagle of Jacobs Engineering.
The 2025 edition drew on more than 300 respondents, according to Kneat. An ISPE blog on that edition reported a sharp rise in one year. The share of organisations using a digital validation system went from 30% to 58%.
The 2026 State of Validation study was published on 30 April 2026. It surveyed 614 validation professionals, according to ISPE’s summary. Nearly two-thirds were fully using or actively implementing a dedicated digital validation tool. Yet only 13% said their organisation was fully digital across all record types.
The two editions describe adoption in different terms. Their figures are therefore not directly comparable and should not be read as one trend line.
Paper persists in core records. Some 41% of respondents said logbooks were still primarily paper-based. The figures were 35% for batch records and 33% for validation protocols.
Workload is rising at the same time. In the 2026 study, 80% said their validation workload had increased over the past year. Some 45% described the increase as significant.
On AI, ISPE’s summary says 39% of respondents were already using or evaluating it for validation. It adds that 78% were confident AI would be standard practice by 2030.
Commercial digital validation platforms include Kneat, ValGenesis, Veeva and Sware. They are named here as examples, not as recommendations.
What Changes in Practice
For validation teams, digital validation is as much about method as about software. Five changes stand out.
- Risk assessment comes first. Teams define intended use, assess what a failure could affect, then choose assurance activities for each function.
- Execution moves on screen. Protocols are executed electronically, with real-time review, electronic signatures and automatic audit trails.
- Supplier and cloud evidence is reused instead of repeated. That reuse rests on a documented supplier assessment, and the regulated user stays accountable.
- Validation becomes continuous. Periodic review replaces the one-off validation event, at a frequency justified by risk under the Annex 11 draft.
- The validation tool needs assurance too. A digital validation platform is itself a computerised system holding GMP records.
On the last point, the logic of both frameworks applies. The tool should be shown fit for its intended use, with effort proportionate to risk.
Digital validation software alone will not fix fragmented processes. A recent contributor article on LSDN argued that many life sciences compliance problems are really operations problems.
What Validation Teams Should Do Now
The European texts are not final, so preparation is a more realistic goal than implementation. Five preparatory steps towards digital validation follow from the documents described above.
- Run a gap assessment against the draft Annex 11 and Chapter 4, then repeat it when final texts appear.
- List every AI and machine learning use in GMP processes and compare each with the Annex 22 scope.
- Update procedures and risk methods towards risk-based assurance. GAMP 5 Second Edition, published by ISPE in July 2022, is the common reference.
- Review supplier and cloud provider agreements for audit rights and access to data.
- Identify which record types remain on paper and set a sequence for digitising them.
ISPE also published a GAMP guide on artificial intelligence in July 2025. It offers an industry reference while Annex 22 remains in draft.
Frequently Asked Questions
What is digital validation?
Digital validation means planning, executing, reviewing and approving validation activities in an electronic system instead of on paper. It uses electronic signatures, automatic audit trails and linked traceability between requirements and tests. The term also describes assuring that digital systems themselves are fit for their intended use. Those systems include manufacturing, laboratory and cloud software, and increasingly AI models.
What is the difference between CSV and CSA?
Computer system validation is the established practice of proving that a computerised system does what it should. In practice, it often relied on uniform scripted testing and extensive documentation. Computer software assurance is the FDA’s risk-based approach. It scales assurance effort to process risk, allows unscripted testing where appropriate and builds on supplier evidence. CSA changes how assurance is achieved, not whether software needs to be fit for use.
Does CSA apply to pharma?
Not formally. The FDA’s CSA guidance was issued by its device and biologics centres. It applies to software used in medical device production or the quality management system. The guidance does not extend to drug manufacturers. Pharmaceutical companies may draw on its risk-based thinking as voluntary good practice. GAMP 5 Second Edition remains the common industry reference.
When does the new Annex 11 take effect?
No date has been set. The revised Annex 11 was still a draft on 7 October 2026. EudraLex Volume 4 continued to list the January 2011 version. The EMA inspectors’ work plan targets the fourth quarter of 2026 for giving the European Commission a final text. Publication, the date of operation and any transition period will follow separately.
Does Annex 22 cover generative AI?
Not in the draft as consulted. The draft annex states that it does not apply to generative AI and large language models. It adds that such models should not be used in critical GMP applications. For non-critical uses, it proposes human-in-the-loop oversight by qualified personnel. The EMA held an expert workshop in mid-2026 after consultation responses supported potentially enabling these technologies. Its report, published on 2 October 2026, says the drafting group has discussed allowing them under risk-based controls.
