Computer Software Assurance (CSA) Training (US FDA) Training

About this course

Why CSA matters now

Device makers rely more and more on software to run production and the quality system, from inspection and sealing to nonconformance, training and document control, and a failure in the wrong function can reach a patient. In May 2025 FDA wrote to a manufacturer whose inspection software accepted capillary rods outside their limits and had never been validated, although the firm's own procedure required it. Since 2 February 2026 the duty to validate software used in production and the quality system comes from the Quality Management System Regulation, which brings ISO 13485:2016 into US law. FDA's current guidance on computer software assurance, issued on 3 February 2026, explains how to meet that duty by putting effort where failure could harm. The course's example company starts with the reverse: a 300-page binder of scripts and screenshots for its training system, and a short test for the camera that accepts product with no person checking it.

What makes this course different

The course teaches the February 2026 guidance, which replaced the September 2025 version, together with the regulation now in force, so references in procedures can be brought up to date. It works through the whole risk framework: intended use, high process risk, choosing scripted or unscripted testing, drawing on vendor evidence and existing controls, the record, Part 11, cloud software and changes for approved devices. One built device maker in Boston, WXY Medical Inc., runs through every module with six systems of very different risk, and the guidance's own appendix examples are applied to them step by step. It is written for US requirements only and names no other jurisdiction's rules. Where the guidance leaves a choice to the manufacturer, the course shows the reasoning behind each option rather than a single template.

Who should take it

The course is for validation and quality engineers, QA and regulatory staff, IT and system owners, and managers at medical device companies in the US or supplying it, who choose, configure, test or approve software used in production or the quality management system. It suits teams moving from script-everything validation to a risk-based approach. Teams validating systems for medicines are better served by the Sterling Academy Computer System Validation (GAMP 5) course. No programming knowledge is needed. The ten modules take about two hours, each with a real or built case, the rule in plain words, what it means at WXY, and the common mistake to avoid, followed by three short practice questions.

What a learner can do afterwards

After the course, a learner can sort a site's software into direct, supporting and out-of-scope uses, rate each important function as high process risk or not, and name the checks that decide that rating. They can choose testing that matches the risk, reuse vendor work where it really applies, and write a lean record that answers what the software is for, how risky it is, what was tested, what was found and who decided. They know when Part 11 applies, how to control cloud vendor updates, and when a software change for an approved device goes in a 30-day notice. They can also explain to an auditor why the site's effort sits where it does, with the guidance and the regulation behind each decision. A scenario-based exam leads to the Certificate of Completion.