Glossary
CSA vs CSV for AI systems
The FDA shift from documenting everything to assuring what actually carries risk, applied to AI.
CSV (Computer System Validation) tests a system against full documented requirements regardless of risk. CSA (Computer Software Assurance) is the FDA risk-based approach that puts assurance effort where patient safety and data integrity are most exposed. For an AI system, CSA means heavy testing on the outputs that carry real risk and lighter assurance on the rest.
The shift comes from the FDA 2022 draft guidance on Computer Software Assurance for production and quality systems. Classic CSV often produced binders of test scripts for low-risk functions, which discouraged teams from adopting software at all. CSA asks a different first question. What is the risk to the patient and the record if this function fails? The answer sets the depth of testing.
For an AI agent the unit of risk is the output, not the model. A draft that a human reviews before it touches anything regulated sits low on the scale. A figure that flows straight into a 21 CFR Part 11 record sits high and needs scripted testing with a named sign-off. That is the same logic behind audit-ready AI agents, and it sits inside the control framework in GAMP 5 for AI agents. See also our regulatory affairs work.
CSV (Computer System Validation) tests a system against full documented requirements regardless of risk. CSA (Computer Software Assurance) is the FDA risk-based approach that puts assurance effort where patient safety and data integrity are most exposed. For an AI system, CSA means heavy testing on the outputs that carry real risk.
What changes between CSV and CSA
- The starting question. CSV starts from requirements to document. CSA starts from the risk a function poses to patient safety and data integrity.
- Where effort goes. CSA concentrates scripted testing on high-risk AI outputs and allows lighter, unscripted assurance on low-risk ones.
- What stays the same. Part 11, the predicate rules, and the need for a human accountable for each regulated output do not relax.
Common questions
Does CSA replace CSV?
No. CSA is how the FDA now expects you to scope validation, not a different set of rules. The Part 11 and predicate requirements still hold. CSA changes where you spend assurance effort, putting it on the functions that affect patient safety and data integrity.
How does CSA apply to an AI agent?
You assess each agent function by risk. A high-risk output, such as text that lands in a regulatory submission or a batch record, gets scripted testing and a human sign-off. A low-risk drafting aid gets lighter, often unscripted, assurance.
15 min. 5-day written diagnosis. No deck.