Abstract: The implementation of the FDA’s Quality Management System Regulation (QMSR) and the adoption of Computer Software Assurance (CSA) principles have shifted medical device manufacturing toward a more risk-based approach to quality management. This article examines how these regulatory changes influence sustaining manufacturing activities for legacy medical devices, with particular emphasis on CAPA, Material Review Board (MRB) decision-making, nonconforming material management, change control, and revalidation. It presents a practical framework for maintaining a validated state by scaling documentation and validation efforts according to patient safety risk, enabling manufacturers to improve compliance, streamline sustaining operations, and support efficient lifecycle management without unnecessary regulatory burden.
The FDA’s transition to the Quality Management System Regulation (QMSR) fundamentally alters how medical device manufacturers manage legacy products by incorporating ISO 13485:2016 by reference.1 Concurrently, the FDA’s finalized Computer Software Assurance (CSA) guidance from September 2025 establishes a risk-based framework for production and quality software.2 Together, these regulatory changes encourage manufacturers to shift away from documentation-intensive validation practices and toward a more balanced approach that prioritizes patient safety, product quality, and scientifically justified decision-making.
While much of the industry’s focus has centered on new product development, sustaining manufacturing represents a high-impact context where already-marketed legacy devices—such as those holding valid CE certificates under the former MDD 93/42/EEC or AIMDD 90/385/EEC directives—require ongoing lifecycle management.1 Throughout a product’s operational life, manufacturers routinely implement supplier changes, process improvements, software updates, and corrective actions while ensuring that existing controls remain effective. These routine activities demand a regulatory strategy that preserves compliance without unnecessarily repeating validation efforts for changes that present minimal risk.
Applying rigid, traditional validation and change control paradigms to these mature products often results in an unsustainable documentation burden. By shifting toward a risk-based approach, manufacturers can maintain a validated state while optimizing resources for quality and safety. This perspective enables sustaining engineering teams to focus validation activities where they have the greatest impact, improving operational efficiency while supporting the long-term reliability and regulatory compliance of legacy medical devices.
Background: The QMSR, CSA, and the sustaining manufacturing context
The QMSR alignment with ISO 13485:2016 requires organizations to evaluate changes through a more integrated quality lens. A critical aspect of sustaining operations is maintaining a validated state for both manufacturing processes and the software that governs the Quality Management System (QMS). Historically, Computer System Validation (CSV) demanded an inverted resource allocation, with approximately 80% of the effort dedicated to documentation and testing, and only 20% to critical thinking and risk analysis.3 The CSA methodology formally flips this paradigm, focusing 80% of the effort on upfront critical thinking and risk analysis.3 Rather than emphasizing the volume of validation documentation, CSA encourages manufacturers to concentrate on activities that directly demonstrate whether software performs its intended function while supporting product quality and patient safety.
This shift is particularly significant in sustaining manufacturing, where legacy products remain in continuous production for years after their initial commercialization. Manufacturing organizations routinely implement equipment upgrades, supplier changes, software enhancements, and process improvements that require careful evaluation without disrupting validated operations. In this environment, maintaining a validated state differs fundamentally from establishing one during new product introduction. The objective is to preserve confidence in existing controls while applying additional validation only when the nature and risk of a change justify it.
Rather than treating every minor change as a trigger for full re-validation, organizations use scheduled Good Manufacturing Practice (GMP) periodic reviews to confirm that legacy systems remain fit-for-purpose and compliant.4 However, the FDA has clarified that regulatory enforcement discretion under 21 CFR Part 11 does not exempt production or QMS software from the strict validation requirements of 21 CFR 820.70(i), necessitating a structured, risk-based maintenance strategy.2 By integrating periodic review, documented risk assessment, and proportionate validation activities, manufacturers can sustain compliance throughout the product lifecycle while reducing unnecessary effort associated with low-risk modifications.
Risk-based CAPA, NCMR, and MRB decision-making
Sustaining operations are heavily driven by nonconforming material reports (NCMRs), Material Review Board (MRB) dispositions, and Corrective and Preventive Actions (CAPA). These quality processes ensure that manufacturing issues are investigated, appropriately dispositioned, and resolved before they affect product quality or patient safety. Inadequate CAPA procedures have been the leading cause of FDA 483 inspectional observations every year since 2010.5 Specifically, FDA data from fiscal year 2020 revealed that CAPA under 21 CFR 820.100 was the most cited requirement, resulting in 197 warning letter observations, followed closely by complaint handling.6 This compliance risk is compounding, as total FDA 483s across all areas surged by nearly 58% between FY2021 and FY2022.7 These findings demonstrate that sustaining manufacturing requires quality systems capable of distinguishing between issues that warrant comprehensive investigations and those that can be addressed through proportionate, risk-based actions.
To address this challenge, the Medical Device Innovation Consortium (MDIC) piloted a risk-based CAPA framework that differentiates between high-risk external events requiring stand-alone CAPA records and internal, non-trend events that can be managed through a fast-track path embedded in existing QMS monitoring processes.8 This framework allowed almost 80% of CAPAs to be fast-tracked, reducing implementation cycle times from over 220 days to fewer than 50 days, and dramatically decreasing repeat CAPAs from 16% to 0.4%.8 Rather than applying identical investigation requirements to every nonconformance, organizations can allocate engineering resources according to the severity, recurrence, and potential patient impact of each event while maintaining an auditable decision-making process.
Applying this risk-based scaling requires concrete justifications based on device class and risk profile. The examples below illustrate how manufacturers can align CAPA, MRB, and change control activities with the significance of the underlying issue instead of relying on a one-size-fits-all validation approach.
Case study 1: Class III implants and electro-mechanical devices
When addressing hardware obsolescence for a legacy implant or electro-mechanical device, replacing a semiconductor or electronic component can be classified as a non-significant design change. According to MDCG 2020-3 Rev.1 guidance, if the replacement maintains the same specifications and does not negatively affect the device’s risk/benefit ratio, it avoids triggering full recertification.9 This justifies a proportionate, fast-tracked MRB and change control response rather than a massive re-validation effort. By documenting the engineering rationale and demonstrating that the replacement does not alter intended use or safety, manufacturers can maintain compliance while minimizing unnecessary disruption to sustaining operations.
Case study 2: Software as a medical device (SaMD)
For SaMD experiencing minor recurring anomalies, manufacturers can utilize a Predetermined Change Control Plan (PCCP). The FDA permits manufacturers of AI/ML-enabled devices to implement iterative, post-deployment algorithm updates without new marketing submissions if they are pre-authorized within a PCCP, effectively right-sizing the corrective action scope for continuous software improvements.10 This approach enables organizations to implement controlled, incremental updates while preserving regulatory oversight, allowing quality teams to respond efficiently to lower-risk software changes without compromising the validated state of the device.
Revalidation triggers and software assurance in sustaining operations
Under the QMSR, change control is governed by ISO 13485 Clause 7.3.9, which mandates that manufacturers evaluate the significance of design and development changes on device function, safety, and regulatory requirements prior to implementation.11 For legacy computerized systems originally qualified under older, documentation-heavy frameworks, the transition to CSA principles offers significant relief during revalidation. Rather than requiring identical validation activities for every modification, manufacturers are encouraged to assess the potential impact of each change and determine the level of verification needed based on risk. This approach enables sustaining engineering teams to preserve the validated state while avoiding unnecessary requalification of mature systems that continue to perform as intended.
The CSA framework categorizes software operations based on process risk. Operations where a failure could foreseeably compromise safety are deemed “high process risk” and still require traditional scripted testing.2 However, for lower-risk QMS features, manufacturers can leverage unscripted, exploratory, or scenario-based testing.2 When utilizing cloud computing models such as Software as a Service (SaaS), Platform as a Service (PaaS), or Infrastructure as a Service (IaaS) for sustaining operations, manufacturers are expected to rely on system-generated digital evidence—including audit trails, electronic records, and system logs—alongside risk-based vendor assessments such as SOC reports and ISO certifications instead of generating redundant paper documentation.12 To ensure these unscripted methods withstand regulatory inspection, organizations must document the FDA’s expected elements, including the risk rationale, testing objectives, and testing outcomes.13
For legacy medical device software, the IEC 62304 standard dictates that safety classes (B or C) drive the documentation burden; for instance, Class C mandates detailed design and unit test reports.¹⁴ As a result, understanding how software safety classifications influence validation requirements is an important component of sustaining operations. Manufacturers can actively reduce revalidation triggers and lower the software safety class by implementing external risk control measures, such as independent hardware monitors or mechanical constraints, thereby reducing ongoing sustaining costs.14 By combining risk-based change evaluations with CSA principles and established software lifecycle standards, organizations can maintain regulatory compliance while focusing engineering effort on changes that have the greatest potential impact on product quality and patient safety.
A practical framework for maintaining the validated state
To operationalize these principles, manufacturers must integrate their sustaining-engineering workflows directly with established risk management standards, specifically ISO 14971:2019. Because the QMSR harmonizes with ISO 13485:2016, which explicitly requires ISO 14971 risk management principles, any defensible framework must use this standard as its foundation for defining patient-safety risk. Rather than treating every engineering change as an independent validation exercise, organizations can evaluate changes within a structured risk management process that considers the likelihood of patient harm, the effectiveness of existing controls, and the potential impact on product quality. This approach enables quality and engineering teams to make consistent, well-documented decisions while maintaining compliance throughout the product lifecycle.
A practical framework scales documentation and testing efforts by mapping ISO 14971 hazard analysis outputs to CSA-aligned validation requirements. For example, when evaluating a post-market cybersecurity vulnerability in a legacy SaMD, manufacturers should not rely solely on traditional probabilistic models such as Failure Mode and Effects Analysis (FMEA), as the FDA considers them insufficient for assessing exploitability.15 Instead, the framework requires nonprobabilistic threat modeling, such as the STRIDE methodology.15 Integrating these methodologies allows organizations to evaluate both functional safety risks and cybersecurity threats within a unified decision-making process, ensuring that validation activities remain proportionate to the significance of the identified hazard.
The framework can be summarized through the risk-based decision process shown in Table 1, which illustrates how validation activities scale according to the assessed level of patient risk.
Table 1. Risk-based framework for maintaining the validated state
| Risk level | Typical scenario | Recommended approach |
|---|---|---|
| Low | Minor QMS software patch or low-exploitability anomaly | Unscripted scenario testing, digital audit trails, and fast-track CAPA closure |
| Moderate | Process or software change with limited quality impact | Targeted validation, documented risk assessment, and focused verification activities |
| High | Safety-critical software or design changes affecting patient risk | Full scripted validation, stand-alone CAPA investigation, and comprehensive documentation |
By integrating cybersecurity risk management into the ISO 14971:2019 framework, engineers assess the risk of patient harm by evaluating a vulnerability’s exploitability alongside the severity of potential harm, mapping metrics such as the Common Vulnerability Scoring System (CVSS) directly into the hazard analysis.16 If the mapped risk is determined to be low—for example, a minor QMS software patch or a low-exploitability anomaly—the framework supports the use of unscripted scenario testing, digital audit trails, and fast-track CAPA closure. Conversely, high-severity hazards trigger full scripted validation and stand-alone CAPA investigations. Furthermore, for Class B and C devices under IEC 62304, maintaining a Software Bill of Materials (SBOM) supports continuous vulnerability monitoring for Software of Unknown Provenance (SOUP), providing an audit-ready rationale for ongoing risk-based maintenance.15
Conclusion
Reframing sustaining operations around patient-safety risk is essential for modernizing legacy device manufacturing under the FDA’s QMSR and CSA paradigms. Rather than applying identical validation requirements to every engineering change, manufacturers can adopt a risk-based approach that aligns the scope of documentation, testing, and quality activities with the potential impact on product performance and patient safety. This shift enables organizations to preserve the validated state of legacy devices while responding more efficiently to routine manufacturing changes, supplier updates, software modifications, and corrective actions throughout the product lifecycle.
By abandoning a one-size-fits-all approach to change control and validation, manufacturers can significantly reduce unnecessary documentation, accelerate MRB and CAPA disposition decisions, and maintain a state of continuous compliance. Leveraging tools such as fast-track CAPAs, digital evidence for software assurance, and ISO 14971-integrated threat modeling allows organizations to focus engineering resources on actual product quality and safety rather than redundant paperwork. These practices also strengthen decision-making by ensuring that validation activities remain proportional to the significance of the identified risk.
As the medical device industry continues to adapt to harmonized regulatory expectations, sustaining manufacturing will play an increasingly important role in maintaining compliance over the long operational life of legacy products. A structured, risk-scaled framework provides manufacturers with a practical and audit-ready strategy for balancing regulatory obligations, operational efficiency, and continuous product quality, ensuring that engineering efforts remain focused on activities that deliver the greatest value to both patients and the organization.
References
- SJ MedTech. (n.d.). Obsolescence management in medical device manufacturing. https://sjmedtech.com/glossary/obsolescence-management/
- RookQS. (2025). FDA finalizes computer software assurance guidance for production and quality system software. https://rookqs.com/blog-rqs/fda-computer-software-assurance-2025-guidance
- Davidson, J. (2023). Advancing the transition to computer software assurance: Responding to the FDA draft guidance for production and quality system software. Food and Drug Law Institute. https://www.fdli.org/2023/05/advancing-the-transition-to-computer-software-assurance/
- V5 Ultimate. (n.d.). Regulated manufacturing glossary. https://v5ultimate.com/glossary
- Nichols, E. (2023, October 17). Ultimate guide to corrective and preventive action (CAPA) for medical devices. Greenlight Guru. https://www.greenlight.guru/blog/corrective-action-and-preventive-action-capa-medical-devices
- Packard, R. (2025, October 8). Regulatory pathway & MedTech investor pitch deck. Medical Device Academy. https://medicaldeviceacademy.com/regulatory-pathway-medtech-investor-pitch-deck/
- Smart Food Safe. (2023, May 26). “Make CAPA cool”: Remodeling CAPA management. https://smartfoodsafe.com/remodeling-capa-management/
- Buehner, D., et al. (2023). Corrective and preventive action (CAPA) process improvement. Medical Device Innovation Consortium. https://mdic.org/wp-content/uploads/2023/05/2022-MDIC-Make-CAPA-Cool-Whitepaper_v16.pdf
- Medical Device Coordination Group. (2023, May). MDCG 2020-3 Rev. 1: Guidance on significant changes regarding the transitional provision under Article 120 of the MDR with regard to devices covered by certificates according to MDD or AIMDD. European Commission. https://health.ec.europa.eu/system/files/2023-09/mdcg_2020-3_en_1.pdf
- Chickering, L. (2025, February 20). A complete guide to the FDA’s AI/ML guidance for medical devices. Ketryx. https://www.ketryx.com/blog/a-complete-guide-to-the-fdas-ai-ml-guidance-for-medical-devices
- Tartal, J. (n.d.). Quality management system regulation (QMSR): Design and development [Presentation slides]. U.S. Food and Drug Administration. https://www.fda.gov/media/189041/download
- GMP Insiders Expert Team. (2025, September 24). FDA’s 2025 guidance on CSA: What manufacturers need to know. GMP Insiders. https://gmpinsiders.com/fda-2025-guidance-csa/
- Geaney, D. (2025, October 7). FDA’s final CSA guidance. Kneat. https://kneat.com/article/fda-final-csa-guidance/
- Schmitt, C. (2025, October 15). Safety classes according to IEC 62304. Johner Institute North America. https://blog.johner-institute.com/iec-62304-medical-software/safety-class-iec-62304/
- Schroeder, W. (2025, May 5). Ultimate guide to software as a medical device (SaMD). Greenlight Guru. https://www.greenlight.guru/blog/samd-software-as-a-medical-device
- International Medical Device Regulators Forum. (2020, March 18). Principles and practices for medical device cybersecurity. https://www.imdrf.org/sites/default/files/docs/imdrf/final/technical/imdrf-tech-200318-pp-mdc-n60.docx