In February 2026, FDA finalized its Computer Software Assurance (CSA) guidance, building on the 2022 draft version. For the first time, the final guidance explicitly names AI/ML systems as technologies requiring risk-based assurance, and it endorses system logs and audit trails as validation evidence, not just manually executed test scripts assembled after the fact.
That second point is the one worth sitting with. FDA didn’t just say “AI needs validation too.” It said the evidence itself can now be the system’s own digital record of what it did, not a document a human wrote describing what the system supposedly did.
What changed between the draft and the final guidance
The 2022 draft referenced AI/ML systems in passing. The final version brings them in explicitly, alongside several other updates: a new definitions section covering cloud deployment models (SaaS, PaaS, IaaS), an expanded cybersecurity section expecting SOC reports and SBOMs from vendors, a clarification that Part 11’s risk-based assurance applies specifically to record-integrity functions, and, the one that matters most here, explicit encouragement to use system logs and audit trails as validation evidence rather than relying solely on prescriptive, manually executed checklists.
Put simply: validation evidence is becoming digital-record-native. Not a PDF summarizing what happened. The actual record of what happened.
Why this breaks the old validation model
For thirty years, the standard validation package has been built on documents: protocols, test scripts, summary reports, written by humans, about systems, for other humans to read later. That worked when systems were simple and static. It stops working the moment you try to build AI on top of it.
A PDF can be read. It cannot be queried. It cannot tell you what changed since the last version, what it affects downstream, or whether the “current” copy in front of you is actually still current. Ask an AI system to reason across a stack of validation documents and you get exactly what you’d expect from asking a person to do the same thing by hand: slow, inconsistent, and only as good as whoever last remembered to update page 40.
Electronic records solve a different problem than documents do. A record isn’t a description of the system’s state; it traces relationships between requirements, tests, and evidence in a form both a person and an AI system can actually navigate. Change one requirement, and the record can show you, automatically, everything downstream it touches. No cross-referencing. No copy-paste errors propagating silently from one document to the next.
Where this leaves the existing standards
None of this happened in a vacuum. GAMP 5’s 2022 AI/ML Annex, 21 CFR Part 11’s risk-based approach to record integrity, and now FDA’s final CSA guidance are all pointing in the same direction: risk-based over prescriptive, continuous over point-in-time, evidence-driven over template-driven. The regulatory environment has already given the industry permission to be smarter about how it validates AI. The gap that remains isn’t in the guidance; it’s in organizational habits still built around static, paper-era documentation.
What “continuous” AI validation actually looks like
It’s not a one-time event that happens at go-live and gets revisited every few years when someone remembers. It’s closer to how software engineering teams already track change: every modification tracked at the element level, not “document updated,” but exactly what changed, what it replaced, who changed it, when. Every dependency known automatically, so changing one thing surfaces everything it affects without a human having to go looking. And critically, the documentation and the system’s own record of its state are the same artifact; there’s no separate description sitting off to the side, quietly drifting out of date the moment it’s written.
That last point is the one most validation programs still get wrong. A requirements traceability matrix built today starts aging the moment it’s finished. A record generated directly from the system’s own configuration doesn’t have that problem, because there’s nothing left to drift.
The takeaway
FDA’s final CSA guidance isn’t asking the industry to invent a new approach to AI validation. It’s catching up to, and now explicitly permitting, an approach some organizations have already started building: electronic records as the shared language between human reviewers and AI systems, audit trails as evidence, and validation as something closer to a continuously current state than a document that goes stale the day it’s filed.
The organizations that make this shift first won’t just move faster. They’ll have fewer inspection findings, because they’ll actually be able to answer the question every inspector eventually asks: what is the current validated state of this system, right now, not what the binder said at go-live.
| Curious what AI-native, electronic-record-based validation looks like in practice? Contact CIMCON to learn more about our approach to risk-based, continuously current validation documentation. |
