# When Your Ops System Became a Validated System

Three regulatory changes in the last ten months expanded what counts as regulated software. QMSR now treats the quality system as one connected whole, and operations software that used to sit outside the inspection lens is inside it. If your team built its own ops platform, the validation burden lands on you.

## Download the full white paper as a PDF

[Download PDF](https://linkly.link/2hkll)

# Contents

1. [Glossary](/content/resources/validation-burden-custom-ops/#section-glossary/index.html)  
2. [Three things changed in ten months](/content/resources/validation-burden-custom-ops/#section-01/index.html)  
3. [The scope widened — here is where](/content/resources/validation-burden-custom-ops/#section-02/index.html)  
4. [What QMSR specifically asks you to show](/content/resources/validation-burden-custom-ops/#section-03/index.html)  
5. [GAMP Category 5: the classification you inherit](/content/resources/validation-burden-custom-ops/#section-04/index.html)  
6. [What Cat 5 validation actually requires](/content/resources/validation-burden-custom-ops/#section-05/index.html)  
7. [Build-vs-buy, reframed](/content/resources/validation-burden-custom-ops/#section-06/index.html)  
8. [What we learned validating with a customer in April 2026](/content/resources/validation-burden-custom-ops/#section-07/index.html)  
9. [The decision framework](/content/resources/validation-burden-custom-ops/#section-08/index.html)  
10. [Sources](/content/resources/validation-burden-custom-ops/#sources/index.html)

# Glossary

## The acronyms, decoded

- **QSR (Quality System Regulation, 21 CFR Part 820)**: The US FDA regulation that governed medical device quality systems from 1996 until February 2, 2026. Included §820.70(i), which required validation of production and quality system software.  
- **QMSR (Quality Management System Regulation)**: The regulation that replaced the QSR effective February 2, 2026. Incorporates ISO 13485:2016 by reference. Broader software validation scope, stronger enterprise-wide QMS framing, and tighter outsourcing and traceability expectations than the QSR it replaced.  
- **ISO 13485:2016** — Clauses 4.1.6 and 7.5.6: The international standard for medical device quality management systems. Clause 4.1.6 requires validation of software used in the QMS. Clause 7.5.6 requires validation of software used in production and service provision. Both are now in US scope via QMSR.  
- **CSV (Computer System Validation)**: The traditional approach to validating regulated software. Document-heavy. Based on the V-Model: user requirements paired with verification/qualification steps (URS → IQ → OQ → PQ). Still the default expectation for many inspectors.  
- **CSA (Computer Software Assurance)**: FDA guidance finalized in September 2025. Risk-based, critical thinking–first alternative to CSV. The final version explicitly applies to AI tools used in production or quality systems.  
- **GAMP 5 (Good Automated Manufacturing Practice)**: ISPE's industry framework for validating computerized systems in regulated environments. Categorizes software by risk and configurability. Second edition published 2022. Updated AI guidance released July 2025.  
- **GAMP Category 5**: The highest-risk GAMP classification. Custom-developed software — including in-house code and outsourced bespoke applications — that performs regulated functions. Requires the full validation lifecycle.

### QMSR Expansions

1. The QMS is one connected system, not several.  
2. Management review has teeth in ISO 13485:2016.  
3. Outsourced activities come inside the system.  
4. Traceability spans PLM and QMS.  
5. Audit access extends into operations systems.

# Sources

### Primary regulatory sources

1. US FDA. ["Medical Devices; Quality System Regulation Amendments."](https://www.federalregister.gov/documents/2024/02/02/2024-01709/medical-devices-quality-system-regulation-amendments) Final rule, 89 FR 7496, February 2, 2024. Effective date February 2, 2026. Incorporates ISO 13485:2016 by reference.  
2. ISO 13485:2016 — Medical devices — Quality management systems — Requirements for regulatory purposes. Clauses 4.1.6 (QMS software validation), 5.6 (management review), 7.4 (purchasing and outsourced processes), and 7.5.6 (production and service software validation).  
3. 21 CFR §820.70(i) — Automated processes. Pre-QMSR validation requirement for production and QMS software, effective 1997.  
4. 21 CFR Part 11 — Electronic Records; Electronic Signatures.