Production software in a regulated environment: what ISO 13485, the MDR and 21 CFR Part 11 require
A vendor presents its software as "ISO 13485 certified". It sounds reassuring, and it is a misnomer: no software is. What the frameworks require concerns your records and a validation you remain responsible for, whatever the vendor's own certification. Here are those requirements, and what they change when you choose a tool.
What do the regulations require?
None of these texts "certifies" software. They impose properties on your records and a validation of the tool for your use. They differ in legal nature and scope, and they do not necessarily all apply to you. Three terms come up in all of these discussions.
- CSV
- Computerized system validation: the documented process by which you demonstrate that the software does what you need, in your environment, for your use. The regulated organization remains responsible for it, even when the vendor supplies a large share of the evidence.
- Predicate rules
- The underlying FDA regulations that require a given record to be created or kept. They are what trigger 21 CFR Part 11: with no applicable predicate rule, there is no "Part 11" record. This is the starting point of any scope analysis, before audit trails or electronic signatures even come up.
- ALCOA+
- A widely used framework for data integrity: Attributable (you know who), Legible, Contemporaneous (entered when the action happens), Original, Accurate, plus complete, consistent, enduring and available. A useful good-practice framework for designing your records, which does not replace the requirements of your own regulatory framework.
| Framework | What it requires in practice |
|---|---|
| ISO 13485 | A QMS standard: certification covers your organization, never a piece of software. It requires you to validate the application of the software used in the quality system, in proportion to risk, and to control the identification and retention of records. |
| MDR 2017/745 & IVDR 2017/746 | European regulations: identification of supply chain operators, the UDI system, technical documentation kept available for a long time, post-market surveillance. High expectations for record control and integrity. |
| FDA: QMSR, Part 11, CSA | The QMSR (2 February 2026) incorporates ISO 13485:2016. 21 CFR Part 11 only covers records that fall under a predicate rule, not the mere fact of selling in the United States. The CSA guidance (2026) focuses assurance on the most critical functions. |
Operational summary: start by determining which ones actually apply to your organization. It replaces neither reading the texts nor the opinion of your regulatory affairs lead.
What should you do?
Computerized system validation is intimidating mostly because people tackle it in the wrong order. In the right order, it boils down to a few decisions, which your organization keeps whatever the software.
- Write the URS (user requirements specification) before choosing the tool: the verifiable list of what the system must allow. It is the step with the best return, and the one most often skipped.
- Assess the risk of the intended use: the impact of a failure on product conformity and patient safety sizes everything else.
- Obtain and reuse what the vendor has already demonstrated (development documentation, test protocols, matrices) rather than retesting everything.
- Carry out assurance activities in proportion to risk, IQ/OQ/PQ or a CSA approach, and trace each requirement to its test.
- Keep the validation current: assess the impact of every update and review it periodically. A validation frozen at go-live goes out of date.
- Keep the responsibility: the vendor provides evidence and support, but the validation covers your use, in your environment. It belongs to you.
A tool designed for these requirements, with support for validation
Arianis is designed for ISO 13485, MDR, GxP and 21 CFR Part 11 environments: it provides the functions needed to implement them, while the scope that actually applies is determined together. Cerebellis also provides the documentation and the method to qualify the tool within your quality system. The validation remains yours, but you do not carry it out alone.
- Time-stamped audit trail on every action, named accounts and permissions per module and per user.
- Deviations justified at the time of the operation, quality controls built into the protocols.
- Batch records exportable as PDF, native CSV exports of all data; designed, developed and hosted in France, HDS hosting as an option.
- CSV support: scope, risk analysis, testing and traceability matrices, according to the chosen method (IQ/OQ/PQ or a risk-based approach).
The Cerebellis software related to this topic
Further reading
Computerized system validation (CSV) according to GAMP 5
Software categories, V-model, risk analysis and traceability matrix: how GAMP 5 structures a risk-proportionate computerized system validation.
Medical device traceability: reconstruct a lot in seconds
What ISO 13485 and the MDR require of lot traceability, the six practical requirements to meet, and a simple test to see where yours stands.
Producing PMS and PSUR reports without rebuilding the data by hand
A PSUR links exposure, incidents, trends and actions. Why this data lives in two systems, production and quality, and how to bring it together to produce the report without re-entry.