FDA 483 Citations for Production and Quality System Software Validation Under 21 CFR 820.70(i)
"Software used as part of [production] [the quality system] has not been [adequately] validated for its intended use according to an established protocol." FDA investigators cited 21 CFR 820.70(i) with that wording 17 times on system-generated Form FDA 483s in fiscal year 2025.
This citation is not about device software. It covers the tools a manufacturer uses to make and control devices: ERP and inventory systems, electronic batch records, complaint and CAPA databases, test station software, PLC programs, spreadsheets with calculations and electronic document control systems. If these tools do the wrong thing, they can release bad product or lose quality data without anyone noticing.
What the citation means
Examples written after "Specifically" usually describe:
A complaint, CAPA or training database used with no validation
Automated test equipment with software that was never validated for its intended use
Spreadsheets used for acceptance calculations with no verification of formulas or locked cells
Software upgrades installed with no assessment or revalidation
No inventory of software used in production and the quality system
Validation that is only a vendor certificate, with no testing of the firm's own configuration
What 21 CFR 820.70(i) required
Under the Quality System Regulation, when computers or automated data processing systems were used as part of production or the quality system, the manufacturer had to validate the computer software for its intended use according to an established protocol. All software changes had to be validated before approval and issuance. These validation activities and results had to be documented.
What changed under QMSR
Under QMSR, in effect since February 2, 2026, three ISO 13485:2016 clauses cover this software:
Clause 4.1.6: the organization must document procedures for the validation of the application of computer software used in the quality management system. The software must be validated prior to initial use and, as appropriate, after changes. The specific approach and activities must be proportionate to the risk associated with the use of the software. Records must be maintained.
Clause 7.5.6: the same requirement for software used in production and service provision.
Clause 7.6: the same requirement for software used in monitoring and measurement.
The ISO 13485 wording supports a risk-based approach. FDA's guidance on Computer Software Assurance for production and quality system software describes the same idea: focus effort on software features whose failure could compromise product quality or patient safety, and use less formal testing for lower-risk functions. Records that are kept electronically are also subject to 21 CFR Part 11 where it applies.
How to respond to the 483
FDA generally considers responses received within 15 business days of the close of the inspection before deciding on further action.
Assess the cited software and its outputs
Validate or verify the software cited. If its outputs drove acceptance or release decisions, check a sample of past results by another method to show they were correct.
Build a software inventory
List every software tool used in production, monitoring and measurement and the quality system. Record the intended use, owner, version and whether it affects product quality or quality records.
Assess risk and plan validation
For each tool, decide the risk of failure to product quality and patient safety. Plan validation proportionate to that risk: scripted testing for high-risk functions, unscripted or exploratory testing for lower-risk functions, and vendor documentation where appropriate.
Control changes
Require a change assessment and revalidation, as needed, before updates or configuration changes are released. Include vendor-pushed updates for cloud software.
Train and verify
Train system owners on the procedure and audit the inventory periodically.
What a compliant software validation procedure contains
Scope: quality system, production and measurement software
Software inventory and ownership
Intended use statements
Risk assessment method
Validation approach by risk level, including use of vendor information
Protocols, test records and reports
Change control and revalidation
Spreadsheet controls
Part 11 considerations where they apply
Periodic review
Common mistakes in software validation responses
Validating the cited system but not building an inventory
Relying on vendor certificates without testing your configuration
Applying the same heavy testing to every tool, which stalls the program
Forgetting spreadsheets and PLC programs
Ignoring software updates after validation
Example: how one response section might read
This illustrates structure only; your response must describe your own facts.
Observation 14: Software used as part of the quality system has not been validated. Specifically, the complaint handling database used to track MDR decisions has no validation.
Response:
Correction: A validation was completed on a stated date. It tested complaint intake, MDR decision fields, due date calculations and audit trails, and found one defect in the due date calculation, which was corrected and retested.
Impact assessment: MDR due dates for all complaints in the last two years were recalculated. No reports were late because of the defect.
Extended review: An inventory identified 31 software tools. Each was risk-ranked, and validation is scheduled by risk, with high-risk tools complete by a stated date.
Corrective action: A software validation procedure based on risk was issued, and change control now covers vendor updates.
Frequently asked questions
Does off-the-shelf software need validation?
Yes, for its intended use in your quality system or production. The extent depends on risk, and vendor documentation can reduce your own testing.
Do spreadsheets need validation?
Spreadsheets that perform calculations used for quality decisions do. Verify formulas, lock cells and control versions.
Is device software covered here?
No. Software in or as a medical device falls under design controls and IEC 62304 practices, not this requirement.
How A.P. Lyon documents help
A.P. Lyon's Software Validation Procedure for ISO 13485 and FDA QMSR covers inventory, risk assessment, validation by risk level and change control. It works with the Validation Protocol and Report Procedure. For device software, see the Medical Device Software Procedure Bundle.
Documents are editable Word and Excel files and must be adapted to your systems and organization. Validation testing must be performed on your own configuration.
Next steps
Validate the cited software and check past outputs
Inventory all production and quality system software
Plan validation by risk and control changes
Respond within 15 business days with dates for each action
Related guides: Process Validation Citations and Calibration Citations.
To build a complete set of procedures at a volume discount, use Build Your QMS. For help with a 483 response, see A.P. Lyon consulting services.
Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.
Comments