List of Validated Software
Summary
List of Validated Software provides centralized documentation of all computer systems and software applications that have been validated for use in quality management processes or production/service provision activities affecting medical device quality and regulatory compliance. This essential Quality Management System (QMS) record maintains current validation status, deployment information, and review schedules to ensure ongoing compliance and operational integrity.
Why is List of Validated Software important?
The List of Validated Software serves as the central registry that demonstrates systematic computer system validation across your organization. Without comprehensive tracking, organizations risk using unvalidated software, losing validation records, or failing to maintain validation currency through software updates and changes.
Regulatory compliance demands systematic documentation of validated systems. FDA Quality System Regulation (21 CFR 820.75) and ISO 13485:2016 (Section 7.5.6) require validation of processes where output cannot be verified through subsequent monitoring. The validated software list provides evidence that computer systems affecting quality are systematically controlled and maintained.
The centralized approach transforms software validation from isolated activities into systematic lifecycle management. Well-maintained software lists support audit readiness, enable proactive validation planning, and provide management oversight of information technology systems critical to quality and regulatory compliance.
Regulatory Context
Under 21 CFR Part 820 (Quality System Regulation) and 21 CFR Part 11 (Electronic Records):
- Process validation required for processes where output cannot be verified by subsequent inspection/test (21 CFR 820.75)
- Computer system validation must ensure software performs intended functions reliably
- Electronic record systems require validation demonstrating system integrity and compliance
- Documentation requirements mandate maintaining records of validation activities and results
Special attention required for:
- GAMP 5 compliance for pharmaceutical and medical device computer system validation
- 21 CFR Part 11 systems requiring enhanced validation and ongoing compliance monitoring
- Design control software requiring validation as part of design and development processes
- Quality system software supporting CAPA, document control, and management review activities
Under 21 CFR Part 820 (Quality System Regulation) and 21 CFR Part 11 (Electronic Records):
- Process validation required for processes where output cannot be verified by subsequent inspection/test (21 CFR 820.75)
- Computer system validation must ensure software performs intended functions reliably
- Electronic record systems require validation demonstrating system integrity and compliance
- Documentation requirements mandate maintaining records of validation activities and results
Special attention required for:
- GAMP 5 compliance for pharmaceutical and medical device computer system validation
- 21 CFR Part 11 systems requiring enhanced validation and ongoing compliance monitoring
- Design control software requiring validation as part of design and development processes
- Quality system software supporting CAPA, document control, and management review activities
Under EU MDR 2017/745 and ISO 13485:2016:
- Process validation mandatory where output cannot be verified through monitoring/measurement (ISO 13485 7.5.6)
- Computer system validation required for systems affecting product quality or QMS effectiveness (ISO 13485 4.1.6)
- Management system documentation must include procedures for computer system control and validation
- Risk management principles apply to software validation approaches and ongoing maintenance
Special attention required for:
- EU GDPR compliance for software processing personal data in clinical or quality contexts
- Cybersecurity validation requirements per MDCG 2019-16 guidance for connected devices
- Notified Body expectations for validated software supporting technical documentation
- Software lifecycle management when supporting clinical evaluation and post-market surveillance
Guide
Validated Software Registry Management
Maintain comprehensive software inventory documenting all validated systems used for quality management or production/service provision. Include essential information for each software including name, manufacturer, version, validation form reference, deployment status, and review schedules.
Update the list systematically when new software is validated, existing software is updated, or systems are decommissioned. Ensure accuracy by cross-referencing with Software Validation Forms and maintaining version control for software deployments.
Organize information logically using consistent categorization and naming conventions. Group software by functional area, criticality level, or validation status to support management review and audit activities.
Software Status Tracking
Document current deployment status for each validated software including “In Use” for active systems and “Decommissioned” for retired software. Maintain historical records of decommissioned software to support audit trails and regulatory inquiries.
Track validation currency through last validation dates and next review schedules. Ensure validation remains current through planned reviews, version assessments, and revalidation activities when necessary.
Monitor validation form references linking each software entry to its comprehensive validation documentation. Maintain traceability between the list entries and detailed validation records for audit and compliance purposes.
Review and Maintenance Scheduling
Establish systematic review cycles based on software risk classification and operational criticality. High-risk or critical systems may require annual reviews, while lower-risk systems might need review every 2-3 years.
Plan review activities to align with management review cycles and audit schedules. Coordinate reviews with software vendors, internal IT teams, and quality personnel to ensure comprehensive assessment of validation currency.
Document review outcomes including validation status confirmation, identification of needed updates, or requirements for revalidation. Update the list based on review findings and schedule follow-up activities as necessary.
Integration with Quality Management System
Connect validated software management with broader quality system processes including change management, risk management, and supplier control. Consider software changes through established change control procedures when updates affect validated functions.
Support audit activities by maintaining readily accessible records that demonstrate systematic software validation and ongoing control. Prepare summary reports showing validation status, overdue reviews, and validation program effectiveness for management and auditor review.
Coordinate with supplier management when software vendors perform services affecting product quality. Include vendor assessment in software validation approaches and maintain appropriate agreements for software support and change notification.
Software Lifecycle Management
Plan for software evolution including version updates, technology changes, and end-of-life transitions. Evaluate software changes for impact on validated functions and determine revalidation requirements systematically.
Manage software transitions including migration to new systems, data conversion activities, and parallel operation periods. Document transition activities and verify validation status throughout change processes.
Address software obsolescence through sunset planning, alternative software evaluation, and validation transfer activities. Maintain business continuity while ensuring validation compliance during software lifecycle transitions.
Example
Scenario: Your medical device organization uses multiple software systems for quality management and production activities including an electronic Quality Management System (eQMS), laboratory information management system (LIMS), enterprise resource planning (ERP) system, and various design control software tools.
Software Inventory Development
You document all validated software in your list including: FormlyAI eQMS v2.3 (critical quality management), LabTech LIMS v4.1 (critical production testing), SAP ERP v12.2 (non-critical business operations), AutoCAD v2024 (critical design control), and MATLAB v2023b (critical design verification).
Validation Status Documentation
Each software entry references its Software Validation Form document number, showing complete validation documentation. You document last validation dates ranging from recent (eQMS - 3 months ago) to older validations requiring review (MATLAB - 18 months ago). Next review dates are scheduled based on software criticality and risk assessment.
Deployment Status Tracking
All systems show “In Use” status except for legacy eQMS v1.8 which shows “Decommissioned” following migration to current version. You maintain decommissioned entries for audit trail purposes while clearly indicating they are no longer active in your operations.
Review Schedule Management
Critical systems (eQMS, LIMS, AutoCAD) have annual review schedules aligned with management review cycles. Non-critical systems (ERP) have biennial review schedules. You track review completion and update validation status based on findings.
Ongoing Maintenance
During quarterly management reviews, you report validation status including completed reviews, overdue validations, and planned software changes requiring revalidation. The list serves as your central reference for software validation compliance and planning.