Validation at its limits?

Why document-heavy CSV is reaching its limits in medical technology

30.04.2026

Consulting, Future Healthcare, Healthcare and MedTech Consulting, Validation / Regulatory Affairs

Eighty percent documentation and twenty percent actual testing is what validation looks like in many medtech companies. Validation processes in medical technology were designed for a world that no longer exists. Back then, IT systems were stable, release cycles were long, and responsibilities were clearly defined.

Today, however, cloud architectures, software as a service (SaaS) platforms with monthly updates, and interconnected system landscapes dominate. This presents a structural challenge to classic computer system validation (CSV). The result? Validation isn’t becoming less secure, but it is becoming less efficient, and regulatory requirements are increasing. The MDR transition, cybersecurity requirements, and the EU AI Act demand more integrated thinking than many existing validation processes provide.

The 80/20 problem: Where your validation time really goes

A closer look at the actual effort involved is sobering. Around 80 percent of validation time is spent on documentation. Only about 20 percent is spent on testing and understanding the system. Paradoxically, approximately 80 percent of identified deviations stem not from real system errors but from test script errors or formal inconsistencies.

This structural problem becomes particularly apparent when every update requires a complete stop. For example, if a SaaS QMS provider announces a release in three weeks, the validation team needs six weeks for traditional revalidation. All options are unsatisfactory: Block the update and forego safety-related improvements. Roll it out and explain it at the next audit. Or, they must fundamentally question the validation approach. Additionally, tool proliferation increases the validation effort and widens potential traceability gaps with every additional system. Vendor tests are often duplicated instead of being used in a targeted, risk-based manner. “Compliance eats delivery” is no longer an exaggeration in many organizations, but a lived reality.

Why this is not a sign of strict regulation

The core problem does not lie in stricter regulatory requirements. The reality of the systems themselves has changed more than the regulations. The FDA has recognized this. The updated CSA guidance (Computer Software Assurance, February 2026) and the GAMP 5 second edition (2022) mark a turning point together. Both frameworks shift the focus from “Have we documented enough?” to “ “Do we have the right, robust evidence for the risk?”

This is not a reduction in compliance. It is a different foundation for compliance.

The paradigm shift has already begun

In modern systems, evidence is generated digitally in the form of test results, system logs, audit trails, and monitoring data. The crucial question is whether this evidence is collected in a targeted manner and converted into structured, traceable audit trails, or if it remains unused in the system while team members paste screenshots into Word documents.

Those who approach this paradigm shift in a structured manner can transform validation into a continuous operating model that keeps pace with CI/CD pipelines, SaaS releases, and audit requirements.

Validation at its limits?

The 80/20 problem: Where your validation time really goes

The 80/20 problem: Where your validation time really goes

Why this is not a sign of strict regulation

The paradigm shift has already begun

FAQ

Sources

Get in touch with us!