The Rules Haven't Change. The Expectations Have.
By
"The regulations, the statutes are the law. The guidance documents are just a nice-to-have. Your companies are required to figure out what and how to apply those rules." — Panel, KENX Summit, March 19, 2026
I spent this morning on stage at the KENX Validation University and Pharmaceutical Engineering Summit in Philadelphia — first as session moderator, then as panelist alongside FDA, medical device, pharma, and software voices that rarely share the same room. What emerged was not a rehearsed regulatory update. It was an honest, at times uncomfortable, reckoning with where our industry actually stands on digital validation, AI adoption, and quality culture.
Here is what every quality leader, validation engineer, and executive sponsor needs to take back to their organization from today.
Signal 1: FDA Inspectors Are Not Grading Your CSA Compliance — They're Testing Your Thinking
Daniel Walter, who has been embedded in the Computer Software Assurance guidance since its inception, made a point that should reframe how every organization prepares for inspections. CSA is non-binding guidance. It did not change a single regulation. The only regulatory text it touched was the General Principles of Software Validation — itself also guidance.
What inspectors are looking for when they walk in the door is your rationale. Not your template. Not your checklist. Your rationale. The question they are trained to ask sounds something like: "Walk me through how you determined that this system was direct impact versus support software." If you cannot explain it to someone who has never seen your facility, you have a documentation problem — regardless of how many IQ/OQ/PQ protocols are on file.
You just have to be able to explain it to somebody who doesn’t know what they’re talking about. If it doesn’t make sense, they might write it on a 483.
Daniel Walter, FDA CDRH — KENX Summit 2026If your validation program is built around generating documents that satisfy a checklist rather than demonstrating defensible risk decisions, you are producing compliance theater. The Ascend methodology is designed precisely to close this gap — risk-first rationale, documented traceability, human-reviewable logic.
Signal 2: The QSR/ISO 13485 Harmonization Is Not a Medical Device Story — It's a QMS-Wide Reset
Effective February 2, 2026, the FDA's Quality Management System Regulation harmonized 21 CFR 820 with ISO 13485 through incorporation by reference. This is not a paperwork update. Under the old regulation, the word "risk" appeared once — in the software validation provision. Under the harmonized rule, risk is referenced over thirty times, spread across the entire quality system: feedback loops, corrective actions, purchasing controls, design controls, and management review.
The shift in audit posture is equally significant. The old Qsit framework audited by subsystem checklist. The new approach is process-based and management-accountability-focused. Auditors are no longer asking "show me the document." They are asking "show me you understand the process and that your leadership owns the risk."
For companies operating dual regulatory environments — FDA and EU — the harmonization eliminates much of the redundancy. But it raises the floor for everyone. If your QMS was designed to satisfy a checklist, it was not designed for this moment.
Medical device and combination product clients should audit their current PQPs and QMS documentation against the expanded risk language now — not at the next scheduled review cycle. This is Month 3 work, not Year 2 work.
Signal 3: "Digital" Is Not Enough — The Industry Needs a Digital Thread
This was one of the clearest and most practically useful distinctions made all morning. Digitization means converting paper to electronic format. Digitalization means transforming how processes operate. But neither of these achieves what the industry actually needs: a digital thread — an unbroken chain of custody connecting requirements, validation documentation, test execution, and quality records across systems.
The problem most organizations have is not that they went paperless. It is that their QMS is in one system, their validation documents are on SharePoint, their test execution is in a separate tool, and no one can see the relationship between them without heroic manual effort. That is not a digital quality system. That is digital filing.
The ISPE Digital Validation Tool Good Practice Guide — referenced by name on stage — offers a roadmap from business case through enterprise-level digital thread implementation, including remote regulatory assessment readiness. If your leadership team does not have this document, get it.
|
01
Digitization
Paper converted to electronic records. Necessary but not sufficient. |
02
Digitalization
Processes redesigned for digital operation. Closer, but still siloed. |
|
03
Digital Thread
Connected chain of custody from requirements through execution. This is the target. |
04
Enterprise Digital
Corporate-level governance driving consistent standards across facilities and functions. |
Signal 4: The AI Adoption Catch-22 Has a Solution — and It Starts Small
The head of AI at Sinton Software named the barrier that stops most life sciences organizations cold: you need results to justify AI adoption, but you need adoption to get results. Organizations sit in paralysis waiting for someone else to go first.
The practical answer offered on stage was validation as a service — using a third-party AI-enabled vendor to run a parallel document generation exercise alongside your existing process. No infrastructure commitment. No IT engagement. No upfront validation of the tool required. You generate the documents both ways, compare quality and cycle time, and make a data-driven business case. Sixty percent of a recently surveyed webinar audience reported already working with third parties on validation document generation. This is not novel. It is already happening.
The more important point: the risk profile of getting started is far lower than the perceived risk. The risk of not starting, meanwhile, is becoming very real.
What used to take six months is now taking six hours or six days, max. Culture is the issue — not the technology.
Khalid Mousally— KENX Summit 2026A claim was made on stage that FDA 21 CFR explicitly prohibits the use of generative AI for GXP activities. That framing requires scrutiny. The current FDA guidance posture on AI and software lifecycle — including FY2026 docket items — is more nuanced. Operational efficiency use cases are explicitly outside scope of GXP oversight, but that does not mean all GXP-adjacent AI use is prohibited. Organizations should not anchor on a blanket prohibition without reviewing the actual regulatory text. ProcellaRX can assist with that classification exercise.
Signal 5: AI Will Expose Your Silos Whether You Are Ready or Not
This was the most direct and important observation of the morning. Daniel Walter noted that AI — deployed at scale within any organization — will surface collaboration gaps that have been tolerated for years. The quality person who never talks to the software engineer. The engineering team that does not understand the regulatory rationale. The management layer that approves quality programs without understanding them. AI will find these gaps and make them visible to people you would rather not inform.
The implication is not that AI is a surveillance tool. The implication is that organizational silos carry regulatory and operational risk that has been invisible because humans have been absorbing it through manual effort and institutional memory. When AI accelerates throughput and removes friction, the gaps become structural rather than personal.
The organizations that will benefit most from AI in validation are those that have done the harder cultural work first: cross-functional communication, shared vocabulary between quality and engineering, and management accountability that is not performative. Those organizations will use AI to accelerate what already works. Everyone else will use AI to expose what doesn't.
What the Greenfield Moment Tells Us About Legacy Organizations
One of the most compelling voices in the room was a practitioner from a clinical software startup that had the advantage of beginning validation programs from scratch — no legacy paper, no inherited systems, no brownfield constraints. They started with a validated lifecycle system from day one, adopted AI-assisted development early, and built audit trail and traceability into the foundation rather than retrofitting it later.
The honest assessment: newer organizations without legacy debt have a structural advantage in this transition. Established organizations are not disqualified — but they face a deliberate choice about where the brownfield ends and where the greenfield begins. That is a governance conversation, not a technical one. And it belongs in the executive suite, not just the quality team.
The Line That Should Hang in Every Quality Department
Near the close of the session, one observation cut through everything else: medical technologies ranks dead last in technology adoption across all industry sectors. The mindset, as one panelist summarized it, has historically been: "If I don't have to pay for it, I ain't gonna."
That posture is no longer viable. The financial sector is using AI to make pacemakers. Regulatory bodies are using AI for remote assessments. The tipping point has arrived, and the question is no longer whether your organization needs to move — it is whether you are going to lead that movement or be dragged into it.
Every single thing you do, every time you breathe, is a risk. We can’t document them all — but we can document the ones where we acknowledge we need controls. Do that collectively, and maybe we actually make a change for the world.
Dori Gonzalez-Acevedo — KENX Summit 2026ProcellaRX Perspective
What This Means for Where We Go from Here
ProcellaRX was in the room today not just as observers but as practitioners. The Ascend methodology — our structured approach to risk-based, defensible digital validation — was designed in direct response to the regulatory and organizational realities surfaced in sessions like this one. The five signals above are not abstract industry trends. They are the operating conditions your quality programs need to be built for, right now.
If your organization is asking any of the following questions, it is time to talk:
- How do we translate CSA into a defensible validation rationale without generating more documentation theater?
- What does the QSR harmonization mean for our existing PQPs and QMS structure?
- How do we build a business case for AI-enabled validation without a prior AI track record?
- Where does our brownfield end and where should our greenfield begin?
- How do we connect our quality, engineering, and regulatory functions before AI exposes the gap for us?
These are governance questions with technical dimensions — and they are exactly what ProcellaRX is built to help you answer.
Ready to move from compliance theater to digital thread?
Connect with the ProcellaRX team to discuss how the Ascend methodology applies to your organization's current validation and quality governance posture.
Start the Conversation
