Replaces the September 2023 final guidance. Title updated from "Quality System" to "Quality Management System" reflecting the QMSR final rule (21 CFR Part 820, effective February 2, 2026), which incorporates ISO 13485:2016 by reference. Core requirements for SPDF, premarket cybersecurity documentation, SBOM submission, and CVD policy remain. Adds terminology (Threat surface, Quality of Service) in Appendix 5.

FDA final guidance (Feb 2026) on risk-based assurance for software used in medical device production and quality management systems. Supersedes the September 24, 2025 version, with the title updated from "Quality System Software" to "Quality Management System Software" to align with the QMSR (21 CFR Part 820 / ISO 13485:2016 harmonization effective February 2, 2026). Replaces Section 6 of the 2002 GPSV. Does NOT apply to SaMD/SiMD.

Final guidance clarifying the regulatory status of Clinical Decision Support (CDS) software under Section 520(o) of the FD&C Act. Defines criteria distinguishing device CDS (subject to FDA oversight) from non-device CDS (exempt). Addresses application to AI/ML-based CDS functions and provides examples across clinical specialties.