Cloud platforms, SaaS, connected equipment, AI-enabled systems, and increasingly integrated ERP and MES environments are evolving faster than traditional validation practices were designed to accommodate throughout manufacturing environments.

The challenge isn't simply that technology is changing faster than regulations. Many organizations still validate modern systems based on assumptions from an earlier generation of technology.

Podcast: Realizing the full potential of connected worker solutions in the AI era

Traditional computerized system validation was built around a relatively straightforward premise: Organizations can exert substantial control over the systems they were validating. Software, infrastructure, equipment, and data flows were more likely to exist inside organizational boundaries. Validation could therefore emphasize extensive documentation and testing of the system itself.

That model becomes harder to sustain when the system is a cloud service maintained by an external provider, updated continuously and integrated with other applications and data sources. It becomes even more complicated when AI is introduced.

The result is tension between the speed at which manufacturers need to adopt technology and the time and resources required to demonstrate that those technologies remain fit for their intended use.

From exhaustive validation to risk-based assurance

Regulations are evolving because of this. In the U.S., the FDA's Computer Software Assurance approach has encouraged organizations to move toward risk-based assurance rather than treating every software function as though it presents the same level of risk.

That distinction matters.

See also: Why manufacturers are rethinking system integration

A cloud-based enterprise system may contain hundreds or thousands of functions, but not all of them have the same impact on product quality, patient safety, or data integrity. Validating every element with the same rigor can consume significant resources without proportionately increasing confidence in the system.

A more risk-based approach lets organizations consider the system's intended use and focus validation activities where failure could have meaningful consequences.

Cloud migration illustrates the difference particularly well. Under a traditional CSV model, an organization might attempt to generate extensive evidence across the software environment. But a SaaS provider controls much of the underlying development and infrastructure. The customer cannot realistically reproduce or independently validate every element of the vendor's software lifecycle.

Instead, organizations can leverage supplier assessments, vendor quality systems, certifications, and existing vendor documentation where appropriate, while focusing their testing on how the system will actually be used.

That doesn't mean reducing rigor, but it does mean applying it where it matters.

When legacy validation becomes an operational risk

Maintaining an outdated validation model doesn't always lead to dramatic system failures. In many cases, the risk is high cost, delayed deployments, unnecessary rework, and reliance on manual procedures to compensate for deficiencies in the validation process.

See also: ServiceNow research warns of ungoverned agentic AI risks

Many manufacturing organizations still run “legacy” systems designed 20 or 30 years ago. Those systems reflect a more paper-based environment and may treat equipment, software, and validation as separate domains.

Modern manufacturing systems are different. Hardware, software, cloud services, data, and connected processes increasingly operate as a single environment.

When continuing to assess those environments through disconnected testing processes, gaps can emerge.

Consider a manufacturer implementing a cloud-based electronic quality management system. This business may attempt to validate the platform using a conventional CSV approach. Still, a traditional model assumes a degree of control over the software development lifecycle that the customer does not have with a SaaS platform.

The result is not necessarily a defective system. Still, it involves spending considerable time and effort validating things it doesn’t control while overlooking the areas it does (like configuration, intended use, data flows, integrations, user access, and the processes surrounding the system).

See also: The death of conversational chatbots in industrial organizations

Validation cycles consume resources, and delayed deployments can postpone process improvements. Likewise, excessive documentation obscures the evidence that actually matters, and organizations may resort to manual logs, procedural workarounds, and other compensating controls that become increasingly difficult to sustain.

The objective should not be less validation. It should be better validation.

The emergence of continuous assurance

The next step is moving beyond the idea that validation happens before a system goes live.

Modern systems change continuously: Software is updated; integrations evolve; and data sets grow. As a result, new functionality is introduced, and users find new ways to apply technology. AI models can also surface additional considerations around data, performance, human review, and changing outputs.

That means confidence in a system cannot depend entirely on evidence collected at a single point in time.

Continuous monitoring offers a different model.

In quality investigations and CAPA management, for example, AI can analyze deviations, investigations, and corrective actions to spot patterns and recommend potential root causes. A qualified employee can review those recommendations, assess the evidence, and make the final decision.

The value isn't simply that AI performs analysis faster. It can help organizations see patterns that would be difficult or time-consuming to detect through manual review, while keeping human accountability for critical decisions.

See also: How manufacturers are using digital twins to make real-time decisions

The same principle can apply to lab data. AI-enabled systems can continuously monitor analytical results, identify anomalies or deviations, and prioritize exceptions for human review. Instead of asking employees to examine every data point with equal attention, organizations can focus expertise where the system flags a reason for more investigation.

In manufacturing, continuous monitoring can extend into production itself. AI-enabled vision systems and sensors can identify defects or process deviations as they occur rather than waiting for those issues to emerge during batch review or after product release.

This changes the role of validation.

Rather than proving once that a system worked as intended, leaders need to demonstrate that the solution continues to work as intended as conditions change.

How AI raises the stakes

AI makes this shift particularly important because traditional validation assumptions become even harder to apply.

An AI-enabled system may produce recommendations rather than deterministic outputs. Its performance can depend on the quality and characteristics of the data it receives; a process may also change as organizations expand how they use it.

That does not make AI incompatible with regulated manufacturing. However, it means organizations need to define where AI can operate, what risks it introduces, how it will monitor performance, and where human involvement remains mandatory.

The most practical model today is not fully autonomous but requires humans-in-the-loop operation, in which AI identifies patterns, provides recommendations, and prioritizes exceptions. At the same time, qualified personnel retain responsibility for consequential decisions.

That approach also points to a more substantial principle for modern validation: Assess technology by the risk associated with its intended use, not by the tech category itself.

Validation needs to become an operational discipline

The challenge for manufacturers is therefore larger than updating a validation procedure.

Organizations need technology roadmaps and validation strategies that recognize how modern systems actually operate. That means accounting for cloud providers, third-party suppliers, cybersecurity, privacy, data governance, system integrations, and ongoing change alongside traditional quality considerations.

This also means that documentation is evidence, not the objective. The objective is confidence that a system is appropriate for its intended use and that critical risks remain controlled throughout its lifespan.

See also: Q&A: 3D printing creator speaks on additive’s future

As manufacturing technology keeps advancing, the organizations that adapt their validation practices will have an advantage beyond regulatory compliance. They will deploy useful technologies faster, spend validation resources where they matter most, and detect problems before they become expensive operational events.

The future of validation is therefore unlikely to be about validating more.

It will be about knowing what to validate, understanding why it matters, and maintaining confidence as the technology changes.