What a Controlled Migration Takes
Whether you land on MAS or another platform, the work breaks into five workstreams. The migration workstreams post covers each in depth.
GxP Scope and Assurance Strategy
Start from intended use and what could reasonably go wrong for product quality, patient safety, record integrity, and the decisions people make from the system. Then choose assurance activities to match: scripted, unscripted, automated, or a mix. A feature name doesn’t decide the risk or the testing method.
FDA’s February 2026 Computer Software Assurance guidance covers medical device production and quality management system software under 21 CFR Part 820, as amended by the Quality Management System Regulation. Pharmaceutical manufacturers shouldn’t describe it as directly governing their Part 211 systems. Quality documents the applicable requirements and any use of the guidance’s principles within your own quality system. FDA CSA guidance
Supplier documentation helps when it’s relevant, current, and traceable. It doesn’t replace your own assessment of intended use or your verification of configuration, data, interfaces, access control, and procedures.
Data Migration and Retention
Decide what to migrate, what to keep somewhere else, and what you can retire under approved rules. Set acceptance criteria before the first trial load: counts, field values, units, relationships, attachments, signatures, and audit information. Check any plan to keep the old system running against your license and the dual support conditions above.
Functions and Processes
Separate real requirements from workarounds you built around the old system. For each required process, record the proposed design and the evidence it works, including how exceptions get handled.
Cutover, Training, and Stabilization
Name the person who can approve go-live. Define freeze windows, the final load, rollback triggers, and how work due during the switch gets captured. Train by role, and set a stabilization period with owners and exit criteria.
Integrations and Ownership
For every interface, write down the source, destination, owner, transformation, authentication, recovery behavior, and acceptance evidence. Decide who owns failures after go-live.