GAMP 5 is the internationally accepted guidance for validating computerized systems in GxP-regulated environments — pharmaceuticals, biotech, medical devices, and food. Published by ISPE, it gives regulated companies a risk-based, scalable framework for determining how much validation work each software system requires. The Second Edition, published in July 2022, introduced agile development support, updated cybersecurity and cloud guidance, and aligned with FDA's Computer Software Assurance (CSA) guidance. Understanding GAMP 5 software categories and lifecycle principles is the starting point for any GxP computer system validation program.

What GAMP 5 is

GAMP stands for Good Automated Manufacturing Practice. GAMP 5 is the fifth edition of the guidance originally developed in 1991 by a group of UK pharmaceutical engineers working to meet FDA expectations on automated manufacturing systems. ISPE (International Society for Pharmaceutical Engineering) has published and maintained the guidance since the formal partnership began in 1995.

The full title of the current version is "GAMP® 5: A Risk-Based Approach to Compliant GxP Computerized Systems (Second Edition)," published in July 2022 by ISPE. The guidance is advisory — it carries no direct legal obligation. However, the FDA, EMA, and other regulatory agencies worldwide reference and respect GAMP 5 as the industry standard for computer system validation (CSV).

According to ISPE, GAMP 5 aims to deliver a cost-effective framework of good practice to ensure that computerized systems are effective, of high quality, and compliant with applicable regulatory requirements.

Why regulated companies follow GAMP 5

GAMP 5 addresses a practical problem: not all software systems in a regulated facility carry the same risk to patient safety, product quality, or data integrity. An operating system that runs a desktop computer carries different risk than a manufacturing execution system that controls batch production. Treating both with identical validation rigor is wasteful. Treating the manufacturing system too casually creates regulatory exposure.

GAMP 5 solves this with a risk-based categorization system and a lifecycle framework that scales validation effort to actual system risk. The result is a validation program that is defensible in an FDA inspection, proportional to the criticality of each system, and practical enough to execute without consuming the entire quality team's capacity.

The guidance applies across GxP domains — Good Manufacturing Practice (GMP), Good Clinical Practice (GCP), Good Laboratory Practice (GLP), Good Distribution Practice (GDP), and pharmacovigilance. It works in conjunction with 21 CFR Part 11 for electronic records and electronic signatures, EU GMP Annex 11, ISO 13485, and ISO 14971.

The four GAMP 5 software categories

The software category system is the practical core of GAMP 5. Each category defines the level of validation evidence required. The Second Edition retained the same four active categories as the first edition. Category 2 (firmware), which appeared in the earlier GAMP 4 guide, was removed.

Category 1: Infrastructure software

This covers operating systems, databases, middleware, network software, and other base-layer technology. Category 1 software is generally not subject to specific functional verification — the focus is on installation qualification and maintaining the system in a known, controlled state. Examples include Windows Server, Oracle Database, and network monitoring tools.

Category 3: Non-configured products

These are commercial off-the-shelf (COTS) software products used without any configuration specific to the regulated use. The software performs a defined function that does not vary based on user settings. Validation focuses on confirming that the software performs its intended function in the user's environment. Examples include standard statistical analysis software or laboratory equipment software used without customization.

Category 4: Configured products

This is the most common category in regulated pharmaceutical and medical device environments. Category 4 covers commercial software that is configured to meet the user's specific requirements — but where configuration stays within the limits the software developer designed. ERP systems, laboratory information management systems (LIMS), and quality management systems fall into this category. Validation covers installation qualification, operational qualification, and confirmation that the specific configuration performs as specified in the user requirements.

Category 5: Custom applications

These are software systems built specifically for the regulated company's use, either developed in-house or by a third party on a custom basis. Category 5 systems carry the highest validation burden because there is no supplier validation package to leverage. Validation must cover design specifications, code review, unit testing, integration testing, and full IQ/OQ/PQ protocols. Custom manufacturing control systems and bespoke data acquisition applications are typical examples.

For eQMS platforms like Cloudtheapp, which are commercial SaaS products configured to the customer's quality processes, GAMP Category 4 validation applies. The supplier (Cloudtheapp) provides a validation package covering the platform itself; the customer's validation effort focuses on configuration qualification and user acceptance testing for their specific setup.

The GAMP 5 validation lifecycle

GAMP 5 organizes validation work around four lifecycle stages: Concept, Project, Operations, and Retirement.

Concept

At this stage, the regulated company identifies the need for a computerized system, defines initial requirements, and assesses potential solutions. The Concept stage falls largely outside the GAMP validation scope for the system itself, but it establishes the foundation for everything that follows — particularly the User Requirements Specification (URS) that will drive all subsequent validation activities.

Project

This is where the system is designed, developed, deployed, and assessed for GxP compliance. The first edition of GAMP 5 relied on the V-model (a linear development approach that maps specification activities to corresponding verification tests). The Second Edition added full support for agile development methodologies, recognizing that SaaS platforms, AI systems, and machine learning applications operate on continuous release cycles that the traditional waterfall model cannot accommodate.

Under the agile approach, validation documentation evolves alongside the system, with testing integrated into each development sprint rather than deferred to a final validation phase. The core principle is the same — documented evidence that the system performs as intended — but the mechanism adapts to the development model.

Operations

This is typically the longest lifecycle stage. The system is in active use, and the objective is to maintain it in a validated state. Key activities in the Operations phase include change control, periodic review, audit trail review, and incident management. Every change to a validated system must be assessed for impact on the validated state, documented, and tested if the impact assessment identifies risk.

Retirement

When a system reaches end of life, the Retirement stage addresses data migration or archival, system decommissioning, and documented evidence that regulated data has been preserved in a retrievable format. GAMP 5 does not define a separate Retirement stage formally, but the guidance in the Operations stage covers the planning and execution required.

The five key GAMP 5 principles

The GAMP 5 guidance rests on five principles that shape how validation work is planned and executed.

Product and process knowledge. Validation decisions should be driven by genuine understanding of what the system does and how it affects GxP activities — not by following a documentation template mechanically. Risk-based decisions require knowing what matters.

Lifecycle approach. Validation is not a one-time event at system go-live. It extends across the entire system lifecycle, from concept through retirement. This means periodic reviews, change control, and ongoing evidence of controlled operation.

Scalable. The depth of validation should match the system's risk profile. A low-risk Category 1 infrastructure component does not require the same documentation depth as a Category 5 custom application that controls a manufacturing process. GAMP 5 explicitly supports reduced documentation where the risk justifies it.

Quality risk management. Risk assessment determines which system functions require the most validation attention. GAMP 5 2nd Edition reinforced the shift toward testing-focused validation over documentation-heavy approaches, supporting exception-based reporting where a simple "Pass" is sufficient for tests that execute as expected.

Leverage supplier activity. When a supplier provides a validated platform with supporting documentation — installation guides, validation packages, release notes, test evidence — the regulated company can leverage that documentation rather than duplicating the work. This is the foundation of the supplier leverage model for Category 4 SaaS platforms.

GAMP 5 and FDA's Computer Software Assurance guidance

The 2022 Second Edition of GAMP 5 explicitly aligned with FDA's September 2022 draft guidance on Computer Software Assurance (CSA) for Production and Quality System Software. The FDA's CSA guidance represents a philosophical shift away from documentation-heavy validation toward testing-critical-thinking-driven assurance.

The core message in both documents: validation effort should focus on critical functions that affect patient safety, product quality, and data integrity. Generating paper to satisfy a checklist — without genuine testing or critical thinking — provides no real assurance and diverts resources from meaningful quality work.

For quality teams, this alignment means GAMP 5 and FDA expectations are now more consistent than at any point in the history of computer system validation. Teams that follow GAMP 5 principles are building validation programs that FDA inspectors increasingly expect to see.

GAMP 5 in practice: what your validation program should include

A GAMP 5-compliant validation program for a Category 4 system typically includes:

A User Requirements Specification (URS) that documents what the system must do from the regulated company's perspective, with traceability to GxP requirements.

A supplier assessment that evaluates the vendor's quality management system, development practices, and available validation documentation. For cloud-based eQMS platforms that maintain a pre-validated environment and update documentation with each release, this step is significantly reduced.

An Installation Qualification (IQ) that confirms the system was installed correctly in the intended environment, per the supplier's specifications.

An Operational Qualification (OQ) that confirms the system functions as specified under defined conditions.

A Performance Qualification (PQ) / User Acceptance Testing (UAT) that confirms the system meets business requirements in actual use conditions.

Change control and periodic review procedures that maintain the validated state across the Operations lifecycle stage.

How an eQMS supports GAMP 5 validation

Cloudtheapp's platform is a pre-validated, cloud-based eQMS built on GAMP Category 4 validation principles. The platform runs on AWS with a supplier-maintained validation package that covers each release, including installation qualification documentation, test evidence, and release notes — all provided to customers to support their own validation obligations.

The 60+ applications on the Cloudtheapp platform — covering document control, audit trail management, CAPA, supplier qualification, and change management — are designed to operate in 21 CFR Part 11-compliant environments, with electronic records and signatures that meet FDA data integrity expectations.

For quality teams building or refreshing their computer system validation program for a new eQMS, Cloudtheapp provides the supplier documentation package, validation support, and a pre-configured validation template set that dramatically reduces the time required to complete IQ/OQ/PQ documentation.

See how Cloudtheapp supports GAMP 5-compliant validation

Common GAMP 5 questions

Is GAMP 5 mandatory?

No. GAMP 5 is advisory guidance published by ISPE, not a regulatory requirement. However, it is the globally recognized standard for GxP computer system validation, and FDA inspectors regard GAMP 5-based validation programs as evidence of a mature quality system approach.

What changed in GAMP 5 Second Edition?

The 2022 Second Edition added agile development support, updated guidance on cybersecurity and cloud computing, addressed AI and machine learning applications, incorporated Blockchain/distributed ledger systems, and aligned explicitly with FDA's Computer Software Assurance draft guidance. The software categories themselves remained the same.

What is the difference between CSV and CSA?

Computer System Validation (CSV) is the traditional term for the documented process of proving a GxP system performs as intended. Computer Software Assurance (CSA) is the FDA's more recent framing, which emphasizes critical thinking and testing over documentation generation. GAMP 5 Second Edition aligns with both framings and supports transitioning from documentation-heavy CSV to more risk-proportional CSA approaches.

Does GAMP 5 apply to cloud-based systems?

Yes. The Second Edition includes updated guidance specifically addressing cloud computing, SaaS, and infrastructure as a service (IaaS). The key principle for cloud systems is clarifying responsibilities between the cloud service provider and the regulated customer — particularly around data security, access control, change management, and business continuity.

Conclusion

GAMP 5 gives regulated companies a practical, risk-based structure for validating the software systems that support GxP activities. The software category system scales validation effort to actual risk. The lifecycle framework ensures validation is not a one-time event but a maintained state across the system's operational life. The Second Edition's alignment with FDA's CSA thinking makes GAMP 5 more current and defensible than ever.

For organizations deploying or upgrading an eQMS, applying GAMP 5 principles from the outset — starting with a clear URS, a structured supplier assessment, and a proportional IQ/OQ/PQ program — builds a validation record that holds up in an inspection and sustains the validated state over time.

Request a demo to see how Cloudtheapp supports GAMP 5-compliant validation

This post created by and appeared first on Cloudtheapp