GAMP 5 Second Edition Playbook
GAMP 5 Second Edition — Agile, critical thinking, CSA alignment — translated into the actual document set, test strategy and roles for your systems.
GAMP 5 is ISPE's guide to validating computerised systems in regulated life sciences. Its Second Edition, published in 2022, aligns with FDA's Computer Software Assurance thinking and adds guidance on Agile delivery, cloud services and critical thinking. Its central device is the software category — 1, 3, 4 or 5 — which determines how much of the validation lifecycle applies.
- Signer’s name
- Date and time
- Meaning of the signature
- Entry in the audit trail
The software categories, and what each one costs you
Categorisation is the single highest-leverage decision in a validation project. Get it wrong upward and you spend months you did not need; wrong downward and you under-document a system that mattered.
- 1
Category 1 — Infrastructure software
Cat 1Operating systems, databases, middleware. Qualified as infrastructure and recorded, not validated as an application.
- 2
Category 3 — Non-configured products
Cat 3Used as supplied, default configuration only. Validation focuses on intended use and installation; supplier evidence carries more weight.
- 3
Category 4 — Configured products
Cat 4Commercial software configured to your process. Requires a configuration specification and testing of the configuration you actually applied.
- 4
Category 5 — Custom applications
Cat 5Bespoke code written for you. The full lifecycle applies, including design specification and code review.
- 5
Mixed-category systems handled
A configured platform with custom extensions is both. Categorise by component rather than forcing one label on the whole system.
- 6
Categorisation justified in writing
Especially where you have categorised downward. 'Category 3' on a heavily configured system is a question waiting to be asked.
What the Second Edition actually changed
If your procedures still reference the First Edition, these are the gaps worth closing first.
- 7
Critical thinking made explicit
The guide now expects documented reasoning about what matters, rather than uniform application of a template.
- 8
CSA alignment
Risk-based testing depth, unscripted testing and supplier-evidence leverage are recognised rather than tolerated.
- 9
Agile and iterative delivery
Guidance on validating systems delivered in increments, with gates that fit sprints rather than waterfall phases.
- 10
Cloud and service providers
How to assess and rely on a SaaS provider's controls, and what remains yours regardless of the deployment model.
- 11
Data integrity woven through
Treated as a lifecycle property rather than a separate assessment appended at the end.
Right-sizing the document set
The deliverables that apply, by category. Document the exclusions — an item left out with a rationale is defensible; an item simply absent is a finding.
- 12
Validation plan
Cat AllAlways required, whatever the category.
- 13
User Requirement Specification
Cat AllAlways required. Numbered and testable, because everything downstream traces to it.
- 14
Functional specification
Cat 4, 5Required for configured and custom systems.
- 15
Configuration specification
Cat 4Required where a commercial product is configured.
- 16
Design specification and code review
Cat 5Required for custom development.
- 17
Supplier assessment
Cat 3, 4, 5Scales with how much of their evidence you intend to rely on.
- 18
Traceability matrix
Cat AllAlways required. It is the document that makes the rest navigable.
Validating in an Agile delivery model
The Second Edition accepts iterative delivery. What it does not accept is evidence assembled retrospectively at the end of a release.
- 19
Requirements managed as a living backlog
Still uniquely identified and traceable, even when they arrive incrementally.
- 20
Quality gates defined per increment
What must be true before an increment can move toward production.
- 21
Evidence captured continuously
Automated test results retained as validation evidence, with the test framework itself qualified.
- 22
Release decision formally recorded
Someone accountable approves the release into GxP use, however incremental the delivery was.
GAMP 5 is industry guidance from ISPE, not a regulation. Regulators recognise it as good practice, but you are assessed against the regulations themselves — 21 CFR Part 11, EU GMP Annex 11 and the relevant predicate rules.
The categories are a tool for sizing effort, not a compliance verdict. A correctly categorised Category 3 system with a documented rationale is in better shape than a Category 5 package assembled without one.
This is a working aid, not a regulatory document, and it does not replace your own quality system procedures.
Explore related resources, products and services: GxP Copilot, TraceDraft, validation services, AI transformation.
Sources
Primary documents referred to on this page, from their official publishers.
- 21 CFR Part 11: Electronic Records; Electronic Signatures · eCFR (US)
- Computer Software Assurance for Production and Quality Management System Software (final guidance, February 2026) · US FDA
- EudraLex Volume 4: EU Good Manufacturing Practice guidelines · European Commission
- EU GMP Annex 11: Computerised Systems (current version) · European Commission
- ISPE GAMP 5 Guide, Second Edition · ISPE
Common questions
Prefer to talk first? Chat with us on WhatsApp or book a call with an expert.
What are the GAMP 5 software categories?
Category 1 is infrastructure software such as operating systems and databases. Category 3 is non-configured products used as supplied. Category 4 is commercial products configured to your process. Category 5 is custom applications written for you. Category 2 was retired in GAMP 5 and no longer exists.
What changed in GAMP 5 Second Edition?
The 2022 Second Edition makes critical thinking explicit, aligns with FDA's Computer Software Assurance guidance on risk-based testing depth, adds guidance for Agile and iterative delivery, addresses cloud and service providers directly, and treats data integrity as a lifecycle property rather than a separate assessment.
Is GAMP 5 a regulation?
No. It is guidance published by ISPE, an industry body. Regulators widely recognise it as good practice and inspectors are familiar with its vocabulary, but you are assessed against the actual regulations — 21 CFR Part 11, EU GMP Annex 11 and the relevant predicate rules — not against GAMP itself.
How do I categorise a configured cloud system?
Usually Category 4, since you are configuring a commercial product. If you have added custom code, integrations or scripts, those components are Category 5 and should be categorised separately rather than absorbed into a single label. The deployment model affects supplier assessment, not the category.
Does GAMP 5 allow Agile validation?
Yes. The Second Edition includes explicit guidance on iterative delivery: requirements managed as a traceable living backlog, quality gates defined per increment, evidence captured continuously rather than assembled at the end, and a formal, accountable release decision before an increment enters GxP use.
Put this to work on your system.
Bring a URS. We show you risk-sized testing on your own requirements.
- We reply within one business day
- We run your URS live on the call
- You get a clear plan for your system