GAMP 5 sorts software into four categories: Category 1 infrastructure software, Category 3 non-configured products, Category 4 configured products and Category 5 custom applications. The more the software is shaped to your process, the higher the category and, generally, the more specification and verification work it needs.
For QA, QC and IT staff in pharma and regulated laboratories, the category is one of the first questions in any validation project. Get it wrong and you either spend months on a low-risk tool or leave a risky spreadsheet untested. Categories are a starting point, though: ISPE GAMP 5 Second Edition (2022) is clear that risk, complexity, novelty and supplier capability matter just as much.
What GAMP 5 is
GAMP 5 is ISPE's guide to a risk-based approach to compliant GxP computerised systems. It is industry guidance, not a regulation, but regulators and auditors widely recognise it, and it fits well with 21 CFR Part 11 and EU GMP Annex 11 expectations.
The Second Edition shares the risk-based thinking behind FDA's Computer Software Assurance draft guidance; see CSV vs CSA.
Why there is no Category 2
Earlier versions of GAMP had a Category 2 for firmware. GAMP 5 dropped it because firmware now ranges from fixed instrument code to highly configurable or even custom software. Firmware is treated like any other software and placed in Category 3, 4 or 5 according to how it is used and configured.
The four categories
Category 1: infrastructure software
This is the layered software that applications run on: operating systems, database engines, middleware, network software, virtualisation, and security and monitoring tools. You do not validate an operating system for your process; you qualify and control the infrastructure through IT procedures for versions, patches, backups, access and change.
Category 3: non-configured products
Commercial software used as supplied. You may enter run-time parameters, such as a measurement range or a sample ID, but you do not configure it to your business process. Examples include the firmware on a balance or pH meter and simple standard instrument software. The work is lighter: requirements, risk-based supplier assessment, verification against intended use and version control.
Category 4: configured products
Commercial software configured to fit your process using the supplier's own tools. Examples include LIMS, ERP, chromatography data systems (CDS), MES and electronic document management systems. You validate your configuration through user requirements, a configuration specification, supplier assessment, testing of configured workflows and traceability from requirements to tests.
Category 5: custom applications
Software written or heavily modified for your needs: bespoke applications, custom interfaces, custom PLC logic, macros and spreadsheets with complex logic. These carry the highest risk because nobody else has used them. Expect the full life cycle: detailed specifications, design and code review, structured testing and strong change control.
One system can contain several categories. A LIMS may be Category 4 overall with a custom Category 5 interface to the ERP that needs a more rigorous approach.
GAMP 5 categories at a glance
| Category | Description | Examples | Typical validation activities |
|---|---|---|---|
| 1: Infrastructure software | Layered software that applications run on | Operating systems, database engines, middleware, antivirus, virtualisation | Infrastructure qualification, version records, patch and access control, backup and restore |
| 3: Non-configured products | Used as supplied; run-time parameters only | Balance or pH meter firmware, standard instrument software | Requirements, risk-based supplier assessment, verification against intended use, version control |
| 4: Configured products | Standard software configured to the business process | LIMS, ERP, CDS, MES, electronic document management | User requirements, supplier assessment, configuration specification, testing of configured functions, traceability |
| 5: Custom applications | Developed or modified for a specific need | Bespoke code, custom interfaces, macros, spreadsheets with complex logic | Full life cycle: functional and design specifications, code review, structured testing, supplier audit where relevant |
The life cycle and the V-model
GAMP 5 describes a life cycle of concept, project, operation and retirement. In the project phase, the V-model links each specification on the left to the verification that confirms it on the right: user requirements to acceptance testing, functional specification to functional testing, and design specification to integration or module testing.
For Category 3 the V is short, often just requirements and verification. Category 4 adds a configuration specification and its testing, and Category 5 needs the full V, down to code review. The Second Edition accepts iterative and agile delivery, provided the controls are equivalent.
Scaling effort by risk and supplier
Category tells you how far the software has been shaped to your process. Risk tells you how much a failure would matter to patient safety, product quality and data integrity. You need both.
A Category 4 dashboard that only displays data may need less testing than a Category 3 balance whose results go straight into a batch record. Novelty and complexity count too.
Supplier assessment decides how much you can rely on the supplier's own testing, from a questionnaire for low-risk standard products to an audit for critical configured or custom systems. A strong supplier lets you avoid repeating their work; a weak one means more verification of your own.
Worked example: a QC assay spreadsheet
A formulation plant in Ahmedabad calculates HPLC assay results in a spreadsheet. Analysts enter peak areas, standard weight, potency and dilutions, and the sheet reports percentage of label claim against a 95.0 to 105.0% specification.
An analyst argued it needed no validation because the spreadsheet application is commercial software. QA disagreed: the template holds the site's own logic, and its results support batch release. The team broke it down:
- The spreadsheet application: treated as a commercial product, with the version recorded.
- The template: standard functions only, but it supports a release decision, so it was rated high risk and validated under the site spreadsheet procedure.
- A planned macro to import peak areas: would make the tool a custom application (Category 5), so it was deferred until a full life cycle approach could be resourced.
Validation covered a short user requirement specification, a risk assessment of each formula, locked cells and protected sheets, and verification against independent hand calculations. Test cases included typical results, values exactly at 95.0% and 105.0%, rounding, blank cells, text in numeric fields and a wrong dilution factor.
Testing found that the pass or fail cell compared unrounded values while the reported result was rounded, so a borderline result could pass on the report but fail in the calculation. It was corrected before release.
Data integrity remained the weak point. A standalone spreadsheet lacks a full audit trail, so the site controlled the template, printed and signed completed calculations, and planned a move into the CDS. See ALCOA and data integrity explained.
Common mistakes
- Assuming off-the-shelf software needs no validation.
- Using category alone to set effort and ignoring risk.
- Giving a whole system one category despite custom interfaces or reports.
- Forgetting firmware: a highly configurable instrument may belong in Category 4, not 3.
- Skipping supplier assessment for critical Category 4 systems.
- Leaving spreadsheets and macros outside change control.
Key takeaway: GAMP 5 categories describe how far software is shaped to your process: 1 infrastructure, 3 used as supplied, 4 configured, 5 custom. Use the category as a starting point, then scale validation by risk and by what your supplier can prove.
Frequently Asked Questions
What happened to GAMP Category 2?
Category 2 covered firmware in earlier GAMP versions and was discontinued in GAMP 5. Modern firmware can be simple and fixed or highly configurable, so a single category no longer made sense. Firmware is now assessed like other software and placed in Category 3, 4 or 5, depending on how it is configured and used.
Is Excel Category 3 or Category 5?
The spreadsheet application itself is generally treated as a commercial product. What matters is the template you build. A simple template using standard functions is often handled through a lighter, procedure-based approach, while macros, VBA or complex logic usually make it a custom application. Follow your site procedure and always scale the work to the risk of the result.
Is GAMP 5 a legal requirement?
No. GAMP 5 is industry guidance from ISPE, not law. The legal requirements come from regulations such as 21 CFR Part 11 and EU GMP Annex 11 and national GMP rules. GAMP 5 is widely used because it offers a recognised, practical way to meet those requirements, and inspectors are familiar with it.
What changed in GAMP 5 Second Edition?
The 2022 Second Edition kept the categories and life cycle but put more weight on critical thinking, scaling effort to risk and using supplier documentation. It added guidance on agile development, cloud services and newer technologies, and encourages cutting documentation that adds no value to patient safety, product quality or data integrity.
Next steps
To apply GAMP 5, risk-based validation and data integrity controls in your own systems, see Data Integrity & Computerised System Validation. If you are unsure which course suits your role, speak to a counsellor.
Related reading: CSV vs CSA: what Computer Software Assurance changes, ALCOA and data integrity explained and OOS vs OOT results investigation.
Looking for structured certification?
Explore Innoryx courses or speak to a counsellor about the right program for you.