GAMP 5

What it is, and is not

GAMP 5 is guidance, not regulation. No inspector can cite you for failing to follow GAMP 5. What they can cite is a computerised system that was not validated for its intended use — and GAMP 5 is the framework the industry converged on for demonstrating that it was.

The Second Edition, published in 2022, sharpened the emphasis on critical thinking, supplier leverage, and the software-development approaches (Agile, continuous delivery, cloud) that the First Edition predated.

The software categories

Category	Meaning	Typical effort
1	Infrastructure software — OS, databases	Qualified, not validated
3	Non-configured products used as supplied	Low
4	Configured products	Moderate, focused on configuration
5	Custom / bespoke code	Highest

Category 2 was retired. The categories are deliberately a continuum, not a filing system — a heavily configured Category 4 system with custom extensions is assessed on what was actually done to it, not on the label.

The core principle

Validation effort should be proportionate to risk to the patient, product quality and data integrity. A system controlling a sterilisation cycle and a system booking meeting rooms both run software; only one can hurt someone.

The corollary is the part organisations find hardest: proportionality means doing less somewhere. Testing every function of a configured commercial system at the same depth as custom code is not conservatism — it consumes the effort that should have gone to the high-risk functions.

Its relationship to CSA

The FDA's Computer Software Assurance thinking pushes the same direction, further: more unscripted and exploratory testing, less documentation-for-its-own-sake, and effort concentrated on features whose failure would matter. CSA and GAMP 5 Second Edition are complementary rather than competing.