GAMP 5 software categories are a classification tool, not a risk score. Category 1 describes infrastructure software, Category 3 non-configured products, Category 4 configured products, and Category 5 custom applications. Use the category to understand the type of software you are managing, then decide lifecycle evidence and assurance depth from intended use, GxP impact, complexity, novelty, supplier evidence, and functional risk.
For the broader framework, read the GAMP 5 FAQ. For FDA’s current medical-device software assurance guidance, see the CSA FAQ.
Important: GAMP 5 Second Edition was published in 2022, but Category 2 was not “removed in 2022.” Category 2 was already absent from the GAMP 5 model introduced in 2008.
GAMP 5 Categories — Quick Reference
| Category | Type | Validation Required | Lifecycle Planning Focus |
|---|---|---|---|
| Category 1 | Infrastructure Software | Configuration documentation + change control only | Low |
| Category 2 | Not used in GAMP 5 | No longer applicable — update any SOPs referencing this | N/A |
| Category 3 | Non-Configured Standard | Functional testing for intended use | Low–Med |
| Category 4 | Configured Standard | Verify intended use and configured GxP functions; leverage suitable supplier evidence | Med–High |
| Category 5 | Custom Software | Full SDLC lifecycle validation | High |
Each Category — What It Means in Practice
OS, databases, and virtualisation platforms used as infrastructure. Establish the controls needed for their GxP role — for example version/configuration baselines, installation or configuration verification, security controls, supplier evidence, change control, and downstream impact assessment.
- Windows Server / Red Hat Linux
- Oracle DB / MS SQL Server
- VMware vSphere / Hyper-V
- Active Directory / Azure AD
Commercial software used exactly as supplied — no custom workflows or fields. Validation focuses on whether it does what you need it to do in your environment, not the vendor's software quality.
- Excel (for read-only reference data)
- Standard PDF readers/viewers
- Fixed-function lab instrument firmware
- Standard network monitoring tools
The most common category in pharma. Validate your configuration — workflows, approval chains, reports — not the base platform. Supplier evidence can be leveraged where appropriate after evaluating its relevance and adequacy; the final assurance scope should still reflect intended use, risk, configuration, and applicable requirements.
- SAP S/4HANA ERP (QM/MM/PM modules)
- Veeva Vault QMS / eTMF
- LabWare LIMS
- MasterControl / GoVal VLMS
Built specifically for you — including any custom script that processes GxP data, regardless of code length. Full Software Development Life Cycle (SDLC) required. Avoid Category 5 where a Category 4 commercial alternative exists.
- Custom SCADA / DCS systems
- Bespoke MES / lab automation
- Python/R/VBA scripts on GxP data
- Custom GxP system integrations
How to Classify Your Software — 4 Steps
1. Determine software origin
Was it developed specifically for your organisation? If yes, it is Category 5, regardless of anything else.
2. Check the configuration level
Can it be configured with your workflows, fields, and approval chains? If yes, it is Category 4. If it is used exactly as the vendor ships it, it is Category 3.
3. Identify infrastructure software
Is it infrastructure software such as an operating system, database platform, virtualisation layer, or directory service? If yes, Category 1 may apply. Define proportionate controls based on how that infrastructure supports GxP applications.
4. Apply the correct validation requirement
Do not translate a category into a fixed document set. Use the category with intended use, GxP impact, risk, complexity, novelty, supplier evidence, and the extent of configuration or custom code to select lifecycle activities and testing.
GAMP 5 + FDA CSA — How They Work Together
GAMP 5 provides software categories as one input to lifecycle planning. FDA's February 2026 CSA guidance is a separate, device-scope document that also uses risk-based assurance concepts, but it does not adopt or reference GAMP 5 categories.
| Category | GAMP 5 Requirement | FDA CSA Approach |
|---|---|---|
| Category 1 | Config documentation + change control | No change — same lightweight approach |
| Category 3 | Functional testing for intended use | Leverage vendor testing where available |
| Category 4 | Verify intended use and configured GxP functions; leverage suitable supplier evidence | Use vendor evidence for base platform; focus testing entirely on your configuration |
| Category 5 | Full SDLC lifecycle validation | No vendor evidence to leverage — full testing rigor and unscripted documentation required |
Applying GAMP categories across a portfolio? See GoVal’s CSV workflow for structured system intake, risk assessment, requirements, assurance evidence, traceability, change control, and review.
Related Topics
Frequently Asked Questions
What are the GAMP 5 software categories? +
What GAMP category is SAP, a LIMS, or a QMS? +
Does a custom Excel macro or Python script need GAMP 5 validation? +
Was Category 2 removed from GAMP 5? +
What validation is required for GAMP 5 Category 4 systems? +
How do GAMP 5 categories and FDA CSA work together? +
Stop Guessing Your GAMP 5 Categories
GoVal classifies every system in your portfolio, configures the right validation workflow, and keeps your entire portfolio audit-ready — without inconsistency from manual classification.