GAMP 5 (Good Automated Manufacturing Practice, Fifth Edition) is ISPE's industry framework for validating computerized systems in GxP-regulated life sciences environments. First published in 2008 and updated in the Second Edition in 2022, it provides practical, risk-based guidance for planning, executing, and maintaining software validation. GAMP 5 is an industry good-practice framework, not a regulation. Regulated companies should use it alongside the laws, regulations, guidance, and quality-system procedures that apply to their products, sites, and computerized systems.
GAMP 5 Second Edition, published by ISPE in 2022, expands the framework for modern technology and delivery models. It strengthens the emphasis on critical thinking, risk-based and proportionate lifecycle activities, supplier involvement, agile and iterative methods, cloud and SaaS, and modern automation. It complements — but is not the same as — FDA’s CSA approach; each has its own scope and authority.
GAMP 5 uses Category 1 for infrastructure software, Category 3 for non-configured products, Category 4 for configured products, and Category 5 for custom applications. These categories describe software type and complexity; they are not risk levels and do not prescribe a fixed validation package. Categories 3–5 are best viewed as a continuum, with intended use, GxP impact, complexity, novelty, supplier evidence, and functional risk guiding the lifecycle approach.
For Category 4 configured products, the lifecycle approach should focus on the company's intended use, configuration, interfaces, data, and GxP-relevant workflows. Supplier evidence can be leveraged when it is credible and relevant, but it should be assessed rather than accepted automatically. Typical activities can include supplier assessment, configuration or functional specifications where useful, risk-based verification of configured functions, and user or process-level assurance for GxP-critical use cases. The exact package should be scaled to GxP impact, complexity, novelty, supplier evidence, and risk.
Category 5 custom software normally needs more lifecycle evidence because the regulated organization has greater responsibility for requirements, design, development, testing, release, and change control. The exact documentation and assurance depth should still be risk-based. Supplier or development-team evidence can be used where it is credible and relevant; custom software does not automatically mean a fixed IQ/OQ/PQ document set.
A practical GAMP 5 risk approach starts with the computerized system's intended use and GxP impact, then examines functions or risk scenarios that could affect product quality, patient safety, data integrity, or other regulated outcomes. The level and method of assurance should be proportionate to the consequence and likelihood of failure, while also considering complexity, novelty, supplier capability, and available evidence. High-risk functions generally need stronger objective evidence; lower-risk functions can use simpler methods when the rationale is documented.
GAMP 5 Second Edition encourages greater use of supplier knowledge, experience, and documentation where appropriate. The regulated company should assess the supplier and the relevance of available evidence rather than duplicate work without a reason. Useful inputs can include development and test evidence, release information, quality-system information, security or service reports, and product documentation. The customer remains responsible for its intended use, configuration, integrations, procedures, and any additional assurance needed for GxP-relevant functions.
A system is GxP-impacting if it creates, modifies, maintains, archives, retrieves, or transmits GxP records; directly controls or monitors a regulated manufacturing or laboratory process; or supports GxP decision-making in a way where system failure could affect product quality or patient safety. GAMP 5 recommends a documented GxP impact assessment as the first step in the validation process. Systems with no GxP impact — IT infrastructure supporting non-regulated business functions — do not require formal GxP validation, though standard IT governance still applies.
GAMP 5 Second Edition addresses cloud and SaaS delivery models and the increased role of service providers. A regulated company can leverage supplier and cloud-provider evidence where it is relevant, but still needs to understand its intended use, configuration, data, interfaces, security responsibilities, service model, and change process. Supplier assessment, contracts, service documentation, security or assurance reports, and targeted verification can all contribute; no single certificate or report automatically qualifies the hosted environment for every GxP use.
GAMP 5 does not mandate the V-model. The V-model can be useful where it fits the delivery approach, but agile, iterative, SaaS, and configured-product lifecycles can use other structures. What matters is that requirements, risks, design/configuration decisions, assurance evidence, issues, and release decisions remain appropriately controlled and traceable.
Yes. GAMP 5 Second Edition explicitly addresses agile development, recognizing that iterative development cycles require adapted validation approaches. For agile environments, each sprint or release cycle should include risk assessment for GxP-impacting changes, documented testing evidence for new or changed functions, and integration into the overall validation record. The challenge is maintaining audit-ready documentation across rapid iterations — a strong Configuration Management and change control process is essential. GAMP 5's critical thinking principle supports flexible implementation as long as GxP impact is continuously assessed.
GAMP 5 treats data integrity as a core lifecycle consideration. A GAMP-based assurance strategy should evaluate whether controls support trustworthy GxP records — for example audit-trail behavior, prevention or detection of unauthorized changes, user access and accountability, time controls, record retention, and review. ALCOA+ is a useful way to frame those data-quality attributes, but the specific controls should follow intended use, risk, and applicable requirements.
A GAMP-based lifecycle should define requirements clearly enough to support intended use, risk assessment, configuration/design decisions, and verification. Requirements should be understandable, testable where appropriate, uniquely controlled, and traceable to relevant assurance evidence. The level of detail should be proportionate to GxP impact, complexity, and risk rather than driven by document volume alone.
A GAMP-based lifecycle should place GxP-relevant system changes under controlled assessment. The impact assessment should consider intended use, affected functions and records, risk, existing evidence, regression needs, and whether additional assurance is needed before release. Supplier patches and upgrades should be assessed using the same risk-based logic as internally initiated changes.
Periodic review is a common lifecycle control for confirming that a system remains fit for intended use. A risk-based review can consider changes, incidents and deviations, access and security, supplier status, version currency, data-integrity controls, outstanding actions, and whether requirements remain appropriate. The frequency and evidence should follow applicable requirements, risk, and the organization’s procedures.
GAMP 5 Second Edition (2022) and FDA's CSA approach are closely aligned around critical thinking, supplier involvement, and risk-proportionate assurance. The current FDA CSA guidance was revised in February 2026 and formally applies to medical-device production and quality management system software. GAMP 5 remains the broader industry implementation framework used across life sciences, providing practical category, supplier-assessment, and lifecycle tools that can support CSA-aligned validation.
GAMP 5 is a published ISPE guidance document available for purchase from the ISPE website. ISPE membership is not required to obtain or use GAMP 5, though members receive discounted pricing. The guidance is not a freely downloadable public document — it is a commercially published technical guide. Many pharmaceutical companies purchase multiple copies or enterprise licenses for distribution to validation teams. Supporting ISPE Good Practice Guides and GAMP Communities of Practice provide supplementary guidance that often is available to members.
GAMP 5 applies to any computerized system used in GxP-regulated activities. This explicitly includes: laboratory systems (LIMS, CDS, electronic notebooks), manufacturing systems (MES, SCADA, DCS, EBR), quality systems (QMS, CAPA, document management), clinical systems (EDC, CTMS), and infrastructure supporting these systems. GAMP 5 also addresses process control and embedded systems, though these have specific validation considerations covered in associated GAMP Good Practice Guides. The primary scoping criterion is GxP impact — not system type or technology platform.
GAMP 5 supports a documentation set proportionate to intended use, GxP impact, risk, complexity, and the product type. A configured system may need planning, requirements, supplier assessment, configuration evidence, risk assessment, assurance/testing records, issue resolution, traceability, and a release or summary decision — but GAMP 5 does not impose one universal IQ/OQ/PQ document pack for every Category 4 implementation. Documents can be combined when purpose, control, and traceability remain clear.
GAMP 5 is widely used across global life-sciences organizations as industry good-practice guidance. It does not replace jurisdiction-specific regulations or guidance such as EU GMP Annex 11 or applicable FDA requirements. Multinational programmes commonly use GAMP principles as an internal lifecycle framework while mapping controls and evidence to each applicable regulatory regime.