GAMP

What is GAMP?

GAMP (Good Automated Manufacturing Practice) is guidance from the professional society ISPE that describes how to specify, verify and maintain automated systems in a GxP environment in a validated state, using a risk-based approach. The current version is called GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems; its second edition was published in July 2022. GAMP is neither a law nor a standard, but regulators and pharmaceutical companies worldwide use it as the accepted way to carry out computerised system validation (CSV).

GAMP helps demonstrate that systems and software are fit for purpose, reliable and compliant for the production of medicines or medical devices.

GAMP is closely linked to GMP, the US FDA requirements in 21 CFR Part 11 and the European EU GMP Annex 11. Those rules say that you must validate; GAMP describes how.

🧠 How did GAMP come about?

GAMP started in 1991 in the United Kingdom as an initiative of validation experts from companies including Glaxo, Wellcome and ICI Pharmaceuticals. It was prompted by rigorous FDA inspections of computer systems in the late 1980s and early 1990s. The name was suggested by an inspector at the UK Medicines Control Agency, the forerunner of today’s MHRA.

GAMP has been part of ISPE (International Society for Pharmaceutical Engineering) since 2000. Alongside the main guide, ISPE publishes Good Practice Guides on specific topics, such as data integrity and, since July 2025, the GAMP Guide: Artificial Intelligence.

🎯 What is the purpose of GAMP?

• Patient safety and product quality - systems that release batches, control recipes or store quality data must demonstrably work correctly
• Data integrity - in line with ALCOA+, data must be attributable, legible, contemporaneous, original and accurate, as well as complete, consistent, enduring and available
• Demonstrable compliance - with EU GMP Annex 11 and, when supplying the US market, 21 CFR Part 11
• Efficient validation - focus effort on what carries risk, and reuse what suppliers have already tested

🧱 What are the core principles of GAMP 5?

GAMP 5 rests on five key concepts. The second edition explicitly adds critical thinking by subject matter experts: not a checklist, but a reasoned choice for each system.

🖥️ Which software categories does GAMP 5 use?

GAMP 5 divides software into four categories. Category 2 (firmware) from GAMP 4 was dropped; the numbering was kept. Firmware now falls into whichever category matches its nature.

For hardware, GAMP distinguishes standard hardware (such as servers, network equipment and off-the-shelf PLCs) from custom-built hardware. The second edition stresses that categories form a continuum rather than fixed risk levels: a simple category 4 application can require less work than a critical category 3 module.

🔧 How do you validate a system under GAMP 5?

GAMP 5 works with specification and verification: every requirement gets a matching test, and a traceability matrix links the two. The second edition states explicitly that this approach need not be linear; iterative and incremental development methods are acceptable.

1. Determine GxP relevance - assess whether the system affects patient safety, product quality or data integrity, and choose the software category.
2. Capture user requirements - a User Requirements Specification (URS) describes what the process needs, including audit trail, electronic signatures and access control.
3. Carry out a functional risk assessment - GAMP uses a five-step model: initial impact assessment, identify critical functions, assess risks per function, implement and verify controls, and review risks periodically. Severity times probability gives a risk class; combined with detectability, that yields a priority.
4. Assess the supplier - through an audit or questionnaire; well-documented supplier tests, such as a FAT, may be reused.
5. Specify and test - functional, configuration and design specifications, followed by verification. In practice these tests are often still called IQ, OQ and PQ (installation, operational and performance qualification), supplemented by the on-site SAT.
6. Report and release - a validation report confirms that the system is fit for its intended use.
7. Maintain the validated state - with change management, configuration management, backups, incident management and periodic reviews.

🔄 What is the difference between GAMP and CSV?

In September 2025 the FDA continued along the same lines with its final Computer Software Assurance (CSA) guidance: test thoroughly where impact is high and keep evidence light where risk is low. CSA was written for medical devices, but it fits closely with the second edition of GAMP 5.

🔐 How does GAMP relate to OT cybersecurity?

For OT teams in pharma, GAMP regularly collides with security. Every patch or firmware update on a validated system is a change that has to be assessed and sometimes retested. As a result, vulnerable systems sometimes remain unpatched for years.

• Patch management - define in advance, as part of validation, which kinds of updates may be applied with a limited regression test
• Security as a requirement - include requirements from IEC 62443 in the URS, such as segmentation, personal accounts and logging
• Test environment - a representative DTAP pipeline lets you verify updates outside production first
• Regulation - the draft revision of Annex 11 from July 2025 aims to make security, identity and access management and patching explicit requirements; until the final version takes effect, the 2011 text applies

In the Netherlands, the Health and Youth Care Inspectorate (IGJ) supervises GMP. Pharmaceutical manufacturers may also fall under NIS2 and the Dutch Cybersecurity Act, in force since 15 August 2026.

❓ Frequently asked questions

Is GAMP 5 mandatory?

GAMP 5 is not legally mandatory: it is good-practice guidance from ISPE. What is mandatory is that computerised systems in a GMP environment are validated, under EU GMP Annex 11 and 21 CFR Part 11 among others. Inspectors widely accept GAMP 5 as a well-founded way to meet that requirement.

Which GAMP category does a SCADA system fall into?

A SCADA system usually falls into GAMP category 4, because a standard product is set up through configuration. Custom scripts or extensions written within that SCADA package fall into category 5 and need additional specification and testing. The final classification follows from a risk assessment, not from the product type alone.

Why does GAMP category 2 no longer exist?

GAMP category 2 was reserved for firmware in GAMP 4, but was removed in GAMP 5 (2008). Firmware has become so diverse that it is now classified by its nature: as non-configured, configured or custom. The numbering 1, 3, 4 and 5 was kept to avoid confusion.

What is new in the second edition of GAMP 5?

The second edition of GAMP 5 was published in July 2022 and retains the principles of 2008. New are the emphasis on critical thinking, room for iterative and incremental development, more reuse of supplier documentation, and appendices on cloud, AI/machine learning, blockchain and open source. It also makes the link with the FDA’s Computer Software Assurance.

Does a validated system need revalidation after a patch?

Under GAMP, a system does not need full revalidation after a patch, but the change must be assessed through change control. The extent of retesting depends on the risk the change poses to GxP functions. An agreed approach for security updates prevents patching from being postponed for years.

Does GAMP also apply to AI applications?

GAMP also applies to AI applications that support GxP decisions. In July 2025, ISPE published a separate GAMP Guide: Artificial Intelligence, intended to be used alongside GAMP 5. In addition, the draft revision of the EU GMP guidelines includes a new Annex 22 on AI.

📌 In summary

Over more than thirty years, GAMP has grown from a British supplier guide into the accepted approach to computer validation in pharma and life sciences. With software categories, a functional risk assessment and reuse of supplier work, it scales validation effort to actual risk. For OT, that means auditable systems, controlled changes and a pre-agreed route for security updates.

GAMP 5 is ISPE’s risk-based guidance for validating automated GxP systems, and helps demonstrate that your systems are safe, reliable and compliant.