Gamp 5 Category 3 2021
| GAMP 5 Level | Description | Typical Examples | |--------------|-------------|------------------| | | Infrastructure – OS, DBMS, network, hardware | Windows Server, Oracle DB, LAN switches | | Category 2 | Off‑the‑Shelf (OTSO) – no configuration | Microsoft Office, Adobe Acrobat | | Category 3 | Configurable C‑COTS – configuration only, no code changes | LIMS, MES, ERP, SCADA, batch execution systems, QC data management tools | | Category 4 | Custom‑built software – source code developed to spec | In‑house instrument control software, bespoke reporting tools | | Category 5 (optional in some interpretations) | Non‑validated tools for non‑regulatory use | Training simulations, marketing dashboards |
Understanding GAMP 5 Category 3: Strategies for Compliant Non-Configured Software gamp 5 category 3
: These systems are typically much faster to install and deploy (sometimes within hours or days) compared to customized Category 5 systems. Validation and Review Requirements | GAMP 5 Level | Description | Typical
| Risk Factor | Evaluation Considerations | Mitigation Strategies | |-------------|---------------------------|-----------------------| | | Does the system generate or store batch records, test results, or release decisions? | Higher‑level testing (PQ), tighter change control | | Patient Safety | Direct impact on dosage, sterility, or labeling? | Additional independent review, audit trails | | Data Integrity | Frequency of data edits, electronic signatures, audit‑trail completeness? | Verify 21 CFR Part 11 compliance, enforce role‑based access | | Regulatory Scope | Scope of FDA/EMA submissions that reference the system? | Document justification for any deviation from standard validation | | Vendor Dependence | Frequency of vendor patches/updates, support SLA? | Include vendor change‑control in risk assessment, schedule periodic re‑qualification | | Additional independent review, audit trails | |
While Category 3 systems are simpler than configurable (Category 4) or custom (Category 5) systems, they still require validation to ensure they are "fit for purpose" in GxP-regulated environments.
