The GAMP 5 software categories, explained like a human

Every validated system journey begins with a single classification, and an astonishing amount of pain comes from getting it wrong. GAMP 5 sorts software by how much of it you invented: the more the system is yours, the more its behavior is your problem to prove.

The three categories that matter

Category 3, non-configured product. You install it and use it as supplied. Think firmware on a balance, a standard PDF tool, an off-the-shelf instrument with fixed parameters. The supplier proved the behavior; you prove it works in your environment and that you control access and data. Validation here is mostly installation verification plus a fitness-for-use check.

Category 4, configured product. The big one. LIMS, eQMS, ERP, MES, most SaaS platforms. The vendor built the engine, you configured the workflows. The supplier owns the core; you own every decision you made in the configuration workbook. Your testing follows your configuration: approval routings, calculation setups, user roles, status flows. This is where most validation effort in the industry lives.

Category 5, custom application. Code written for you: bespoke applications, custom interfaces, macros with logic, that one Excel sheet with 400 lines of VBA the lab cannot live without. Nobody has ever tested this code but you. Full lifecycle rigor applies: design specifications, code review, structural and functional testing, the works.

The classic traps

• A configured product with one custom script inside is a Category 4 system carrying a Category 5 component. Classify the component, not just the platform.
• A spreadsheet with formulas is closer to Category 5 than anyone wants to admit. If it calculates something GxP-relevant, it needs more than a prayer.
• SaaS does not mean the supplier validated it for you. They tested their platform. Your intended use, your configuration and your data flows remain yours.

If you want to pressure-test your own classification instinct, the tool below walks the same decision path an experienced validation lead would, one question at a time.

One closing thought: the category is the start of risk-based thinking, not the end of it. A Category 3 instrument feeding batch release decisions can deserve more scrutiny than a Category 5 tool that formats meeting minutes. Classify the software, then assess the use.