1What GAMP 5 is.
GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems is a guide published by ISPE, the International Society for Pharmaceutical Engineering. GAMP is an ISPE Community of Practice whose guidance “aims to safeguard patient safety, product quality, and data integrity in the use of GxP computerized systems”. ISPE says the guidance helps interpret regulatory requirements, sets a common language, promotes a lifecycle approach and clarifies roles, but “does not define a prescriptive method or a standard”.¹ The guide is written for regulated companies, suppliers and regulators.²
PIC/S records that the UK Pharmaceutical Industry Systems Validation Forum developed the GAMP Supplier Guide for software suppliers, and that the GAMP Forum came to be sponsored by ISPE.³ The first edition of GAMP 5 was published in 2008.⁴ Regulators cite it without making it law. FDA’s Computer Software Assurance guidance of February 2026 names GAMP 5, Second Edition, among industry guidance manufacturers may consult on testing methods and validation approaches,⁵ and WHO’s 2019 validation guideline lists GAMP 5 in its references.⁴
2What the guide covers.
The Second Edition runs to 404 pages.² Its chapters cover key concepts, the lifecycle approach, the concept, project, operation and retirement phases, quality risk management, the regulated company’s and the supplier’s activities, and efficiency improvements such as verifiable user requirements, risk-based decisions, using supplier input, efficient testing and tools and automation.⁶
The appendices fall into five groups: management (M1 to M12), development (D1 to D11), operation (O1 to O13), special interest (S1 to S6) and general (G1 and G2). The categories of software and hardware are in Appendix M4.⁶ They are explained in What are the GAMP 5 software categories?
3What changed in the Second Edition.
ISPE says the Second Edition maintains “the principles and framework of the first edition” and updates their application in the modern world.²
| Area | What ISPE says changed |
|---|---|
| Service providers | Greater importance, with regulated companies encouraged “to maximize supplier involvement to leverage knowledge, experience, and documentation where possible”. |
| Software development | The specification and verification approach “is not inherently linear but also fully supports iterative and incremental methods”. |
| Tools and automation | Increased use of software tools and automation “to achieve greater control, higher quality, and lower risks throughout the life cycle”. |
| Critical thinking | Applied by knowledgeable and experienced subject matter experts to define the right approach for specific circumstances. |
| CSA and data integrity | Discussion of FDA’s Computer Software Assurance activity, and links to ISPE’s data integrity guidance, added. |
| New technology | Appendices expanded to cover blockchain, AI and machine learning, cloud computing and open-source software. |
The contents list shows where these topics sit: critical thinking in section 3.4 and Appendix M12, and appendices on agile software development (D8), software tools (D9), distributed ledger systems (D10) and artificial intelligence and machine learning (D11). It marks three earlier appendices, D2, O7 and S5, as retired.⁶
4How GAMP 5 fits with the regulations.
GAMP 5 helps interpret requirements that come from elsewhere,¹ such as 21 CFR Part 11 and the predicate rules in the US and EU GMP Annex 11 in Europe. Annex 11 asks for risk management “throughout the lifecycle of the computerised system” and for decisions on the extent of validation to rest on “a justified and documented risk assessment”, and defines the lifecycle as all phases “from initial requirements until retirement”.⁷ That matches the guide’s structure, with its chapters on the lifecycle and on quality risk management.⁶
FDA’s final Computer Software Assurance guidance, issued on 3 February 2026 and superseding the version of 24 September 2025, applies to software used in medical device production and quality management systems. It describes a risk-based, least-burdensome approach to establishing confidence that software is fit for its intended use.⁵ GAMP 5 and CSA both encourage building on suppliers’ work and on automation: CSA counts validation activities performed by developers, suppliers and cloud service providers, automated testing and automated traceability among the ways to provide assurance.⁵ CSV compared with CSA and risk-based validation go further.
5How it runs in Seal.
Seal’s validation and AI assurance guide sets out how it applies GAMP 5, Second Edition. Requirements and specifications, the URS, FS, DS and configuration specification, can be kept as controlled records linked to the configured process and its tests, and assurance is assessed at three boundaries: the managed platform, your configured process, and custom logic and connected systems. Software categorisation follows the actual components and their use, and your team owns the intended use, risk acceptance and production approval.
The computer system assurance blueprint follows one system from intended use and function-level risk through supplier evidence, scripted and exploratory testing, release against a configuration baseline and later change.
References
- 1What is GAMP?, ISPE. https:/
/ ispe. org/ initiatives/ regulatory/ what- gamp (read 6 November 2026) - 2ISPE GAMP 5 Guide: A Risk-Based Approach to Compliant GxP Computerized Systems, Second Edition, ISPE, July 2022. https:/
/ ispe. org/ publications/ guidance- documents/ gamp- 5- guide- 2nd- edition (read 6 November 2026) - 3PI 011-3, Good Practices for Computerised Systems in Regulated GxP Environments, PIC/S, 25 September 2007, section 4.7. https:/
/ picscheme. org/ docview/ 3444 (read 6 November 2026) - 4WHO Technical Report Series No. 1019, Annex 3, Good manufacturing practices: guidelines on validation, Appendix 5, references, WHO, 2019. https:/
/ www. who. int/ docs/ default- source/ medicines/ norms- and- standards/ guidelines/ production/ trs1019- annex3- gmp- validation. pdf (read 6 November 2026) - 5Computer Software Assurance for Production and Quality Management System Software, Guidance for Industry and FDA Staff, FDA, 3 February 2026. https:/
/ www. fda. gov/ media/ 188844/ download (read 6 November 2026) - 6ISPE GAMP 5 Guide, Second Edition, table of contents, ISPE, 2022. https:/
/ ispe. org/ sites/ default/ files/ publications/ guidance- documents/ 2022- TOC/ ISPE- GAMP5- Ed2_ TOC. pdf (read 6 November 2026) - 7EudraLex Volume 4, Annex 11: Computerised Systems, European Commission, revision 1, in operation from 30 June 2011, section 1 and glossary. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026)
AQuestions and answers
Is there a free PDF of GAMP 5 Second Edition?
No. ISPE sells the guide. On 6 November 2026 its page listed the digital edition at US$540 for members and US$1,125 for non-members. ISPE publishes the table of contents free, which shows every chapter and appendix.
When was GAMP 5 Second Edition published?
ISPE published it in July 2022. The first edition of GAMP 5 dates from 2008, and the Second Edition keeps its principles and framework.
Is GAMP 5 mandatory?
No. It is industry guidance, and ISPE says it does not define a prescriptive method or a standard. The obligations come from regulations and GMP guidelines such as 21 CFR Part 11, the drug CGMP rules and EU GMP Annex 11. Regulators such as FDA and WHO cite GAMP 5 as a resource.
Where are the software categories in the Second Edition?
In Appendix M4, Categories of Software and Hardware, one of the twelve management appendices. The appendix covers hardware as well as software.
Does GAMP 5 cover AI and machine learning?
Yes. ISPE says the Second Edition expanded its appendices to cover AI and machine learning, and the contents list Appendix D11, Artificial Intelligence and Machine Learning. Blockchain, cloud computing and open-source software were added at the same time.
How does GAMP 5 relate to FDA’s CSA guidance?
They point the same way. FDA’s final Computer Software Assurance guidance of February 2026 applies a risk-based, least-burdensome approach to medical device production and quality system software and names GAMP 5, Second Edition, as an industry resource. ISPE says the Second Edition discusses FDA’s CSA work.