What are the GAMP 5 software categories, and which category is a LIMS, eQMS or MES?

1What the GAMP software categories are.

GAMP 5 is ISPE’s guide to a risk-based approach to compliant GxP computerised systems. Its Second Edition was published in July 2022 and is written for regulated companies, suppliers and regulators.¹ The software categories sit in Appendix M4, “Categories of Software and Hardware”.² They group components by one question: “What complexity of activity has to be done to create the component for this specific application?”³

The names have changed since GAMP 4. ISPE’s 2026 article on categorisation traces GAMP 4’s “operating systems, firmware, standard software packages, configurable software packages and custom (bespoke) software” to the Second Edition’s “infrastructure software, tools and IT services, standard system components, configured components and custom applications and components”.³ Firmware, numbered 2 in GAMP 4,⁴ has no counterpart in the new list, and ISPE’s own articles keep the numbers 1, 3, 4 and 5.⁵

ISPE’s functional risk article uses the categories as a rough guide to the likelihood of failure: low for non-configured off-the-shelf software, medium for configured software and high for customised software. It adds that “These are guidelines only”: complex configuration can raise the likelihood, and simple custom software can be medium.⁹

2Categories describe components, not systems.

The Second Edition makes this explicit. ISPE’s summary of the changes says computerised systems “are generally made up of a combination of components from different categories”, that “categories 3-5 should be viewed as a continuum”, and that the category “is just one factor in a risk-based approach”, with life cycle activities scaled by the system’s GxP impact, complexity and novelty.¹²

ISPE’s 2026 article on categorisation quotes Section 12.2 of the guide: “Categorization is not intended to provide a checklist approach to validation.” The guide recommends whole-system categorisation only to help define the approach to supplier assessment; everywhere else, categories apply to the components that make up a system. The article’s example of why judgement matters: “a very complex configured component might have a higher likelihood of residual defects than a very simple custom component”.³ PIC/S made the same point under GAMP 4 in 2007: “Many systems span the category levels.”⁴

3Which category is a LIMS, eQMS or MES.

None of these sources assigns a LIMS, eQMS or MES a single category, and under the Second Edition’s component approach none would have one. A typical configurable platform breaks down like this.

Regulators look past the platform’s category to what it is used for. FDA says each CGMP workflow is an intended use to be validated, and that qualifying an MES platform “does not demonstrate that a given MPCR generated by the MES contains the correct calculations”; validating the workflow does.¹³ MHRA says accepting “vendor-supplied validation data in isolation of system configuration and users intended use is not acceptable”.¹⁴ ISPE’s 2013 white paper on clinical systems, written under the first edition, made the same split for electronic data capture: a validated platform, then trial-specific configuration validated for each trial, as “two separate life cycles”.¹⁰

4What the regulations say about categories.

No regulation sets GAMP categories. EU GMP Annex 11 (2011) says “The application should be validated; IT infrastructure should be qualified”, and that the extent of validation should rest on “a justified and documented risk assessment”. It asks users to review the documentation supplied with commercial off-the-shelf products against their requirements (clause 3.3), and for bespoke or customised systems it expects a process for “formal assessment and reporting of quality and performance measures for all the life-cycle stages” (clause 4.6).¹⁵

FDA’s data integrity guidance says “The extent of validation studies should be commensurate with the risk posed by the automated system.”¹³ Its final guidance on computer software assurance, issued on 3 February 2026 for software used in medical device production or quality management systems, sorts features, functions and operations into “high process risk” and “not high process risk”, and names GAMP 5 Second Edition as one industry resource on testing and validation methods.¹⁶ The categories are a tool for applying those requirements, not a substitute for the risk assessment they call for.

5How it runs in Seal.

Seal’s validation and AI assurance guide sets assurance at three boundaries: the managed platform, your configured process, and custom logic and connected systems. It says software categorisation follows the actual components and their use, so a configurable platform does not give every script, integration or deployment the same GAMP category, and the scope and assurance rationale are agreed in your validation plan.

The computer system assurance blueprint starts from intended use and function risk, and releases against a fixed configuration baseline. In the LIMS blueprint, the user requirements, functional and design specifications, configuration specification, verification results and approval can be kept together in Seal and updated with the configuration they describe.