GxP / GAMP 5 — Good Automated Manufacturing Practice
- ClassificationCategoryRisk ManagementDomainQuality & SafetyFramework FamilyOther
- Regulatory ContextTypeGuidanceLegal InstrumentGuidanceSectorHealthcare SectorIndustryHealthcare & Life Sciences
- Region / PublisherRegionGlobalRegion DetailInternationalPublisherInternational Society for Pharmaceutical Engineering (ISPE)
- VersioningVersionISPE GAMP 5 Guide, Second Edition (2022)Effective DateJuly 2022 (Second Edition; first edition 2008)Issue DateJuly 2022
- AdoptionAdoption ModelVoluntaryImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
The guide is a paid ISPE publication. ISPE's guidance license allows personal, non-commercial use by the individual purchaser, and the text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- ISPE GAMP 5 Second Edition (July 2022) is guidance on validating and operating computerized systems in GxP-regulated life sciences.
- It is guidance, not a law or certifiable standard, and helps interpret rules such as FDA 21 CFR Part 11 and EU GMP Annex 11.
- The Second Edition adds critical thinking, cloud service providers, iterative and Agile development, tools and automation, and appendices on blockchain and AI/ML.
- It covers the system life cycle from concept to retirement, quality risk management aligned with ICH Q9, and regulated company and supplier activities.
- SmartSuite Compliance Management keeps each system's intended use, GxP impact, and category with its validation evidence, and Third Party Risk Management holds supplier assessments.
Overview
ISPE GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems, Second Edition, is guidance from the International Society for Pharmaceutical Engineering (ISPE) on validating and operating computerized systems in GxP-regulated life sciences. It was published in July 2022 as the update of the 2008 first edition, and regulated companies, suppliers and regulators use it to show that systems are fit for intended use and protect patient safety, product quality and data integrity.
GAMP is guidance, not a law or a certifiable standard. ISPE says it does not define a prescriptive method. It helps interpret regulatory requirements such as FDA 21 CFR Part 11 and EU GMP Annex 11, sets a common language and clarifies roles. The Second Edition keeps the first edition's framework and key concepts and adds critical thinking, service providers including cloud, iterative and Agile development, tools and automation, and appendices on blockchain and AI/ML.
The guide covers the computerized system life cycle from concept to retirement, quality risk management aligned with ICH Q9, regulated company and supplier activities, and management, development, operation and special-interest appendices. ISPE sells the guide, and this page summarizes its structure without reproducing its text.
Why does it matter?
GxP rules expect computerized systems that affect product quality, patient safety or data integrity to be validated, for example 21 CFR 11.10(a), but they do not say how much validation is enough. GAMP 5 gives a risk-based, scalable approach so that effort goes to the systems and functions that matter most.
Key benefits include:
- Effort scaled to risk
Life cycle activities are added, removed and scaled by the GxP impact, complexity and novelty of a system, not by software category alone (Appendix M4).
- Supplier knowledge put to use
Chapter 7 and Appendix M2 describe supplier activities and assessment, and the Second Edition encourages regulated companies to use supplier knowledge and documentation where possible.
- Support for Agile and iterative work
The specification and verification approach is not inherently linear and fully supports iterative and incremental methods (section 3.2 and Appendix D8).
- Critical thinking built in
Section 3.4 and Appendix M12 show how subject matter experts apply critical thinking, including planning test effort in proportion to risk and using exploratory testing.
- A common language for inspections
ISPE describes GAMP as establishing common terminology and clarifying the roles of regulated companies and suppliers, which helps teams explain their approach to inspectors.
How does it work?
The guide describes a computerized system life cycle in four phases: concept, project, operation and retirement (sections 3.1 and 4.1 to 4.4). Specification and verification (section 3.2) link what the business needs to evidence that the system delivers it, and the computerized system validation framework (section 3.3) ties the activities together.
Chapter 5 sets out science-based quality risk management, aligned with ICH Q9, with detail in Appendix M3. The Second Edition adds guidance on process risk assessment. Appendix M4 groups components by the effort needed to create them for the application: infrastructure software, tools and IT services; standard system components; configured components; and custom applications and components.
Chapter 6 covers regulated company activities, including governance for achieving compliance and system-specific activities. Chapter 7 covers supplier activities. Chapter 8 lists efficiency improvements, such as verifiable user requirements, risk-based decisions, using supplier input and existing information, efficient testing and managing changes efficiently (sections 8.1 to 8.9).
Key Elements
- Key concepts (chapter 2)
Chapter 2 gives an overview and key terms. ISPE states that the overall approach, framework and key concepts of the Second Edition remain unchanged from the first edition.
- Life cycle and critical thinking (chapter 3)
The life cycle approach covers specification and verification, the validation framework and critical thinking through the life cycle, with Appendix M12 on applying critical thinking.
- Quality risk management (chapter 5)
Risk management is science-based and follows the ICH Q9 aligned process, with Appendix M3 on science-based quality risk management.
- Software and hardware categories (Appendix M4)
Categories describe the likely effort and risk of components. They form a continuum, and the guide says categorization is not a checklist for validation.
- Supplier activities (chapter 7)
Topics include the supplier quality management system, requirements, sub-supplier assessments, design reviews, testing, commercial release and system support, with Appendix M2 on supplier assessment.
- Appendices
Management appendices M1 to M12, development appendices D1 to D11 (including Agile, software tools, blockchain and AI/ML), operation appendices O1 to O13 (including incident management, CAPA, periodic review, backup and restore and security management) and special interest appendices S1 to S6 (including electronic production records and spreadsheets).
What does it cover?
The guide is intended for regulated companies, suppliers and regulators. Suppliers include providers of software, hardware, equipment, system integration and IT services, inside or outside the regulated company. It applies to GxP computerized systems in pharmaceutical, biotechnology and other life sciences operations, and its appendices address current topics such as cloud computing, open-source software, blockchain and AI/ML. ISPE describes GAMP as guidance and not as a standard, so organizations adopt it by choice and judge its fit for their own systems.
What are its objectives?
GAMP aims to give a cost-effective framework of good practice for computerized systems.
Protect patient safety, product quality and data integrity.
Achieve computerized systems that are effective, reliable, of high quality and fit for intended use.
Meet current regulatory requirements by building on existing industry good practice.
Provide a common language and clear roles for regulated companies and suppliers.
Encourage appropriate and proportionate practices, including innovative approaches.
Framework in Context
GAMP guides how to meet regulations and does not replace them. 21 CFR Part 11 sets the criteria under which electronic records and signatures are trustworthy and generally equivalent to paper (section 11.1), and 11.10(a) calls for validation of systems. EU GMP Annex 11 covers computerized systems in the EU GMP Guide (revision January 2011). FDA's final guidance on computer software assurance, reissued in February 2026 by CDRH and CBER, expresses a risk-based assurance approach that the Second Edition also discusses.
Common Framework Mappings
GxP/GAMP 5 is often mapped to other quality and safety frameworks to centralize compliance efforts, simplify validations, and maintain regulatory alignment in life sciences and pharmaceutical manufacturing environments.
Mapped frameworks include:
21 CFR Part 11
21 CFR Part 211
EU GMP
ICH Q10
ICH Q9
ISO 13485:2016
ISO 9001:2026
PIC/S GMP
WHO GMP
How SmartSuite Supports GxP (Good Practice) – GAMP 5
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to keep each computerized system's intended use, GxP impact and category together with its validation evidence, and Third Party Risk Management to hold supplier assessments and service provider records.
System Inventory with Intended Use
Record each system's intended use, GxP impact, components and Appendix M4 category, with a business owner and a quality owner.
Risk Assessment Register
Record risks to patient safety, product quality and data integrity by function, with severity, probability, detectability and mitigations (chapter 5).
Supplier and Service Provider Records
Track supplier assessments, quality agreements, service levels and contract exit terms for each system's suppliers (chapter 7 and Appendix M2).
Specification, Test and Traceability
Link requirements, specifications and test results, and keep exploratory test notes beside scripted results (Appendices D1, D5 and M5).
Change, Incident and CAPA Workflow
Run operational change, incident, problem management and corrective and preventive action records with approvals (Appendices O4, O5 and O6).
Periodic Review and Retirement
Schedule periodic reviews, backup and restore checks, retirement and archiving tasks, and report open actions to quality (Appendices O8, O9, M10 and O13).
Frequently Asked Questions For GAMP 5 (Good Automated Manufacturing Practice)
No. GAMP 5 is ISPE guidance, not a law or a certifiable standard, and ISPE says it does not define a prescriptive method. Regulations such as 21 CFR Part 11 and EU GMP Annex 11 are what bind regulated companies, and GAMP shows one widely used way to meet them.
ISPE published the Second Edition in July 2022. It keeps the first edition's framework and key concepts and adds critical thinking, a bigger role for service providers, support for iterative and Agile development, more use of tools and automation, and appendices on blockchain, AI/ML, cloud computing and open-source software.
Appendix M4 groups components as infrastructure software, tools and IT services; standard system components; configured components; and custom applications and components. The guide treats them as a continuum and says categorization is not a checklist for validation. Life cycle activities are scaled by GxP impact, complexity and novelty.
Those texts set requirements, and GAMP helps interpret them. For example, 21 CFR 11.10(a) calls for validation of systems to ensure accuracy, reliability and consistent intended performance. GAMP's life cycle, risk management and supplier chapters describe how a regulated company can do that in proportion to risk.
ISPE sells the Second Edition, with member and non-member pricing, and its guidance license limits use to the individual purchaser for personal, non-commercial purposes. ISPE also publishes a free table of contents and an overview page called What is GAMP.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.