Computer system validation (CSV) is the documented evidence that a computerized system does what it is intended to do in a regulated GxP process. GAMP 5, published by ISPE, is the most widely used framework for it, scaling validation effort to the system's risk to patients, product quality, and data integrity.
Why validation is required
Part 11 requires validation of systems that hold regulated electronic records, and the cGMP rules for drugs (211.68) and dietary supplements (111.30) require controls over automated and electronic equipment used in production. Validation is how you show those systems work as intended and keep working after changes. See the Part 11 checklist.
GAMP 5 in brief
GAMP 5 (Good Automated Manufacturing Practice) is industry guidance from ISPE, not a regulation. Its second edition, published in 2022, keeps the core ideas: understand the process, manage systems across their life cycle, scale effort to risk, lean on supplier documentation where it is good, and apply critical thinking rather than generating paper for its own sake.
| GAMP 5 category | Examples | Typical effort |
|---|---|---|
| 1 · Infrastructure software | Operating systems, databases | Record versions, qualify the infrastructure |
| 3 · Non-configured products | Standard instruments and packages | Verify against requirements |
| 4 · Configured products | Configured LIMS, ERP, or QMS | Verify the configuration against requirements |
| 5 · Custom applications | Bespoke software | Full life cycle, including design and code review |
Category 2, firmware, was retired in the first edition of GAMP 5.
The validation deliverables
- User requirements specification (URS): what the system must do for its intended use
- Risk assessment: which functions affect product quality, patient safety, or data integrity
- Functional and configuration specifications (FRS): how the system meets each requirement
- Installation qualification (IQ): it was installed correctly
- Operational qualification (OQ): it operates as specified
- Performance qualification (PQ): it performs in the intended use
- Traceability matrix: every requirement traced to a test
- Validation summary report, then change control and periodic review
From CSV to computer software assurance
FDA's Computer Software Assurance (CSA) guidance for production and quality system software pushes the same direction as GAMP 5's second edition: spend assurance effort where a failure would affect product quality or patient safety, and use lighter, unscripted testing for lower-risk functions instead of scripting everything.
Validating AI-enabled workflows
AI wording can vary from run to run, so validate the controlled workflow around the model rather than the exact output: a defined intended use, fixed evidence requirements, deterministic checks for explicit rules, version-pinned models and prompts under change control, human review gates, and periodic review. GAMP 5's second edition adds an appendix on AI and machine learning.
How Ovada handles validation
Ovada ships a validation package with IQ/OQ/PQ documentation, user and functional requirements specifications, and a traceability matrix, plus validation support for your implementation. Models, prompts, and knowledge are version-pinned and change-controlled. See security and validation.
Questions
What are the GAMP 5 software categories?
Category 1 is infrastructure software, category 3 is non-configured products, category 4 is configured products, and category 5 is custom applications. Category 2, firmware, was retired.
Is GAMP 5 a regulation?
No. GAMP 5 is industry guidance published by ISPE. FDA does not require it, but it is widely accepted as a sound way to meet validation expectations.
What is the difference between CSV and CSA?
Computer system validation (CSV) is the overall practice of proving a system fits its intended use. Computer software assurance (CSA) is FDA's risk-based approach to that work, focusing effort on high-risk functions and accepting lighter testing elsewhere.