GAMP 5 and Predictive Maintenance: Software Category and Validation

In one line: GAMP 5 is ISPE's risk-based framework for validating computerized systems in regulated environments. A configured predictive-maintenance analytics platform is a Category 4 configured product (the same category as SCADA, MES, and LIMS), not Category 1 infrastructure. Validation is proportionate to GxP risk, and you perform it, under your own quality system.

The procurement review that stalls on one question

Your reliability team has already run the pilot. The anomaly detector caught a bearing degrading three weeks before it would have seized, and the vibration trend backed it up. Everyone in the room (maintenance, engineering, even the plant manager) wants to move to a site-wide rollout.

Then the request lands on the desk of the validation lead, and the meeting takes a different shape. "What GAMP category is this?" isn't a stalling tactic: it determines whether this becomes a two-week configuration exercise or a project needing its own budget line and a Computer System Validation (CSV) master plan. Too often, the honest answer from the vendor is a shrug, a marketing PDF that says "fully compliant," or a confident answer that's simply wrong.

Get the category wrong and one of two things happens. Call a configured analytics platform "Category 1 infrastructure" and you underestimate the review it needs: infrastructure validation verifies an installation, not whether a model's outputs are fit for a maintenance decision. Call it "Category 5 custom" and you send a configurable product through a bespoke-software validation effort it doesn't need. Misclassification is one of the most common reasons a good tool stalls in procurement, and it's avoidable once you know where PdM software actually sits.

(This post assumes the regulated-environment groundwork covered in our medical-device and pharma GMP posts, and the broader vendor-evaluation lens in our buyer's guide. This one goes deep on one specific question: what GAMP 5 category does PdM software fall into, and who actually validates it.)

What is GAMP 5?

GAMP 5 (Good Automated Manufacturing Practice, now in its second edition) is ISPE's risk-based framework for validating computerized systems in GxP-regulated environments (GxP: good manufacturing, laboratory, clinical, and distribution practice). It isn't a regulation itself; it's the reference model regulators expect a mature quality system to apply, scaling validation effort to risk instead of testing everything identically.

GAMP 5 is published by ISPE, the International Society for Pharmaceutical Engineering, and its central premise is leverage: use a supplier's own development and quality documentation instead of re-proving everything from first principles, and scale your own effort to the system's actual risk rather than testing every function to the same exhaustive depth (ISPE GAMP 5 Guide, 2nd Edition).

The framework does two jobs at once, and conflating them is exactly where the procurement-review stall above comes from: it classifies what kind of software you're validating (a category, from infrastructure through fully custom code) and it classifies how the software is used, whether it directly executes or informs a GxP decision, which drives how deep validation needs to go. Category sets the validation approach; GxP impact sets the validation depth. Collapsing those two axes into one question is where "Category 1" gets misapplied to a configured analytics platform.

The GAMP 5 software categories

GAMP 5 replaced GAMP 4's five-tier scheme with four categories (1, 3, 4, and 5, with no Category 2) ranked by how much of the software's behavior is unique to your installation. Infrastructure sits at one end, fully custom code at the other, and validation effort scales with that same spectrum.

| Category | What it covers | Plain example | Validation implication | |---|---|---|---| | 1: Infrastructure | Operating systems, database engines, network components, middleware: the platform other software runs on | Windows Server, PostgreSQL, a managed Kubernetes cluster | Validated through infrastructure qualification and change control, not a full system validation | | 3: Non-configured products | Commercial off-the-shelf (COTS) software used as delivered, with no configuration of business logic | A standalone lab instrument's reporting software, used out of the box | Installation verification plus testing of the GxP-relevant functions you actually use | | 4: Configured products | Commercial packages configured to your environment (user roles, workflows, parameters, integrations) with no custom code | SCADA, MES, LIMS, DCS, and a monitoring/analytics platform configured with your assets, sensors, and thresholds | Risk-based testing of your configuration: does it perform as configured, for your intended use | | 5: Custom applications | Bespoke code, custom-developed applications, heavily customized systems, in-house scripts and macros | An in-house LIMS interface, a custom batch-release calculator | The full software development lifecycle: design specifications, code review, structural and functional testing |

Two things to notice. First, the categories track a spectrum of how much of the software's behavior is unique to you: infrastructure is identical everywhere it's installed, custom code exists nowhere else. Second, validation effort tracks that same spectrum: Category 1 leans on the vendor's own development rigor plus your installation and change control; Category 5 assumes nothing was pre-built or pre-tested, so you build that evidence yourself.

Where predictive-maintenance software fits

A predictive-maintenance analytics platform, Prevly included, is a Category 4 configured product. You configure it to your environment (asset hierarchy, sensor mappings, alert thresholds, roles) rather than run it unmodified or write custom code, which is exactly the profile GAMP 5 assigns to Category 4: the same category SCADA, MES, and LIMS occupy.

Here's the misconception worth naming, because it's common enough to be the reason this article exists: predictive-maintenance software is not GAMP 5 Category 1. Category 1 is infrastructure: the operating system and database a configured application runs on top of, validated through configuration management, because there's no application-specific behavior to test. A PdM platform has exactly that behavior: it ingests your sensor data, runs models against it, and surfaces alerts and predictions your team acts on. That's what puts it in Category 4, not underneath it in Category 1.

It's also not Category 5. Nothing about configuring asset hierarchies, sensor mappings, and alert routing constitutes writing custom code: you're not authoring the LSTM autoencoder or the gradient-boosted RUL model; you're pointing a pre-built, pre-tested model pipeline at your equipment. Landing it at Category 5 would mean validating it as if it were bespoke software built from scratch for your site, which both overstates the work and misses where the real validation questions actually live: not "does this code work" but "does this configuration produce trustworthy results for our equipment."

Category vs. GxP impact: the axis people miss

Software category answers what kind of thing this is; it doesn't answer how much it matters if the software is wrong. GAMP 5 pairs category with a risk-based impact assessment: direct GxP impact (the system executes or makes the decision) versus indirect, informational impact (it informs a decision a qualified person reviews and owns).

A predictive-maintenance platform sits toward the second, lighter end. It analyzes sensor data and recommends action: flags a bearing that looks like it's degrading, estimates remaining useful life, surfaces which sensors drove that call. It doesn't release a batch or adjust a setpoint. That's an informational, indirect-GxP-impact use, so validation effort should be proportionate: lighter than a system of record, but not zero, because a bad prediction that leads to a bad maintenance decision is still a real risk worth managing on purpose.

This is also where 21 CFR Part 11 attaches, or doesn't. Part 11 governs electronic records and signatures, but only for records that satisfy a "predicate rule": an existing requirement, like the pharma cGMP maintenance-record obligations in 21 CFR 211.67(c), or the device-side equivalent under the Quality Management System Regulation (21 CFR Part 820, which since February 2026 incorporates ISO 13485:2016), kept electronically. Whether a PdM alert becomes a Part 11 record depends on whether it's used as evidence for a regulated decision, not on the software's GAMP category. We cover that mechanism (audit trails, e-signatures, ALCOA+) in 21 CFR Part 11 and predictive maintenance data integrity; this article stays on categorization.

The validation lifecycle, and the CSV-to-CSA shift

For a Category 4 product with indirect GxP impact, validation follows the same shape whether the rulebook is traditional CSV (Computer System Validation) or the newer CSA (Computer Software Assurance): define requirements, assess risk, then qualify installation, operation, and performance. What changed with CSA is how much scripted documentation that shape demands.

The classic sequence:

URS (User Requirements Specification): what you need the system to do, in your environment, for your intended use.
FS (Functional Specification): how the configured system meets those requirements: which assets, which thresholds, which roles.
Risk assessment: where the real GAMP 5 discipline lives: rank each requirement by GxP impact and complexity, and scale testing rigor accordingly instead of testing everything to the same exhaustive depth.
IQ/OQ/PQ: Installation Qualification (is it installed correctly), Operational Qualification (does it operate per spec across its intended range), Performance Qualification (does it perform reliably under your actual operating conditions, on your actual equipment).

That's traditional CSV, and it isn't wrong: it's often over-applied. FDA proposed a lighter alternative in September 2022 draft guidance and finalized it in September 2025 as "Computer Software Assurance for Production and Quality System Software", scoped to device production and quality-system software, but its critical-thinking philosophy has become the reference point the wider CSV and GAMP 5 community now uses. CSA's core move: replace exhaustive, scripted testing of every function with critical thinking applied up front: identify intended use, assess risk, and choose assurance activities accordingly, reserving scripted testing for functions where GxP impact is genuinely high (ISPE, "Computer Software Assurance and Critical Thinking").

For a Category 4, indirect-impact platform like a PdM analytics tool, that shift matters in practice: it's the difference between a validation effort that takes a proportionate number of weeks and one that takes a proportionate number of months for the same actual risk. Neither CSV nor CSA changes whether you validate: both assume you do. What changed is the license to stop treating every test case as equally important.

Who actually validates it

You validate it, under your own quality management system (QMS), not the vendor, and not a third-party stamp you can buy. A supplier can document its own development rigor so you don't re-derive it from nothing, but validation is inherently specific to your intended use, your configuration, and your risk assessment.

A vendor claiming "we're GAMP 5 validated" is making a claim that doesn't quite parse: GAMP 5 is a framework you apply, not a certification a product earns once and carries everywhere.

That division of labor is exactly why "capable" and "compliant" aren't the same word. A platform can be built to make validation fast and defensible: that's a design and documentation choice a vendor controls. Whether your specific installation, at your specific site, actually is validated is a fact only your quality system can establish, because only you hold the URS, the risk assessment, and the sign-off authority that make it true.

What this looks like with Prevly

Prevly's Validated tier ships a GAMP 5 / CSV documentation package sized for a Category 4, indirect-impact use, Part 11-capable e-signatures, and an ALCOA+-oriented audit trail on alerts, predictions, and sign-offs; on-premise by default, with read-only ingestion that never writes to a PLC you've already validated.

The models underneath hold the same honest boundary everywhere else: an LSTM autoencoder for anomaly detection, conformal-calibrated on your own equipment's baseline; a gradient-boosted (LightGBM) model with SHAP attribution for remaining useful life, validated on the public NASA C-MAPSS dataset and reported as conformal prediction intervals, not a single overconfident number; Integrated Gradients on a CNN-1D for fault attribution, which, unlike the other two, currently runs on a synthetic demonstrator, and we say so in the product, not just here.

None of that adds up to a certification. Validation of your specific installation is performed by you under your own quality system; Prevly is not itself a regulatory certification. What the tooling changes is how much of the documentation groundwork already exists before your validation lead opens a blank template: a GAMP 5 / CSV pack that starts the traceability matrix instead of leaving you to build it from a vendor data sheet and a prayer.

Frequently asked questions

What GAMP 5 category is predictive-maintenance software? Category 4: a configured product. A PdM analytics platform is commercial software you configure (assets, sensor mappings, thresholds, roles) rather than software you build from scratch or run unmodified. That puts it in the same category as SCADA, MES, and LIMS systems.

Is predictive-maintenance software Category 1? No. Category 1 is infrastructure (operating systems, databases, middleware), validated through configuration and change control because it has no application-specific behavior of its own. A PdM platform has that application-specific behavior (it processes sensor data and produces alerts and predictions), which places it in Category 4 instead.

Who is responsible for validating GAMP 5 software? You are, under your own quality management system. A supplier can provide documentation of its own development and testing rigor to support your effort, but only you hold the intended use, the risk assessment, and the sign-off authority that make a validation real. No vendor "validates itself" on your behalf.

What's the difference between GAMP 5 and CSA? GAMP 5 is the overall risk-based validation framework; CSA (Computer Software Assurance) is FDA's more recent articulation of the same idea: critical thinking and proportionate testing in place of exhaustive scripted testing of every function. They're compatible, not competing: CSA is a lighter-weight way to satisfy the same GAMP 5 principle.

Does predictive-maintenance software need to be Part 11 compliant? Only for records that satisfy a predicate rule: an existing requirement, like 21 CFR 211.67(c) maintenance-record obligations, kept electronically. It's a records-and-signatures question, separate from GAMP category, covered in full in our dedicated Part 11 post.

Bring a defensible category into your next procurement review

The fastest way to stall a good predictive-maintenance pilot is to walk into a validation review without a straight answer to "what GAMP category is this, and who validates it." Prevly is a GAMP 5 Category 4 configured product, used for informational, indirect-GxP-impact decision support, and the Validated tier ships the GAMP 5 / CSV documentation, Part 11-capable e-signatures, and ALCOA+-oriented audit trail that make your own validation effort faster to complete, not someone else's shortcut around it.

Request a Prevly demo