GAMP 5 software categories

Category 4 in practice: the supplier is responsible for the development quality of the product; the regulated company is responsible for specifying requirements, documenting and controlling the configuration, and testing the configured workflows. Any bespoke extension or integration middleware inside a configured product is a Category 5 element and gets Category 5 rigour.

Being Category 4 reduces validation less than vendors imply. GAMP 5’s second edition (July 2022) is explicit that the category is one factor in a risk-based approach, and lifecycle activities scale with GxP impact, complexity, novelty and criticality — not a checklist shortcut.

Where MYREX sits: MYREX is a configured product — Category 4, direct impact, with risk-based scoping of test effort concentrated on record integrity, the audit trail, attestation, and the functions that gate line release — or, in current ISPE terms, a system whose critical aspects your risk assessment will identify. We state direct impact rather than arguing for a lower tier, because if MYREX is your system of record for 211.182 equipment logs, it holds primary records required by regulation. That does not mean MYREX is validated, or that a category determination substitutes for your own risk assessment — both are yours.