Instrument Classification: Why One Qualification Strategy Doesn’t Fit Every Instrument

Every pharmaceutical QC lab relies on a diverse range of analytical instruments, from simple glassware to sophisticated analytical systems that incorporate sophisticated electronics and even a configurable software. As new instruments are procured, a fundamental question arises: Does this instrument require qualification? And if qualification is needed, what level of rigour is appropriate? Clearly, a pipette and an HPLC system demand very different approaches. Making this determination consistently each time an instrument is acquired requires a structured framework. USP General Chapter <1058> “Analytical Instrument and System Qualification” addresses this need through a risk-based framework for Analytical Instrument Qualification (AIQ), ensuring qualification effort is proportionate to the instrument’s intended use, functionality, and analytical system complexity.

From Function to Classification

A typical laboratory contains a diverse mix of equipment: simple apparatus without measurement capability, instruments incorporating firmware and sophisticated electronics, and computerised systems connected to software or wider software platforms. This diversity leads naturally to the next question: How should they be classified?

USP <1058> groups analytical instruments into three broad categories based on measurement capability and how complex the instrument is. This tiered structure forms the foundation of a risk-based approach that avoids both over-qualifying simple equipment and under-qualifying complex systems — a balance that has become increasingly important as regulatory scrutiny around data integrity and analytical lifecycle management intensifies.

A Closer Look at the Categories

Each of the three groups, listed below, reflect a different level of effort required to demonstrate that an instrument is fit for its intended purpose.

• Group A — standard laboratory apparatus without measurement capability and therefore the need to calibrate them. Basic functionality can be verified through visual inspection.

Examples: Glass beakers, volumetric flasks, magnetic stirrers, and vortex mixers.

• Group B — Instruments that generate measurements or equipment that control experimental conditions thereby having an influence on analytical results.

Examples: Analytical balance, pH meter, laboratory oven, and thermometer.

• Group C — computerised analytical systems where hardware and software together generate, process, calculate, store, or report analytical data. These systems require the highest level of qualification due to their functionality and complexity.

Examples: HPLC system with chromatography data system (CDS),

The three groups represent the top level of the USP <1058> classification framework. USP <1058> further subdivides them into eight subcategories, enabling qualification activities to be matched more precisely to an instrument’s functionality and intended use.

The verification workload does not scale in a single leap from Group A to Group B to Group C – it escalates gradually across the subcategories. Recognising these nuances allows laboratories to right-size their approach: minimal for A1/A2, structured and calibration-driven for B1, enhanced with calculation checks for B2, and further reinforced with method and configuration controls for B3. For Group C, qualification effort expands further because these systems incorporate software, and their qualification fundamentals should align with GAMP 5 principles for computerised system validation — applying full 4Qs qualification for C1 with fixed vendor software, extending to configuration management for C2, and expanding again for C3 to include full software lifecycle documentation, custom code assessment, and interface testing. This graded approach ensures that verification effort remains proportionate to the risk each instrument poses to data quality. The sections below explain the verification workload for each subcategory in turn.

Sub-category	Keyword	Example	Activity List
A1	No Metrological function	Magnetic stirrer (without temperature control) and vortex mixer	Verification only. Verification activity is limited to: A short, risk-based justification stating why no qualification is required.Confirming the equipment is present, correctly installed, and identified (asset tag, location).Visual observation that it operates as intended (e.g., the stirrer spins, the vortex mixes).Retaining the supplier documentation or operating manual. No calibration, no performance testing, and no periodic requalification typically required.
A2	No user calibration	Sieves and volumetric glassware	Verification only. These items may have defined specifications (e.g., certified mesh size, Class A tolerance) but they are not calibrated by the user. Verification typically includes: A short, risk-based justification stating why no qualification is required.Installation/receipt check and asset identification.Visual confirmation of fitness for use and absence of damage.Retention of manufacturer certificates confirming compliance with compendial specifications. Differs from A1 in that the specification is verified against supplier provided conformance document(s).
B1	Firmware-controlled	Analytical balance and pH meter	Vendor-supplied qualification package, typically covering FS, IQ and OQ.Verification of the User Requirement Specification (URS) through executed IQ, OQ, and PQ.Routine calibration against traceable standards, with documented procedures and records.Periodic performance verification (e.g., daily balance checks, buffer verification for pH meters).Change control and requalification for firmware updates.
B2	In-built calculations	TOC Analyser and density meter	All B1 activities plus: Verification of built-in calculations against known reference materials or manually calculated values. OQ to challenge computational logic. Documented evidence that calculation algorithms are appropriate for intended use.
B3	User-defined routines	FTIR with custom methods and Gas Chromatography	All B1 and B2 activities plus: Verification of user-defined methods through method-specific challenge testing. Documented control of method creation, review, approval, and version management.
C1	Non configurable software	Stand-alone chromatography data system (CDS) with standard templates	Vendor-supplied qualification package, typically covering IQ and OQ, aligned with GAMP 5 Category 3.Routine calibration and maintenance of hardware components against traceable standards, with documented procedures and records.Verification of the URS through executed IQ, OQ, and PQChange control and requalification for software patches and version upgrades.
C2	Configurable software	ELN with configurable templates	Vendor-supplied qualification package, typically covering IQ and OQ, aligned with GAMP 5 Category 4. Activities apart from that noted for C1 include:Documented Configuration Specification (CS) covering all user-configured elements (templates, workflows, user roles, calculations).
C3	Custom software	LIMS integrated with SAP and custom calculations	Vendor-supplied qualification package, typically covering IQ and OQ, aligned with GAMP 5 Category 5. Activities include:Software development lifecycle definition Documented Design Qualification (DQ)Source code review, structural testing, or thorough supplier assessment for custom-developed code.Comprehensive testing of custom calculations, workflows, and interfaces (e.g., SAP, LIMS, ERP integrations).

As instrument functionality and analytical system complexity increase, so does the level of documented activities needed to demonstrate fitness for intended use.

Conclusion

Instrument classification is the starting point for determining qualification effort. Rather than applying a uniform qualification strategy across all laboratory instruments, USP <1058> encourages a proportionate approach based on instrument characteristics, intended use, and system complexity. By matching the qualification package to the instrument’s role, laboratories can focus effort where it adds value while maintaining confidence that analytical systems are fit for their intended use.

Reference:

USP–NF General Chapter <1058> Analytical Instrument and System Qualification. USP–NF, official 1 June 2026.

Sindu K

August 1, 2026

Uncategorized

digital transformation, GAMP 5, group a, group b, group c, GxP Compliance, instrument classification, instrumnet qualification, pharmaceutical, Pharmaceutical Validation, User Requirement Specification

Equipment Classification: The Decision That Drives Qualification

Before an equipment qualification protocol is drafted, here’s a question worth asking: Does every piece of equipment have to go through a qualification lifecycle requiring the same resources, time, and effort, or would commissioning suffice for some?

Some never pause to question whether full commissioning and qualification are truly necessary. Instead, the default option of qualifying every asset is exercised because it appears comprehensive on paper. But is this approach the most efficient use of time and resources, or could a more targeted strategy deliver faster, equally reliable outcomes?

Equipment classification provides a structured way to answer that question. As outlined in the ISPE Baseline Guide Volume 5, the System Classification framework classifies equipment as Direct Impact or Not Direct Impact, providing the basis for determining the qualification strategy.

System Classification According to ISPE

Classification comes down to answering eight questions — a YES to any one of them makes the equipment Direct Impact. All eight have to come back NO before it can be Not Direct Impact. (ISPE Baseline® Guide Volume 5, Section 3.3)

Does it control a CPP, or otherwise serve a defined CQA?
Does it have direct contact with the product or process stream?
Does it produce an excipient, ingredient, or solvent—Water for Injection being the obvious one?
Is it used for cleaning, sanitising, or sterilising?
Does it maintain an environment—temperature, humidity, an aseptic zone — that’s a CPP for the process?
Does it generate or hold data used to accept or reject the batch, or fall under 21 CFR Part 11 or EU GMP Annex 11?
Does it provide the container closure or product protection?
Does it apply or check product identification with no independent verification elsewhere?

Classification Outcomes

Every piece of equipment gets sorted into one of two categories based on how it answers those eight questions — Direct Impact or Not Direct Impact.

Direct Impact (DI)	Not Direct Impact (NDI)
Qualified and commissioned	Commissioned only
Scope set by CQA/CPP risk to the product	Scope set by SME judgment and HSE criticality
System Risk Assessment identifies the CDEs	SME review sets the commissioning scope
Full C&Q documentation package	Commissioning documentation only

Consider the following examples:

A vial filling machine answers YES at Q2 alone—it’s in direct contact with the product during filling, and a failure there is a direct line to product quality. One YES is enough. It’s Direct Impact and goes through the commissioning and qualification workflow.
A shrink-wrapping machine sits downstream; it bundles product that’s already capped, stoppered, or sealed. It doesn’t touch product, so Q2 is a clean NO. The question worth pausing on is Q7—product protection. Shrink film does protect the product in transit, so a quick read might call this a YES. But Q7 asks whether this equipment provides the seal on which product quality depends, and the upstream capping or stoppering step already provides that seal. The shrink wrap is a secondary bundle, not the barrier the product relies on. Q7 comes back NO, and so does the rest. The shrink-wrapper is Not Direct Impact. It still goes through commissioning—it just doesn’t go through qualification.

Where classification gets genuinely tricky

Most equipment can be classified with relative ease. Utilities, however, often require a closer evaluation because their classification depends on how they support the process.

Utilities controlling critical process parameters: Product contact alone does not determine classification. Utilities that control Critical Process Parameters (CPPs) may still be classified as Direct Impact.

Example: A chilled water system cooling a jacketed reactor may never contact the product, but if it controls the reaction temperature (a CPP), it is classified as Direct Impact.

Utilities with multiple points of use: The same utility can serve both Direct Impact and Not Direct Impact applications. Classification should be based on the specific point of use rather than the utility itself.

Example: Compressed air used to dry product-contact equipment after cleaning may be classified as Direct Impact. The same compressed air used only to operate non-product-contact equipment is Not Direct Impact.

Function over equipment type: Classify systems such as nitrogen, vacuum, or compressed air according to their function in the process, not their names.

Example: Nitrogen used for product blanketing is Direct Impact, whereas nitrogen used only for line pressurisation may not be.

The Bottom Line

The most effective qualification programmes do not qualify every equipment. They are selective. Equipment classification provides the framework for making that decision consistently, ensuring that the qualification effort, project resources, and regulatory focus remain aligned with actual product and process risk.

Reference

1. ISPE Baseline® Guide: Commissioning and Qualification, Volume 5, Second Edition. International Society for Pharmaceutical Engineering (ISPE), 2019. ISBN 978-1-946964-23-6.

Sindu K

July 27, 2026

Uncategorized

digital transformation, direct impact, Equipment Qualification, GxP Compliance, ispe, not direct impact, pharmaceutical, Pharmaceutical Validation, Quality Assurance

User Requirements Specification — Getting the Sequence Right.

Most of us have written a URS with a system already in mind. The vendor had been shortlisted, sometimes already selected, and the document was drafted to formalise what had already been decided. The result is a URS that describes a product rather than defines a need. It cannot be used to challenge whether the selected system is fit for purpose, because that question was never genuinely open.

This is the most common URS failure in the industry. Not vague language. Not missing signatures. The sequence. A URS written after vendor selection is not a requirements document. It is a justification; those of us who have reviewed enough of them know the difference.

What the Regulators and ISPE Expect

The ISPE definition is precise: the URS states what the system must do, not how it should do it. Every major GxP framework shares one expectation underneath the differing language: document what you need before you build it, and prove you did.

The Annex 11 makes this more explicit than before. URS traceability to testing is no longer implied — it is mandatory. Risk management must be embedded from URS through to system retirement. The one-time IQ/OQ/PQ followed by silence is no longer a defensible position.

What the URS Must Cover

Every requirement in it must be verifiable — specific enough that someone can design a test, run it, and return a clear pass or fail. If it cannot be tested, it does not belong.

The URS must cover, at a minimum:

Functional capabilities — calculations, safety functions, access controls, audit trails, and output formats
Data handling — data definitions, valid ranges, integrity controls, backup, and archiving
Technical performance — capacity, failover behaviour, and disaster recovery
Interfaces — with users, other systems, and equipment
Environmental and power conditions — the physical operating environment in which the system must function
Alarm requirements — including explicit identification of critical alarms
System automation — with clearly defined boundaries between systems
Data integrity requires its own attention. The URS must define what the system needs to do to satisfy ALCOA+ principles — data that is Attributable, Legible, Contemporaneous, Original, and Accurate, and beyond that, Complete, Consistent, Enduring, and Available. These are not abstract ideals. Each one translates directly into a testable requirement — audit trails, user access controls, timestamps, backup provisions, and data storage conditions.
Every requirement should state its category — Quality, Business, or HSE — and its source, whether a CQA, a CPP, a regulatory requirement, a risk assessment output, or an engineering standard. We must explicitly identify quality-critical requirements and write them with precision.

Finally, not every requirement carries the same weight. Separating mandatory from beneficial and nice-to-haves keeps the qualification effort focused where it actually matters.

What a GMP-Grade Requirement Looks Like

The gap between a weak requirement and a defensible one is not technical knowledge. It is discipline, specificity, and process ownership.

Weak Requirement	GMP-Grade Requirement
The system shall monitor temperature.	The system shall continuously monitor storage temperature within 2°C–8°C(CPP), trigger a GMP-critical alarm within 60 seconds of exceedance, and maintain a tamper-proof audit trail per 21 CFR Part 11.
The system should print labels correctly.	The system shall restrict label reprints to QA-authorised personnel with an electronic signature, reason code, and a full audit trail of all print events and template changes.

A requirement that cannot be tested has no place in a qualification programme.

Five Failure Modes That Destroy URS Credibility

These are not theoretical. They are the patterns behind real audit observations, 483s, and warning letters.

Vague, untestable language. Robust, appropriate, user-friendly — these are not requirements. If a test cannot be written for it, it does not belong in the document.
Vendor Brochure Transcription. A URS sourced from supplier documentation belongs to their sales cycle, not your process. Auditors notice immediately.
No CQAs or CPPs identification. You cannot build a credible risk assessment on a document that fails to identify what is critical.
URS Written Post-Selection. A URS written after vendor selection is not a requirements document. It is a justification.
Never Updated After Go-Live. If your team has not updated the document to reflect the current validated state, it is a liability.

Each of these patterns is recoverable before qualification begins. After a deviation occurs, they become the gap that an investigation cannot close.

Conclusion

A URS is only as useful as the process understanding behind it. Written early, classified correctly, and maintained through every system change — it is the document that gives every qualification activity its purpose. Written late, vaguely, or not at all — it is the gap an investigation will eventually fall into.

Sindu K

June 15, 2026

Uncategorized

ALCOA+, GMP validation, GxP Compliance, Pharmaceutical Validation, QMS, Quality Assurance, Regulatory compliance, User Requirement Specification

Factory Acceptance and Site Acceptance Testing: Accelerating Equipment Qualification with ValDoc Pro
Synopsis:

“Suitable for the intended purpose/activities” is a core regulatory expectation for all pharmaceutical manufacturing equipment, and qualification is the documented proof that this is achieved. The qualification lifecycle starts with a User Requirement Specification (URS) document followed by a Functional Specification (FS). Test Scripts are executed in IQ, OQ and PQ documents to demonstrate that the requirements noted in the URS are met. Because running IQ/OQ/PQ scripts at the manufacturing site is time-consuming and the responsibility falls only on the drug manufacturer, some of the effort can be shared with the vendor via Factory Acceptance Testing (FAT) and Site Acceptance Testing (SAT). ValDoc Pro can streamline this process and build better compliance.

Regulatory Guidelines:

¹21 CFR 211.63 states that “Equipment must be of appropriate design, adequate size, and suitably located to facilitate operations for its intended use”[2]. While the FDA recognises the advantages of FAT and SAT (mentioned in presentations by the FDA), there is no guideline that discusses this. EU GMP Annex 15 & PIC/S explicitly state, in sections 3.4-3.7, that:
- Equipment, especially if incorporating novel or complex technology, may be evaluated, if applicable, at the vendor prior to delivery.
- Prior to installation, equipment should be confirmed to comply with the URS/ functional specification at the vendor site, if applicable.
- Where appropriate and justified, documentation review and some tests could be performed at the FAT or other stages without the need to repeat on-site at IQ/OQ if it can be shown that the functionality is not affected by the transport and installation.
- FAT may be supplemented by the execution of a SAT following the receipt of equipment at the manufacturing site.
Leveraging Vendor Testing:

The Factory Acceptance Test (FAT) is carried out at the vendor’s site and provides documented evidence that the equipment meets the user requirements and the vendor has fulfilled contractual responsibilities. A well‑planned FAT helps save time during qualification by identifying design issues, functional gaps, and integration problems before the equipment leaves the factory. Sending the equipment back to the vendor to fix issues, especially when they are located across continents, is avoided through FAT. Fat also provides the ability to check internal components of the equipment that one would not be able to reach at the site unless it is disassembled.

It is not necessary that a FAT test be performed for all equipment/systems. That decision is left to the manufacturing site and its policy. For a greenfield facility, a commissioning and qualification (C&Q) plan will direct this strategy. A survey by ECA Academy in 2018 found that FAT is used by 37% of the companies surveyed, while 55% stated “it depends on the complexity of the project”. SAT was found to be used by 49% of those surveyed [5].

Planning and preparation for the Factory Acceptance Test (FAT) are critical because the activity is conducted at the vendor’s site and involves budgeting for extra expenses on both sides. The decision to perform FAT is typically taken very early in the procurement lifecycle, during the development of the User Requirement Specification (URS) for the equipment. The contract signed between the drug manufacturer and the vendor for an equipment includes scope of the FAT, responsibilities and the commercials. The details of what is to be covered in FAT are put down in a protocol and frozen before approval of the design stage. The site and the vendor have to agree on the features/functions to be demonstrated, parameter specification to be met, tests to be carried out, and identify the URS points covered by FAT. The FAT protocol is sent to the drug manufacturer for review. Once approved, then only the protocol can be executed. During execution, the drug manufacturer representative(s) ideally should be present to at least to verify the minimum test requirements and resolve any deviations. During and after the pandemic, many FATs have been conducted remotely, reducing travel and related expenses and making this an attractive option, particularly when organisations can leverage a wide range of digital tools and platforms to their advantage.

The FAT protocol, once executed, is compiled along with attachments and sent to the site by the vendor for review. In most cases, the equipment would have to be disassembled before shipping. The documentation put together details equipment component labels and the process to follow to reassemble these components.

Similar to the FAT, the Site Acceptance Test (SAT) is not a mandatory test to perform. The advantage of SAT is time savings. A successful execution of the SAT protocol provides assurance that the equipment works as per specification post-transportation to the site. While infrastructure, utilities, interfaces, etc, are defined in advance and agreed upon, surprises may crop up. The SAT protocol also rechecks issues found during FAT. These should be addressed before IQ begins. In addition, the presence of the vendor’s team at the site speeds up testing, as that machine is very well known to them.

The SAT process follows the same overall approach as the FAT, but is performed at the manufacturing site rather than at the vendor’s facility. Whether a SAT will be performed should be defined in the C&Q plan and, preferably, specified in the URS and subsequently reflected in the contract. SAT is led by the site, along with the vendor’s project/commissioning/service staff. The SAT protocol is normally drafted by the vendor or the project engineering/validation team.

A decision that the site needs to take is whether they would like to leverage what was tested in FAT and SAT. Most sites leverage the data from these tests. The SAT protocol has many tests that overlap with what one would carry out under IQ and OQ protocols.

Accelerating FAT and SAT Efficiency with ValDoc Pro:

ValDoc Pro is an easy to use Qualification management application that assists companies in digitizing their qualification workflow, from URS onwards through the entire lifecycle. Its role-based access and real-time collaboration features enable vendors and manufacturers to coordinate FAT and SAT seamlessly. Following are some of the advantages:
- Vendor Access: Vendor can create, obtain site approval and execute FAT protocols within ValDoc Pro, with controlled access to designated folders/files.
- Site Review and Approval: The FAT protocol and FAT report can be submitted for review and approval online.
- Seamless Flow: Generating the protocol by the vendor, review, execution and compilation all can be carried out seamlessly in ValDoc Pro.
- Sequential: ValDoc Pro ensures that the SAT protocol cannot be executed until the executed FAT report has been approved. This ensures that the SAT protocol captures all relevant tests.
- Traceability Matrix: ValDoc Pro maintains a continuous link from URS through FAT/SAT to IQ/OQ/PQ, demonstrating to regulators that all user requirements were tested and all deviations addressed.
Conclusion:

Compared with relying solely on traditional IQ, OQ, and PQ, integrating FAT and SAT into the equipment qualification strategy allows issues to be identified earlier at the vendor and manufacturing site, limits risk, and reduces the amount of testing and troubleshooting that must be compressed into already busy commissioning windows. This upstream focus not only improves the quality of delivered assets but also frees site resources to concentrate on value-added verification and routine operation rather than firefighting late-stage gaps. ValDoc Pro-enabled FAT and SAT give pharmaceutical manufacturers a more efficient and compliant path to equipment qualification by moving protocols into a digitized, collaborative environment and enabling options such as Remote FAT, so teams can shorten timelines, reduce on-site disruption, and strengthen data integrity while maintaining full traceability from URS through lifecycle maintenance. In a landscape where each site-based role carries a greater workload, embedding FAT and SAT within a robust application like ValDoc Pro is not just an efficiency gain, but a strategic necessity for sustaining reliable, inspection-ready manufacturing.

[1] FDA. Process Validation: General Principles and Practices. U.S. Food and Drug Administration.

[2] “U.S. Food and Drug Administration. 21 CFR Part 211 – Current Good Manufacturing Practice for Finished Pharmaceuticals, §211.63 Equipment design, size, and location.”

[3] European Commission. EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use, EudraLex, Volume 4, Annex 15: Qualification and Validation. In operation since 1 October 2015

[4] PIC/S. Guide to Good Manufacturing Practice for Medicinal Products, PE 009 (current version), Annex 15: Qualification and Validation

[5] ECA Academy. FAT & SAT not frequently used as Part of Qualification – ECA Modern Qualification Survey Results. GMP News, gmp-compliance.org (2018)
ravi

December 12, 2025

Uncategorized

Equipment Qualification, Equipment Testing, GMP Compliance, Pharmaceutical Validation, Process Validation, Quality Assurance
Who is actually Responsible for the URS?
Synopsis:

Before purchasing an equipment, software or instrument, regulatory requirement mandates that one documents what is expected of the proposed acquisition. While it may be tempting to rely on vendors for this, as they understand their product, they do not understand the business requirements. That is why the User Requirement Specification (URS) must be authored by the team responsible for this new acquisition. This article explains why a user-driven URS ensures the acquired entity genuinely matches user needs, moving it from basic functionality to real-world fit

It All Starts with a Need

Picture this. You have been asked to put together a URS for a new equipment/software/instrument. If this requirement was identical or similar to one that you have purchased in the past, that makes your task easier. But what if this is a brand-new requirement. Where do you start?

Appendix D5 from the ISPE GAMP 5 guidance document says it the best when it states that each user requirement should be specific, measurable, achievable, realistic, and testable. It is also a good practice to prioritize the requirements, typically in two or three levels: (mandatory (high), beneficial (medium), and nice-to-have (low)) Or (mandatory (high) and nice-to-have (low)).

The Easy Way

As a vendor, we very often get asked to provide a draft URS that the regulated company then uses as a basis to draft the requirement. Is this the right approach? It sounds logical, right? After all, vendors are experts in the products they sell. But here’s the catch — they are experts in their product, not your business process.

Sometimes we receive a URS that lists a specific brand or model, even including specifications unique to that brand. This is not the intended purpose of a user requirement, which should describe what is the needed functionally, not prescribe a particular vendor or solution. When this happens, it limits the scope of solutions, undermines competitive assessment, and can introduce bias or compliance risks. Such requirements do not reflect true user needs but rather pre-select a solution, making it harder to compare alternatives and potentially exclude options that better meet functional requirements. GAMP 5 guidelines recommend describing functional needs in clear, objective terms, avoiding references to specific suppliers unless it is absolutely necessary to do so for business reasons
Understanding the Roles the RACI way

How do we decide the roles of various stakeholders. A RACI Matrix, a simple chart that outlines who does what, breaks down the roles:

Responsible: Team/end users responsible for the business process. The end users or process owners are usually responsible for drafting the URS since they know the operational needs best.

Accountable: Manager(s) responsible for the business process. Oversees URS creation and ensures it meets desired goals

Consulted:
- Other departments to provide their input/expertise as the acquired product may influence their workflows
- IT team for software/IT hardware requirements to provide input on technical feasibility and rollout implications
- CSV team for software to include regulatory requirements
- Vendor – provide input and give technical advice.
- Informed-Vendors so as to put together a function requirement specification.
What do the Regulators Say?

The FDA, the EMA and others, have made their stance clear: every system must be “fit for its intended use.” That phrase — fit for intended use — is powerful. It means the system should perform exactly as needed for your specific products and processes.

And who defines that intended use? Not the vendor — you do.

According to the FDA’s General Principles of Software Validation and EMA’s Annex 11 on Computerised Systems, the responsibility for defining and confirming suitability lies with the regulated user organisation for computerised systems. But that principle doesn’t stop there. Under broader GMP guidance, such as Annex 15 on Qualification and Validation, the manufacturers are responsible for ensuring equipment is suitable for its intended purpose and for defining its requirements in a User Requirements Specification (URS) or functional specification.

In short, the user determines what’s needed; the vendor shows how their product meets those needs.

Why Ownership Matters?

When the customer owns the URS, everything aligns. The equipment fits its real operational needs, and the system passes regulatory scrutiny because it was built for its true purpose. And most importantly, it saves time, money, and frustration down the road.

When vendors take over the URS, it might seem faster, but it’s like letting someone else write your recipe — you’ll never get the exact flavour you wanted.
ravi

November 9, 2025

Uncategorized

Equipment Qualification, GMP Compliance, Pharmaceutical Validation, Quality Assurance, URS, User Requirement Specification
Demystifying GAMP 5 Software Classification: Understanding Categories 3, 4 and 5

Demystifying GAMP 5 Software Classifications

Summary:

In a GxP environment, the software to be acquired should be fit for use. In order to meet the user requirements, one buys software that can be used as-is, with configuration, or custom-developed. To ensure the appropriate documents are included in the qualification package, it is essential to identify the relevant qualification documents for each scenario. This article explores how the software classifications, defined in GAMP 5, aid in determining the necessary qualification documentation for software in Categories 3, 4, and 5.

Defining Software Qualification Requirements:

When a pharmaceutical company, be it a manufacturer or a CRO, purchases software for use in a GxP environment, they must create a clear and detailed User Requirement Specification (URS) that outlines their needs. In response to the URS, the software vendor(s) submit a Functional Specification (FS) that describes how their software will address the user requirements. All URS requirements must be tested and proven through qualification. A Traceability Matrix (TM) is a document that maps each specific requirement within the URS to corresponding testing scripts.

Every software qualification workflow requires a URS, FS, and TM to ensure that each requirement is properly addressed, tested, and fulfilled. The other documents in the qualification package depend on the category the software falls under per GAMP 5.

Category 3 consists of Commercial Off-the-Shelf Software (COTS) that is used as-is; for instance, Microsoft Excel (without macros), or statistical tools like JMP and Minitab. The qualification objective for such software is to ensure proper installation and expected performance. For software installed on a computer or server, Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) must be completed. For Software as a Solution (SaaS) applications, since the software is pre-installed on the cloud, a simplified IQ may be conducted together with a full OQ to comprise an IOQ, and a PQ test is performed.

Category 4 encompasses software that is configured without changing the code. Examples include Laboratory Information Management Systems (LIMS) or Manufacturing Execution Systems (MES), where modifications can be made to templates, forms, or workflows without changing the main software. Another example is an Excel sheet that has been configured for a specific use without macros or Visual Basic code. In addition to the qualification documents specified for Category 3 software, configured systems require a Configuration Specification (CS) to document the changes or settings that have been made.

Category 5 includes software developed from scratch or that has undergone code modifications. One example is an Excel sheet that has macros, scripts, or Visual Basic code added. These systems are unique to a company and may be developed in-house or by an external vendor. Testing for Category 5 is more detailed, involving unit, integration, and full system testing to ensure that all components function as intended. This is critical, as even minor code changes can impact performance. The same documents that are required for Category 4 are also required for Category 5. Additionally, a Design Specification (DS) is needed to explain the software construction, since the logic has been modified or custom-developed.

Conclusion:

Identifying a software’s category under GAMP 5 is not always clear. One does not decide on the basis of the software name; rather, it depends on its usage. The same software can potentially belong to any of the three categories—category 3 if used as-is, category 4 if configuration is required, or category 5 if custom coding is required. Higher the category classification, more extensive is the documentation and testing requirements.

ravi

November 5, 2025

Uncategorized

Computer System Validation, GAMP 5, GxP Compliance, Pharmaceutical Validation, Software Categories, Software Classification

Instrument Classification: Why One Qualification Strategy Doesn’t Fit Every Instrument

From Function to Classification

A Closer Look at the Categories

Conclusion

Reference:

Equipment Classification: The Decision That Drives Qualification

System Classification According to ISPE

Classification Outcomes

Where classification gets genuinely tricky

The Bottom Line

Reference

User Requirements Specification — Getting the Sequence Right.

Factory Acceptance and Site Acceptance Testing: Accelerating Equipment Qualification with ValDoc Pro

Who is actually Responsible for the URS?

Demystifying GAMP 5 Software Classification: Understanding Categories 3, 4 and 5