I think folks tend to fall into a trap when it comes to equipment and GAMP5, automatically assuming that because it is equipment it must be Category 3. Oh, how that can lead to problems.

When thinking about equipment it is best to think in terms of “No Configuration” and ” Low Configuration” software. This terminology is used to describe software that requires little to no configuration or customization to meet the user’s needs.

No Configuration(NoCo) aligns with GAMP 5 Category 3 software, which is described as “Non-Configured Products”. These are commercial off-the-shelf software applications that are used as-is, without any customization or with only minimal parameter settings. My microwave is NoCo.

Low Configuration(LoCo) typically falls between Category 3 and Category 4 software. It refers to software that requires some configuration, but not to the extent of fully configurable systems. My PlayStation is LoCo.

The distinction between these categories is important for determining the appropriate validation approach:

• Category 3 (NoCo) software generally requires less extensive validation efforts, as it is used without significant modifications. Truly it can be implicit testing.
• Software with low configuration may require a bit more scrutiny in validation, but still less than fully configurable or custom-developed systems.

Remember that GAMP 5 emphasizes a continuum approach rather than strict categorization. The level of validation effort should be based on the system’s impact on patient safety, product quality, and data integrity, as well as the extent of configuration or customization.

When is Something Low Configuration?

Low Configuration refers to software that requires minimal setup or customization to meet user needs, falling between Category 3 (Non-Configured Products) and Category 4 (Configured Products) software. Here’s a breakdown of what counts as low configuration:

1. Parameter settings: Software that allows basic parameter adjustments without altering core functionality.
2. Limited customization: Applications that permit some tailoring to specific workflows, but not extensive modifications.
3. Standard modules: Software that uses pre-built, configurable modules to adapt to business processes.
4. Default configurations: Systems that can be used with supplier-provided default settings or with minor adjustments.
5. Simple data input: Applications that allow input of specific data or ranges, such as electronic chart recorders with input ranges and alarm setpoints.
6. Basic user interface customization: Software that allows minor changes to the user interface without altering underlying functionality.
7. Report customization: Systems that permit basic report formatting or selection of data fields to display.
8. Simple workflow adjustments: Applications that allow minor changes to predefined workflows without complex programming.

It’s important to note that the distinction between low configuration and more extensive configuration (Category 4) can sometimes be subjective. The key is to assess the extent of configuration required and its impact on the system’s core functionality and GxP compliance. Organizations should document their rationale for categorization in system risk assessments or validation plans.

Attribute	Category 3 (No Configuration)	Low Configuration	Category 4
Configuration Level	No configuration	Minimal configuration	Extensive configuration
Parameter Settings	Fixed or minimal	Basic adjustments	Complex adjustments
Customization	None	Limited	Extensive
Modules	Pre-built, non-configurable	Standard, slightly configurable	Highly configurable
Default Settings	Used as-is	Minor adjustments	Significant modifications
Data Input	Fixed format	Simple data/range input	Complex data structures
User Interface	Fixed	Basic customization	Extensive customization
Workflow Adjustments	None	Minor changes	Significant alterations
User Account Management	Basic, often single-user	Limited user roles and permissions	Advanced user management with multiple roles and access levels
Report Customization	Pre-defined reports	Basic formatting/field selection	Advanced report design
Example Equipment	pH meter	Electronic chart recorder	Chromatography data system
Validation Effort	Minimal	Moderate	Extensive
Risk Level	Low	Low to Medium	Medium to High
Supplier Documentation	Heavily relied upon	Partially relied upon	Supplemented with in-house testing

Here’s the thing to be aware of, a lot of equipment these days is more category 4 than 3, as the manufacturers include all sorts of features, such as user account management and trending and configurable reports. And to be frank, I’ve seen too many situations where Programmable Logic Controllers (PLCs) didn’t take into account all that configuration from standard function libraries to control specific manufacturing processes.

Your methodology needs to keep up with the technological growth curve.