GAMP 5 is a risk-based approach to computerised system validation, not a certificate an EDC can hold. This page maps its ideas onto an EDC project so QA, data management and IT agree who owns each piece of evidence.
Free sandbox · No credit card · 21 CFR Part 11 aligned
| Vendor | Sponsor | |
|---|---|---|
| Product development and release control | Assess | |
| Intended-use statement and risk assessment | ||
| Study configuration (forms, checks, roles) | ||
| UAT scripts executed and signed | Support | |
| Change control for the live study | ||
| Periodic review and retirement |
What to know first
The framework
GAMP stands for Good Automated Manufacturing Practice, and the fifth edition of the guide is the reference many pharmaceutical quality teams use for computerised system validation. It is not law and it is not a standard you can pass. It is a way of thinking: define what the system is for, assess what could go wrong, scale testing to that risk, rely on the supplier's quality work where it is credible, and keep the system under control after go-live.
Two ideas matter most for EDC. The first is scaling effort to risk. A field that drives eligibility or the primary endpoint deserves more testing than a free-text comment box. The second is leveraging the supplier. For a commercial product, you do not retest everything the vendor already tests and controls; you assess the supplier, confirm the product fits your intended use, and focus your own testing on what you configured. The Second Edition leans harder on both, encouraging subject matter experts to apply critical thinking instead of generating documents for their own sake.
GAMP 5 sits alongside, not instead of, the rules that apply to your trial. For electronic records and signatures in FDA-regulated work, see the 21 CFR Part 11 compliance checklist. For EU expectations on computerised systems, see Annex 11 vs 21 CFR Part 11 and the EMA guideline on computerised systems.
Software categories
The categories describe how much of the system is standard product and how much is custom. Secondary sources describe the Second Edition as treating them as a continuum rather than a rigid label, so use this as a conversation starter with QA, not a ruling.
| Category | What it covers | Typical example in a trial setup | Validation emphasis |
|---|---|---|---|
| 1: Infrastructure | Operating systems, databases, networks | Cloud hosting layer under the EDC | Supplier assessment; qualification of infrastructure |
| 3: Non-configured product | Standard software used as delivered | A PDF reader or statistical package used without configuration | Confirm fit for purpose; version control |
| 4: Configured product | Standard software configured to your process | An EDC configured with your forms, checks, visits and roles | Supplier assessment plus testing of your configuration |
| 5: Custom application | Bespoke code written for you | Custom integrations or in-house built data capture | Full lifecycle validation including code review |
Category numbers come from secondary summaries; verify the list against the ISPE text.
What the vendor provides
The vendor side of an EDC validation is the product and the quality of its controls. These are the Capture controls a validation plan would typically map to.
Weight changed 68.0 to 68.5 kg
Site coordinator · Reason: Transcription error
Query Q-0014 answered on Weight
Site coordinator · Reason: Source checked
Vital signs form locked
Data manager · Reason: Visit cleaned
What the sponsor validates
Whatever the vendor provides, three things stay with you. They are also where inspectors tend to look first, because they are specific to your trial.
Scripts
24
Passed
19
Build your forms in the free sandbox and execute your scripts there. Sandbox and production are separate, so validation testing never touches live data.
A practical approach
An outline for discussion with your QA function. Your SOPs take precedence.
What the EDC will hold, which decisions rely on it, which regulations apply, who will use it.
Request the vendor's quality documentation and ask how releases are controlled. Record the answers. Use the vendor security questionnaire as a starting point.
Agree the software category with QA and rate each function by impact on participant safety and data integrity.
Document forms, visits, checks, calculated fields and roles. The data validation plan template helps.
Heavy testing for high-risk functions, light for low. Include negative tests, such as an out-of-range value that must raise a query.
Approve the forms, sign the validation summary, train users and record it.
Assess every amendment. Capture's approved forms are locked; amending one is a deliberate step. See eCRF versioning mid-study and protocol amendments without change orders.
Questions for any vendor
Ask every EDC vendor, Capture included, and get answers in writing.
Ask for the release notes process and how you are warned of changes that could affect a validated study.
Ask exactly what, in what form, and on which plan. Do not assume a package exists.
Ask what supplier audit access exists. Independent certifications are separate questions; check them directly.
Ask how rows are written, whether they can be altered and how that is evidenced.
Ask for format and timing, and test an export during UAT.
Capture hosts in the EU (Frankfurt) and the USA (N. Virginia). Confirm that location meets your requirements.
No EDC can be GAMP 5 certified; GAMP 5 is guidance, not a certification scheme. Validation is the sponsor's documented evidence for its own intended use. Capture provides controls such as the audit trail and e-signatures and, for Enterprise customers, documentation to support sponsor validation and UAT.
EDCs are commonly treated as configured products (Category 4), but classification is a decision for your QA function based on how you use the system. Confirm against the ISPE guide.
This page does not claim a pre-built IQ/OQ/PQ package. Enterprise customers receive documentation to support their validation and UAT; ask for the specifics during your evaluation.
Yes. The free sandbox includes every feature, with no credit card and no time limit, and sandbox and production are separate environments.
Part 11 sets requirements for electronic records and signatures. GAMP 5 is a method for demonstrating, with proportionate evidence, that a system is fit for its intended use. Capture offers Part 11-aligned controls; compliance is shared with the sponsor's own validated use.
Secondary sources describe a stronger emphasis on critical thinking, on focusing effort on risk and on computer software assurance concepts. Check the ISPE publication for the exact changes.
You remain responsible for assessing the impact on your validated study under your change control procedure. Ask each vendor how release notes and testing evidence are shared.
Yes. Capture is suitable for Phase 1, 2 and 3 studies; the amount of validation evidence scales with the risk of your study, not with the phase label.
Keep exploring
Computer system validation for trial software
Whose job validation is.
EDC UAT sandbox environment
Running UAT before go-live.
21 CFR Part 11 compliance checklist
The records and signature rules.
Annex 11 vs 21 CFR Part 11
EU and US expectations side by side.
Data validation plan template
Specify checks before testing them.
Vendor security questionnaire
Supplier assessment questions.
Free sandbox with every feature. Execute your scripts, then book a demo to talk through validation support for your study.