HQ Cortex
All compliance regimes

GAMP 5 (2nd Edition) — Computerized System Validation

ISPE's risk-based approach to validating computerized systems used in regulated GxP environments.

Supported
1(11%)
In progress
4(44%)
Not yet planned
4(44%)
Tracked9

Why this matters: GAMP 5 is the framework most regulated manufacturers will use to validate HQ Cortex within their own quality system. Customers will classify HQ Cortex as a Category 4 (configurable) system. This page outlines the validation artifacts we provide, with honest status. The 2nd Edition (2022) embraces FDA's Computer Software Assurance approach — risk-based, critical-thinking-led testing rather than blanket scripted testing.

We are not currently certified to this standard. The mapping below shows where our day-to-day controls already align.

Status legend

  • SupportedWe can do this today.
  • In progressPartially in place or actively in development.
  • Not yet plannedNot yet started or not in scope.

Validation Artifacts

  • Software categorization (Cat 1–5)

    Supported

    Per-module categorization aligning rigor to risk; HQ Cortex modules are Cat 1 (infra) through Cat 4 (configurable workflows).

    In HQ Cortex: A per-module GAMP 5 categorization is published at /validation, mapping infrastructure (Cat 1), configurable workflows (Cat 4), and AI-assisted authoring (Cat 5, low GxP impact) to the rationale behind each.

    GAMP 5 §M3

  • User Requirements Specification template

    Not yet planned

    Customer-adaptable URS template mapped to features and tests.

    In HQ Cortex: Not yet published.

    GAMP 5 §M2

  • Functional / configuration specification

    In progress

    Published functional spec per release; documented tenant-configurable items.

    In HQ Cortex: Internal functional documentation exists; customer-facing release-bound functional spec is being formalized.

    GAMP 5 §M2

  • Risk-based validation plan

    In progress

    Per-feature risk assessment driving test depth; product quality and patient safety impact called out.

    In HQ Cortex: A risk register published at /validation enumerates the major product areas with their patient-safety and product-quality impact. Closed-loop traceability from each risk entry to a specific test artifact is still being formalized.

    GAMP 5 §M3

  • Traceability matrix

    Not yet planned

    Auto-generated matrix linking requirements → design → tests → defects, exported per release.

    In HQ Cortex: Not yet implemented.

    GAMP 5 §M4

  • Operational qualification scripts for tenants

    Not yet planned

    Customer-runnable IQ/OQ/PQ scripts that exercise critical workflows in their tenant.

    In HQ Cortex: Not yet shipped.

    GAMP 5 §M5

  • CSA-aligned test strategy

    In progress

    Mix of scripted + unscripted/exploratory testing aligned with FDA Computer Software Assurance guidance.

    In HQ Cortex: A CSA-aligned test strategy is published at /validation, layering scripted unit/integration tests, strict type safety and schema validation, mandatory peer review on a protected main branch, and risk-based exploratory testing. A continuous-integration pipeline that runs the full suite on every pull request is the remaining piece to formalize this control.

    GAMP 5 2nd Ed., FDA CSA Final Guidance (2025)

  • Release notes flagging validation impact

    Not yet planned

    Each release tags features as PQI-impact / non-impact so customers can scope re-validation.

    In HQ Cortex: Not yet structured this way.

    GAMP 5 §O1

  • Periodic system review tooling

    In progress

    Dashboards covering change history, incidents, access reviews to support customer periodic reviews.

    In HQ Cortex: Org-level audit logs and version histories support this; a packaged periodic-review export is being built.

    GAMP 5 §O7

References

Last reviewed: May 2026.