represents Configured Products , which are commercial software platforms adapted to meet specific business workflows without altering the underlying source code. According to the ISPE GAMP 5 framework, software in this tier carries a medium compliance risk because user-defined setups—such as custom workflows, electronic signatures, and calculation parameters—directly dictate data management and GxP compliance. Misconfiguring a Category 4 system can introduce data integrity gaps, making targeted validation of these configurations essential.