What is GxP? GLP, GCP, GMP and GDP, and where Part 11 fits

Published 2026-10-23 16 min read

Chromolithograph of four glass bottles each standing on its own gridded document — One bottle to a document: each GxP keeps its own records, and Part 11 governs them all once they are electronic.

01Discovery researchNo GxP rule yetRecords stay outside Part 11 until a rule requires them or they go to FDA

02Nonclinical studiesGLP21 CFR 58Safety studies that support an FDA application

03Clinical investigationsGCP21 CFR 50, 56, 312, 812Consent, IRB review, investigator and sponsor records; ICH E6(R3) as guidance

04Manufacture and testingGMP / QMSR21 CFR 210, 211, 600s, 820Drugs and biologics under CGMP; finished devices under the QMSR

05DistributionGDP21 CFR 205Wholesale prescription drug records, via the state licence

21 CFR Part 11 runs under every stage from 02 to 05: it applies to the records each stage's rule requires, once they are kept or signed electronically, and to anything submitted to FDA.

A product's life, the GxP rule for each stage, and Part 11 underneath.

GxP is the family of good-practice rules for regulated life-science work: GLP in the lab, GCP in clinical trials, GMP in manufacturing, GDP in distribution. Each one decides which records you keep. 21 CFR Part 11 decides how those records may be kept and signed on a computer.

This guide sets out each rule as it reaches a small US lab or device maker: who it binds, the records it requires, how long they are kept, and the exact point where a record becomes a Part 11 record.

GxP in plain words

GxP is shorthand for the “good practice” rules that regulated life-science work runs on. The letter x is a placeholder for the area: laboratory (GLP), clinical (GCP), manufacturing (GMP) and distribution (GDP) are the four a small lab or device maker meets. It is a working label, not the name of one regulation. MHRA's guidance on GxP data integrity, for one, covers GLP, GCP, GMP, GDP and pharmacovigilance practice (GPvP) under the one word.

In the US each GxP is a part of Title 21 of the Code of Federal Regulations, and each one tells you which records to keep, who signs them and how long they live. FDA calls those the predicate rules. 21 CFR Part 11 sits across all of them: it adds nothing to the list of records, it sets the conditions under which those records can be electronic and signed on screen. The full picture of Part 11 is in 21 CFR Part 11: what it is and who it binds.

Common misreading

“GxP compliant software” is not a status any agency grants. The GxP rules bind the firm doing the regulated work, and Part 11 binds “persons who use” the system. A vendor can state that its product supports the controls; you still validate it for your own use.

The GxP family on one record

Six rows cover what a small US lab, CRO or device maker runs into. Read across a row: who the rule binds, the records it makes you keep, and the point where those records become Part 11 records.

Scroll sideways for every column

The GxP rules: who each binds, the records each requires, and where Part 11 comes in
Rule	Who it binds	Records it requires	Where Part 11 comes in
GLP Good laboratory practice 21 CFR 58	Testing facilities running nonclinical laboratory studies that support, or are meant to support, an FDA research or marketing application § 58.1(a)	Raw data recorded promptly, dated and signed by the person entering it; changes that do not obscure the original entry, with a reason; an archive kept for the § 58.195 period § 58.130(e), § 58.195	Automated data collection is named in the rule: the person entering data is identified at input. Raw data kept or relied on electronically is a Part 11 record; so are study director and QA signatures applied on screen.
GCP Good clinical practice 21 CFR 50, 56, 312, 812	Sponsors, investigators and IRBs of FDA-regulated clinical investigations of drugs, biologics and devices § 50.1(a), § 56.103	A consent form signed and dated by the subject; IRB minutes and correspondence; investigator case histories; sponsor records of drug or device shipment and disposition § 50.27(a), § 56.115, § 312.62, § 312.57, § 812.140	EDC entries, eConsent signatures and the electronic trial master file. FDA's October 2024 clinical-investigations Q&A expands the 2003 Part 11 guidance for investigations under parts 312 and 812.
GMP Current good manufacturing practice (drugs) 21 CFR 210, 211	Anyone who manufactures, processes, packs or holds a drug; a phase 1 investigational drug is exempt from part 211 until it is used in phase 2 or 3 or marketed § 210.1(a), § 210.2(c)	Batch production and control records for each batch; laboratory records with complete data from all tests; controls on computer systems and a backup file of data § 211.188, § 211.194(a), § 211.68(b)	Electronic batch records, LIMS results and chromatography data. § 211.68(b) already asks for authorised-only changes and checked input and output; Part 11 adds the audit trail and signature rules on top.
GMP (biologics) Biological products: general 21 CFR 600–680	Manufacturers of biological products for human use; parts 600 through 680 supplement parts 210 and 211 § 210.2(a)	Records made concurrently with each step, legible and indelible, naming the person immediately responsible, so an inspector can trace every lot § 600.12(a)	“Indelible” on a screen means a change can never overwrite the old value unseen: the § 11.10(e) audit trail does that job for electronic records.
QMSR Device quality management system regulation 21 CFR 820	Manufacturers of finished devices intended for human use; makers of components or parts are not covered § 820.1(a), § 820.1(a)(2)	Control of records under ISO 13485 Clause 4.2.5, plus set content for complaint, servicing and UDI records § 820.35	The QMSR “supplements regulations in other parts of this chapter except where explicitly stated otherwise”, and Part 11 is not excepted. eQMS complaint, CAPA, design and training records signed on screen are Part 11 records.
GDP Good distribution practice 21 CFR 205 (US); EU GDP guidelines	Wholesale distributors of prescription drugs, through their state licence; in the EU, holders of a wholesale distribution authorisation § 205.1	Records of every receipt and distribution (source, identity and quantity, dates), open to inspection for 3 years § 205.50(f)	Part 205 sets the minimum content of state licensing law, not a records rule FDA applies to the distributor directly, so Part 11's reach here is less direct than in GMP. Ask your regulatory lead before you assume either way.

Cites are 21 CFR sections as published on the eCFR, up to date as of 2026-10-20, read 2026-10-22. The device row is the amended part 820, in force since 2026-02-02.

Two things the table shows. First, the GxPs overlap: a biologic is made under parts 210 and 211 and also under parts 600 to 680 (§ 210.2(a)), and a clinical trial of a device runs under parts 50, 56 and 812 at once. Second, Part 11 is the same in every row. What changes is the record it lands on, and that is always set by the row's own rule. If you want the software side of this table, our GxP compliance software guide for small labs maps each duty to the kind of system that usually carries it.

Takeaway

Write down which rows apply to you before you buy or validate anything. A lab that only runs GLP studies and a device maker under the QMSR need different systems, but both inventory their records the same way.

Which GxPs bind you

Pick what your firm does. The answer lists the rules that bind it and the systems to put on your Part 11 inventory first.

What does your firm do?

Pick every line that fits. Pre-set to a small drug QC lab.

One GxP binds you

GMP
21 CFR 210, 211
Put these on your Part 11 inventory first:
- Electronic batch record
- LIMS and chromatography data system
- Document control for master records and SOPs

GLP: nonclinical studies, 21 CFR 58

Part 58 covers “nonclinical laboratory studies that support or are intended to support applications for research or marketing permits” for FDA-regulated products (§ 58.1(a)). Discovery screening that never reaches an application is outside it; a toxicology study run for an IND or an IDE is inside it, because § 58.3 lists both as applications for a research permit.

Its data rule is the one most GLP software is built around. Paper data is recorded “directly, promptly, and legibly in ink”, dated and signed. For instruments and data-capture systems § 58.130(e) says the person responsible “shall be identified at the time of data input”, and any change “shall be made so as not to obscure the original entry, shall indicate the reason for change, shall be dated, and the responsible individual shall be identified.”

Where GLP asks for more than Part 11

Part 11's audit trail (§ 11.10(e)) records who did what and when, and says changes “shall not obscure previously recorded information”. It does not ask for a reason. Part 58 does. A GLP system whose audit trail has no reason-for-change field meets Part 11 and still fails the predicate rule.

Records go to the archive and stay there for the shortest of three periods (§ 58.195(b)): 2 years after FDA approves the application the study supported, 5 years after the results were submitted, or 2 years after the study ends when nothing is submitted. The audit trail goes with them, because Part 11 keeps it “at least as long as” the record. Our guide to what an audit trail must hold walks through the fields.

Takeaway

Check one thing on every GLP data system today: can a user change a value without typing a reason?

GCP: clinical investigations, 21 CFR 50, 56, 312 and 812

There is no single US regulation called GCP. The binding parts are four: part 50 for informed consent, part 56 for IRBs, part 312 for drug and biologic investigations under an IND and part 812 for device investigations under an IDE. ICH E6 sits on top as guidance.

Consent is documented by a form “signed and dated by the subject or the subject's legally authorized representative at the time of consent” (§ 50.27(a)). Signed on a tablet, that signature is an electronic signature standing in for one a predicate rule requires, which is the plainest case of a Part 11 record there is.
IRB minutes, correspondence and member lists are kept “for at least 3 years after completion of the research” (§ 56.115(b)).
Investigators keep case histories, including case report forms and signed and dated consent forms (§ 312.62(b) for drugs, § 812.140(a)(3) for devices). In an EDC system those entries are electronic records under Part 11.

FDA's own reading for trials is its October 2024 guidance, “Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers”, which expands the 2003 Part 11 guidance for investigations under parts 312 and 812. If you are choosing systems, our comparison of EDC and eConsent software reads each one against the Part 11 rows.

Where ICH E6 stands

ICH adopted E6(R3) in two stages: the Principles and Annex 1 on 2025-01-06, and Annex 2 (decentralised and pragmatic elements, real-world data) on 2026-06-03. ICH now publishes all three as one consolidated E6(R3) guideline. FDA announced the Principles and Annex 1 as final guidance on 2025-09-09 (90 FR 43460); as of 2026-10-22 the Federal Register shows FDA's Annex 2 only as the December 2024 draft. ICH lists the European Commission as having implemented E6(R3) on 2025-07-23.

In the US, E6 is guidance and parts 50, 56, 312 and 812 are the law. E6(R3) is still worth reading for its records section. It asks that systems “maintain logs of user account creation, changes to user roles and permissions and user access”, that “audit trails, reports and logs are not disabled”, and that the captured date and time be “unambiguous (e.g., coordinated universal time (UTC))” (section 4.2.2). Part 11 is looser on this point: FDA's 2003 guidance does not expect the signer's local time, only documentation that explains the time-zone reference.

Takeaway

A sponsor-investigator running a small device study carries parts 50, 56 and 812 at once. List the consent, IRB and case-history records first; those are the ones an inspector asks for.

GMP: drugs and biologics, 21 CFR 210, 211 and 600

Parts 210 and 211 hold “the minimum current good manufacturing practice” for anyone who manufactures, processes, packs or holds a drug (§ 210.1(a)). Two scope points catch small firms. A drug made for a phase 1 study is exempt from part 211, but the exemption ends once that drug is used in phase 2 or 3 or is marketed (§ 210.2(c)). And a firm that does only some operations, say contract testing, “need only comply with those regulations applicable to the operations in which the person is engaged” (§ 210.2(b)).

The records that most often end up in software:

Batch production and control records for each batch, including “identification of the persons performing and directly supervising or checking each significant step” (§ 211.188(b)(11)). Each of those identifications becomes an electronic signature in an eBR.
Laboratory records with “complete data derived from all tests”, including graphs, charts and spectra from instruments (§ 211.194(a)).
Controls over computer systems so that changes to records are “instituted only by authorized personnel”, with input and output checked and “a backup file of data” kept (§ 211.68(b)). This is GMP's own computer rule, and it applies whether or not Part 11 does.

Batch records are kept “for at least 1 year after the expiration date of the batch” (§ 211.180(a)). Biologics add parts 600 to 680 on top (§ 210.2(a)): records made “concurrently with the performance, of each step”, “legible and indelible”, naming the person immediately responsible, and kept at least five years after the records of manufacture are completed or six months after the latest expiration date, whichever is later (§ 600.12). For the systems that carry batch records, see our electronic batch record software comparison; for proving those systems work, computer system validation for small labs.

Takeaway

If your QC lab tests drug products for a client under contract, part 211 binds the tests you run: § 210.3(b)(12) counts “testing, and quality control” as part of manufacture. The client's batch record is theirs; your laboratory records and your LIMS are yours to control.

Devices: the QMSR, 21 CFR 820

The device GMP is now the Quality Management System Regulation. FDA published the rule on 2024-02-02 (89 FR 7496) and it took effect on 2026-02-02. It incorporates ISO 13485:2016 by reference and keeps a few sections of its own. It binds manufacturers of finished devices for human use; makers of “components or parts of finished devices” are outside it (§ 820.1(a)(2)).

Records sit in § 820.35: ISO 13485 Clause 4.2.5 on control of records, plus required content for complaint records (device name, date received, UDI, complainant, nature of the complaint, corrective action, reply), servicing records and UDI. Two consequences for Part 11:

Part 11 still applies. The QMSR “supplements regulations in other parts of this chapter except where explicitly stated otherwise” (§ 820.1(b)), and it states no exception for Part 11.
The old software-validation cite is gone. The QMSR removed § 820.70, so 820.70(i) no longer exists; software validation now sits in ISO 13485 Subclauses 4.1.6, 7.5.6 and 7.6. FDA's Computer Software Assurance guidance, written for device makers, explains a risk-based way to do it (CSA vs CSV).

Common misreading

The QMSR incorporates ISO 13485; it does not require ISO 13485 certification. What it requires is a quality system that meets the clauses it incorporates.

The rest of the change, clause by clause, is in FDA QMSR for small device makers.

GDP: distribution, and the other GDP

In the EU, good distribution practice is a full guideline. EMA describes it as “the minimum standards that a wholesale distributor must meet to ensure that the quality and integrity of medicines is maintained throughout the supply chain”, set out in two European Commission guidelines, one for medicines and one for active substances. PIC/S's data-integrity guidance (PI 041-1, 2021) is written for “GMP/GDP environments” together.

The US has no FDA regulation named GDP. The nearest is 21 CFR 205, which sets the minimum a state licensing law must require of wholesale prescription drug distributors (§ 205.1): records of every receipt and distribution, with source, identity, quantity and dates, open to inspection for 3 years (§ 205.50(f)), and storage conditions documented with “manual, electromechanical, or electronic temperature and humidity recording equipment” (§ 205.50(c)(2)).

You will also hear GDP used for good documentation practice: ink, dated corrections, no obscured entries. In the US those habits are not a separate rule; they are written into the predicate rules themselves, as in § 58.130(e) and § 600.12(a). The record-quality version of the same idea is ALCOA+.

Which predicate rule makes a record a Part 11 record

FDA defines predicate rules as “the underlying requirements set forth in the Act, PHS Act, and FDA regulations (other than part 11).” Every GxP part in the table above is one. Under the narrow reading in FDA's 2003 Scope and Application guidance, a record is a Part 11 record in four cases:

01Records a predicate rule requires, kept electronically in place of paper.
02Records kept electronically as well as on paper, when the electronic copy is relied on for regulated work.
03Records submitted to FDA electronically.
04Electronic signatures meant to equal handwritten signatures a predicate rule requires.

So the question is never “is this system GxP?” but “which rule requires this record, and is the electronic version the one we rely on?” Seven records, worked through:

Scroll sideways for every column

Seven records traced from their predicate rule to a Part 11 answer
Record	Predicate rule	Part 11 record?	Why
HPLC result reviewed and approved on screen in a drug QC lab	§ 211.194(a)	Yes	Required, kept electronically and relied on.
The same result printed and signed in ink, with an SOP naming the printout as the record	§ 211.194(a)	Not the printout	Paper that meets the rule and is relied on does not trigger Part 11; § 211.68(b) still governs the computer system.
Body weights sent from a balance into a GLP study system	§ 58.130(e)	Yes	The rule names automated data collection and wants the person at input identified.
Consent signed on a tablet	§ 50.27(a)	Yes, a signature	An electronic signature in place of one the rule requires.
Device complaint logged in an eQMS	§ 820.35(a)	Yes	A required complaint record kept electronically.
Screening notebook in discovery, nothing filed	None	No	No rule requires it. Its data become Part 11 records once submitted to FDA.
Receiving log in a distributor's ERP	§ 205.50(f)	Ask	Required through state licensing law, not an FDA records rule on the distributor.

Write the decision down

When a printout is your record, FDA's 2003 guidance recommends documenting that decision, for example in an SOP. Without that, which version is the record stays an open question when an inspector asks.

The Part 11 applicability checker runs the same questions for one system at a time and gives you the answer to file.

How long each GxP keeps its records

Part 11 sets no retention period. The predicate rule does, and the periods differ more than most teams expect. Archive, backup and audit-trail settings in every system should follow the longest period among the records it holds.

Scroll sideways for every column

Record retention by GxP rule
Records	How long	Cite
GLP study records	Shortest of: 2 years after approval, 5 years after submission, or 2 years after the study ends	§ 58.195(b)
IRB records	At least 3 years after the research is completed	§ 56.115(b)
IND investigator records	2 years after approval for the indication studied, or 2 years after the investigation is discontinued and FDA is notified	§ 312.62(c)
IND sponsor records	2 years after the drug is approved, or 2 years after investigational shipment stops and FDA is notified	§ 312.57(c)
IDE investigator and sponsor records	2 years after the later of: end of the investigation, or the date the records stop supporting a marketing submission	§ 812.140(d)
Drug batch records	At least 1 year after the batch expires	§ 211.180(a)
Biologics records	5 years after the records of manufacture are completed or 6 months after the latest expiry, whichever is later	§ 600.12(b)
Wholesale distribution records	3 years after creation	§ 205.50(f)(2)
Part 11 itself	None. The audit trail is kept as long as the record it covers	§ 11.10(e)

Device records follow ISO 13485 Clause 4.2.5 through § 820.35; the standard is sold by ISO, so read the period in your own copy. A plain summary of each period, not legal advice.

Takeaway

Put the retention period beside each record type in your system inventory, with its cite.

Often called GxP, not a US rule

Several documents get filed under GxP in audits and vendor decks. They are worth knowing, but none of them is a US predicate rule, and none of them makes a record a Part 11 record.

ICH E6(R3): In the US, FDA guidance. The binding GCP duties are parts 50, 56, 312 and 812.
EU GMP Annex 11: EU GMP guidance on computerised systems, the January 2011 revision, in operation since 2011-06-30. A revision was consulted on in 2025; the 2011 text remains the one in force. See EU Annex 11 for US labs.
GAMP 5: ISPE industry guidance, second edition July 2022. Useful method, not law. See what GAMP 5 is.
ISO 13485: A standard. It binds a US device maker only through the QMSR, which incorporates the 2016 edition by reference.
ALCOA+: FDA's 2018 data-integrity Q&A uses ALCOA (five attributes). The four added ones (complete, consistent, enduring, available) are listed in PIC/S PI 041-1 (2021).

First steps for a small lab or device maker

Five steps, in order. The output is one inventory that answers the GxP question and the Part 11 question.

01
Name your rows
List what the firm does and the GxP parts that follow from it. The picker above does this in a minute.
02
List the records each rule requires
One line per record type, with its cite and its retention period from the table above.
03
Mark where each record lives
Paper, electronic, or both. Where both, write down which one you rely on, in an SOP.
04
Run each system through Part 11
Every system holding an electronic record from step 3 goes through the Part 11 compliance checklist.
05
Close the predicate-rule gaps
Check what the GxP asks beyond Part 11: a reason for every change under § 58.130(e), the person checking each significant step under § 211.188(b)(11).

GxP on one sheet

GxP: A label for the good-practice rules; the x is the area
GLP: 21 CFR 58, nonclinical studies for an FDA application
GCP: 21 CFR 50, 56, 312, 812, with ICH E6(R3) as guidance
GMP: 21 CFR 210, 211 for drugs; parts 600 to 680 added for biologics
Devices: 21 CFR 820, the QMSR, in force since 2026-02-02
GDP: 21 CFR 205 as the US minimum for state licences; EU GDP guidelines
Part 11: Not a GxP. It governs GxP records once they are kept or signed electronically
Retention: Set by each GxP rule; Part 11 sets none

Questions

What does GxP stand for?

Good “x” practice, where x is the area: GLP for laboratory, GCP for clinical, GMP for manufacturing, GDP for distribution. Some lists add GPvP (pharmacovigilance); MHRA's GxP data-integrity guidance covers all five.

Is GxP a law?

The word is not. The rules behind it are: in the US each one is a part of Title 21 of the Code of Federal Regulations, issued by FDA, and binding like any regulation. Guidance documents around them, such as ICH E6 in the US or GAMP 5 anywhere, are not.

What is the difference between GMP and CGMP?

The C is “current”. Title 21 says “current good manufacturing practice” throughout (§ 210.1), and the device QMSR describes itself the same way: “Current good manufacturing practice (CGMP) requirements are set forth in this quality management system regulation” (§ 820.1(a)).

Is Part 11 one of the GxPs?

No. Part 11 is not a predicate rule; FDA defines those as the requirements in the Act, the PHS Act and FDA regulations “other than part 11”. It adds the conditions for keeping and signing GxP records electronically. What Part 11 is covers it in full.

Does GxP apply to an early-stage biotech?

Only to the work a rule reaches. Discovery research with nothing filed is outside the GxPs. A nonclinical study meant for an IND falls under part 58, the first clinical study under parts 50, 56 and 312, and drug made for phase 2 or 3 under part 211 (§ 210.2(c)).

Does a contract testing lab fall under GMP?

For drug products, yes. Part 210 counts “testing, and quality control of drug products” as part of manufacture (§ 210.3(b)(12)), and a firm doing only some operations complies with the rules for those operations (§ 210.2(b)).

Did ICH E6(R3) replace Part 11 for clinical trials?

No. In the US, E6(R3) is guidance (FDA announced the Principles and Annex 1 as final in September 2025). Part 11 is a regulation and still governs electronic records and signatures in trials, read through FDA's October 2024 clinical-investigations Q&A.

Sources

21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
Part 11, Electronic Records; Electronic Signatures: Scope and Application, FDAread 2026-10-22
21 CFR Part 58, Good Laboratory Practice (§§ 58.1, 58.3, 58.130, 58.195), eCFRread 2026-10-22
21 CFR Part 50, Protection of Human Subjects (§§ 50.1, 50.27), eCFRread 2026-10-22
21 CFR Part 56, Institutional Review Boards (§§ 56.103, 56.115), eCFRread 2026-10-22
21 CFR Part 312, Investigational New Drug Application (§§ 312.57, 312.62), eCFRread 2026-10-22
21 CFR Part 812, Investigational Device Exemptions (§ 812.140), eCFRread 2026-10-22
21 CFR Part 210, CGMP in Manufacturing, Processing, Packing, or Holding of Drugs (§§ 210.1–210.3), eCFRread 2026-10-22
21 CFR Part 211, CGMP for Finished Pharmaceuticals (§§ 211.68, 211.180, 211.188, 211.194), eCFRread 2026-10-22
21 CFR Part 600, Biological Products: General (§ 600.12), eCFRread 2026-10-22
21 CFR Part 820, Quality Management System Regulation (§§ 820.1, 820.35), eCFRread 2026-10-22
Medical Devices; Quality System Regulation Amendments, 89 FR 7496, Federal Registerread 2026-10-22
Computer Software Assurance for Production and Quality Management System Software, FDAread 2026-10-22
21 CFR Part 205, Guidelines for State Licensing of Wholesale Prescription Drug Distributors (§§ 205.1, 205.50), eCFRread 2026-10-22
Efficacy Guidelines: E6(R3) Good Clinical Practice, status and implementation, ICHread 2026-10-22
ICH E6(R3) Guideline for Good Clinical Practice, consolidated Step 4 text (PDF), ICHread 2026-10-22
E6(R3) Good Clinical Practice; guidance for industry; availability, 90 FR 43460, Federal Registerread 2026-10-22
E6(R3) Good Clinical Practice: Annex 2; draft guidance; availability, 89 FR 106519, Federal Registerread 2026-10-22
Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Q&A, FDAread 2026-10-22
Data Integrity and Compliance With Drug CGMP: Questions and Answers, FDAread 2026-10-22
Good distribution practice, European Medicines Agencyread 2026-10-22
Guidance on GxP data integrity, MHRAread 2026-10-22
PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (PDF), PIC/Sread 2026-10-22
EudraLex Volume 4, Annex 11: Computerised Systems (PDF), European Commissionread 2026-10-22
GAMP 5 Guide, 2nd Edition, ISPEread 2026-10-22