GxP is an umbrella term for the regulations, guidelines, and quality practices used to control work that can affect product quality, patient safety, and the integrity of regulated records.
Depending on the activity being performed, different Good Practice frameworks may apply, including Good Manufacturing Practice (GMP), Good Laboratory Practice (GLP), Good Clinical Practice (GCP), and Good Distribution Practice (GDP). Good Documentation Practices (GDocP) provide cross-cutting documentation principles used throughout these regulated environments.
This guide focuses on the fundamental principles shared across GxP environments: controlled processes, qualified personnel, suitable equipment, reliable documentation, data integrity, validation or qualification where appropriate, and the ability to demonstrate that regulated activities were performed as intended.
Organizations evaluating computerized tools for regulated processes should separately consider system functionality, validation support, electronic-record controls, supplier evidence, and intended use. For that topic, see What Software Supports GxP Compliance in Life Sciences?.
Table of Contents
- What is GxP Compliance?
- Why GxP Compliance Matters in Life Sciences
- The Main GxP Frameworks and Practices: GMP, GLP, GCP, GDP, and GDocP
- Good Documentation Practices (GDocP) and ALCOA+
- The GxP Compliance Lifecycle
- Validation and Qualification in GxP
- GxP Documentation Requirements
- 21 CFR Part 11 and Electronic Records
- Common GxP Compliance Challenges
- Electronic Systems in a GxP Environment
- How to Prepare for a GxP Audit or Inspection
- Practical GxP Practices for 2026
- Frequently Asked Questions
What is GxP Compliance?
GxP means "Good x Practice," where the "x" identifies the applicable practice area, such as manufacturing, laboratory, clinical, or distribution. Cross-cutting practices such as Good Documentation Practices (GDocP) support these areas by defining expectations for reliable, traceable records.
GxP requirements are intended to ensure that regulated activities are performed under appropriate control and that the resulting records can be trusted. Depending on the activity, this may include requirements for:
- Defined procedures and responsibilities
- Qualified personnel
- Suitable and maintained equipment
- Validated or qualified processes and computerized systems
- Controlled records and documentation
- Data integrity and traceability
- Change control and ongoing review
The exact requirements are not identical for every organization or every record. They are determined by the regulations and guidance that apply to the company's activities and by the risk and intended use of the process or system.
Why GxP Compliance Matters in Life Sciences
GxP controls exist because unreliable processes and unreliable records can lead to poor decisions about product quality and patient safety. They also make it difficult for a company to demonstrate what actually occurred during manufacturing, testing, maintenance, calibration, validation, or other regulated work.
Common consequences of weak GxP controls include:
- Inability to demonstrate that equipment or processes were in a controlled state
- Incomplete or unreliable records
- Data-integrity concerns
- Inspection observations or other regulatory findings
- Repeated deviations and corrective actions
- Product-quality or operational risk
- Significant effort reconstructing records during audits and inspections
Strong GxP practices do not eliminate every problem. They provide a controlled framework for detecting problems, documenting what occurred, assessing impact, and taking appropriate action.
The Main GxP Frameworks and Practices: GMP, GLP, GCP, GDP, and GDocP
GxP is not a single regulation. Different Good Practice frameworks apply to different regulated activities, while some practices, such as Good Documentation Practices (GDocP), apply across multiple GxP areas.
1. GMP - Good Manufacturing Practice
Good Manufacturing Practice (GMP) governs the manufacture and control of regulated products such as pharmaceuticals and biologics. GMP requirements address the facilities, equipment, processes, personnel, documentation, and quality systems used to manufacture products consistently and under controlled conditions.
Equipment-related GMP activities commonly include:
- Equipment identification and status
- Calibration
- Preventive and corrective maintenance
- Qualification and validation
- Cleaning and change control where applicable
- Complete and retrievable equipment records
2. GLP - Good Laboratory Practice
Good Laboratory Practice (GLP) applies to specified nonclinical laboratory studies and establishes controls intended to support the quality and integrity of study data.
Depending on the laboratory and study, controlled activities may include:
- Equipment calibration and maintenance
- Study protocols and procedures
- Test and reference items
- Raw data and record retention
- Personnel responsibilities and training
- Quality assurance oversight
3. GCP - Good Clinical Practice
Good Clinical Practice (GCP) applies to clinical trials involving human participants. It addresses trial design and conduct, protection of participants, responsibilities of investigators and sponsors, and the credibility and traceability of clinical-trial data.
GCP activities commonly involve:
- Protocol control
- Informed consent
- Trial documentation
- Data integrity
- Safety reporting
- Defined investigator and sponsor responsibilities
4. GDP - Good Distribution Practice
Good Distribution Practice (GDP) addresses the controlled storage and distribution of medicinal products. It is intended to help ensure that product quality and the integrity of the distribution chain are maintained after manufacture.
Note: In this guide, GDP refers to Good Distribution Practice. The abbreviation GDP is also sometimes used for Good Documentation Practices. To avoid ambiguity, this guide uses GDocP for Good Documentation Practices.
GDP controls may include:
- Storage conditions
- Temperature monitoring
- Transportation controls
- Traceability
- Handling of returns, complaints, and recalls
- Qualification of relevant facilities, equipment, and service providers
5. GDocP - Good Documentation Practices
Good Documentation Practices (GDocP) are cross-cutting practices used to ensure that records created during regulated activities are reliable, understandable, traceable, and maintained appropriately throughout their lifecycle.
Unlike GMP, GLP, GCP, or GDP, GDocP is not generally treated as a separate regulatory regime. Instead, GDocP principles support documentation and data integrity across multiple GxP environments.
GDocP commonly addresses:
- Who performed or documented an activity
- When information was recorded
- How corrections and changes are documented
- Record legibility and completeness
- Original records and verified copies
- Record review, retention, and retrieval
Good Documentation Practices (GDocP) and ALCOA+
Good Documentation Practices (GDocP) are not limited to one GxP sector. They cut across GMP, GLP, GCP, GDP, and other regulated activities. The objective is to create records that accurately reflect what occurred and remain understandable and reliable throughout their required lifecycle.
Data-integrity principles are often summarized using ALCOA+:
| Principle | Meaning |
|---|---|
| Attributable | It should be possible to determine who performed or documented an activity. |
| Legible | Records should remain readable and understandable. |
| Contemporaneous | Information should be recorded at the time the activity occurs, as appropriate. |
| Original | The original record or an appropriately verified true copy should be maintained. |
| Accurate | Records should correctly represent the activity or result. |
| + | Complete, consistent, enduring, and available. |
For electronic records, GDocP also depends on the controls surrounding the system: user access, audit trails where appropriate, record review, backup and recovery, change control, retention, and the procedures used by the organization.
The GxP Compliance Lifecycle
GxP compliance is not a one-time project. Regulated processes and systems must remain controlled as they are introduced, used, changed, reviewed, and eventually retired.
1. Define scope and requirements
- Identify the regulations and quality requirements that apply.
- Determine which processes, systems, equipment, and records are GxP-relevant.
- Define intended use and user requirements.
- Use risk assessment to determine the level of control and verification required.
2. Implement controlled processes and systems
- Establish procedures and responsibilities.
- Configure systems for their intended use.
- Define user roles and access.
- Establish document, record, and change-control processes consistent with GDocP principles.
3. Qualify and validate as appropriate
- Verify that equipment and computerized systems are suitable for intended use.
- Document testing and acceptance criteria appropriate to the risk.
- Resolve significant deficiencies before regulated use.
4. Operate in a controlled state
- Perform work according to approved procedures.
- Maintain calibration, maintenance, validation, and other required records in accordance with applicable GDocP expectations.
- Control user access and changes.
- Review records and audit trails where required by procedure, regulation, or risk.
5. Review and improve
- Investigate deviations and recurring problems.
- Assess changes before implementation.
- Periodically review system status and controls where appropriate.
- Keep validation and qualification evidence current with significant changes.
Validation and Qualification in GxP
Validation provides documented evidence that a process or system is suitable for its intended use. Qualification is commonly used for equipment, utilities, facilities, and elements of computerized-system implementation.
The amount and type of validation should be based on intended use, complexity, risk, and applicable requirements. There is not one universal validation package that must be applied identically to every system.
Where IQ, OQ, and PQ fit
IQ - Installation Qualification documents that equipment or a system has been installed and configured as intended.
OQ - Operational Qualification documents that defined functions and operating ranges perform as intended.
PQ - Performance Qualification is commonly used to demonstrate acceptable performance under actual or representative operating conditions.
IQ/OQ/PQ terminology is widely used, particularly for equipment and process systems, but computerized-system validation may use different lifecycle deliverables and test structures. What matters is that the organization can demonstrate, with appropriate evidence, that the system is suitable for its intended use and remains controlled through change.
GxP Documentation Requirements
Documentation is central to GxP because records provide evidence that required activities were actually performed and that the state of control can be reconstructed when needed. GDocP principles help ensure these records remain reliable and usable throughout their required lifecycle.
Common controlled records may include:
Standard Operating Procedures
Approved instructions describing how regulated activities are performed. SOPs should be controlled, current, and available to personnel who need them.
Validation and Qualification Records
Requirements, protocols, test evidence, reports, deviations, approvals, and other records appropriate to the equipment, process, or computerized system being qualified or validated.
Calibration Records
Calibration history, results, standards or references used, status, dates, and other information needed to demonstrate that measurement equipment remains suitable for use.
Maintenance Records
Preventive and corrective maintenance records that document the work performed, equipment status, relevant findings, and supporting information.
Audit Trails
Where required or appropriate, secure computer-generated audit trails can provide traceability of changes to regulated electronic records, including who performed the action and when.
Training Records
Evidence that personnel have the qualifications and training required for the activities they perform.
Change Control Records
Documentation of significant changes, including the reason for the change, impact assessment, approvals, implementation activities, and any required testing or requalification.
Retention requirements vary by record type and applicable regulation. Consistent with GDocP principles, records should remain protected, readable, traceable, and retrievable for the period that applies to them.
21 CFR Part 11 and Electronic Records
21 CFR Part 11 establishes FDA requirements for certain electronic records and electronic signatures. Its scope is tied to records required by FDA predicate rules that are maintained electronically, as well as certain electronic records submitted to FDA and electronic signatures used in place of handwritten signatures.
Part 11 should therefore be evaluated based on the specific records and intended use of the system rather than treated as a blanket requirement for every electronic file used by an FDA-regulated company.
For systems that maintain Part 11 records, relevant controls may include:
- System validation appropriate to intended use
- Authorized access
- Authority and operational checks where applicable
- Secure, computer-generated, time-stamped audit trails where applicable
- Record protection and retrieval
- Controls for electronic signatures when electronic signatures are used
- Procedures, training, and accountability for system users
For EU GMP operations, EU GMP Annex 11 - Computerised Systems provides requirements and expectations for computerized systems used in GMP activities. Annex 11 is not simply a European copy of Part 11; it addresses the broader lifecycle and control of computerized systems used in GMP operations.
Common GxP Compliance Challenges
1. Uncontrolled spreadsheets
Spreadsheets are not automatically non-compliant, and they can be validated and controlled for specific intended uses. The practical problem is that ordinary spreadsheets often lack the controls expected for important regulated records unless those controls are deliberately added and maintained.
Typical challenges include:
- No inherent secure audit trail for record changes
- Weak or difficult-to-manage user access controls
- Formula and configuration changes that may not be obvious
- Multiple uncontrolled copies
- Manual reminders and due-date tracking
- Significant validation and change-control effort as complexity grows
For simple, low-risk uses, a controlled spreadsheet may be appropriate. For a growing calibration or maintenance program, the administrative burden of keeping spreadsheets controlled can become greater than using a purpose-built regulated system.
2. Using a system before validation is complete
When a GxP-relevant system is placed into regulated use before its intended use and controls have been adequately verified, the organization may have difficulty demonstrating that the resulting records are reliable. Validation should be planned as part of implementation rather than treated as an afterthought.
3. Poor record retrieval and data integrity
Records that technically exist but cannot be readily located, interpreted, or connected to their supporting information create problems during routine work and during inspections. GDocP principles emphasize maintaining enough context for records to remain complete, understandable, and traceable.
4. Weak change control
Validated systems and processes change. The important control is to assess the change, determine its impact, document approval, perform appropriate testing, and update affected documentation before or as the change is implemented.
5. Training and procedural gaps
Software controls alone do not make an operation compliant. Personnel must understand the procedures and responsibilities associated with the system, including record entry, review, access administration, corrections, and escalation of problems.
Electronic Systems in a GxP Environment
Electronic systems used for regulated activities should be evaluated according to their intended use, the records they manage, applicable regulatory requirements, and the risk associated with those records and processes.
System controls may include authentication, access restrictions, audit trails, record protection, backup and recovery, change control, and validation appropriate to intended use. GDocP principles remain relevant when regulated records are created, maintained, reviewed, corrected, retained, or retrieved electronically.
The regulated organization remains responsible for determining which controls are required and for operating the system within its quality system.
For a detailed discussion of software selection, system boundaries, validation responsibilities, and the evidence buyers should request, see What Software Supports GxP Compliance in Life Sciences?.
How to Prepare for a GxP Audit or Inspection
Whether preparing for an FDA inspection, an EU GMP inspection, a customer audit, or an internal quality review, the objective is the same: be able to demonstrate that the process is controlled and that the records supporting it are complete, understandable, and readily retrievable.
1. Review procedures and responsibilities
Confirm that relevant procedures are current, approved, and aligned with actual practice.
2. Verify qualification and validation status
Confirm that relevant equipment and systems have appropriate qualification or validation evidence and that significant changes have been assessed.
3. Review audit trails where appropriate
Confirm that required audit-trail review is being performed according to your procedures and that unusual or unexplained changes are investigated.
4. Check calibration and maintenance status
Identify overdue activities, unresolved failures, incomplete records, and equipment whose status is unclear.
5. Check training
Confirm that personnel performing regulated activities have appropriate and current training.
6. Test record retrieval
Select representative records and verify that personnel can quickly retrieve the complete record and its supporting information without reconstructing it from multiple uncontrolled sources. This is also a practical check that GDocP principles are being applied effectively.
Practical GxP Practices for 2026
Use controls appropriate to risk and intended use. Not every system requires the same validation effort, but important regulated records should not depend on uncontrolled tools or undocumented practices.
Apply GDocP consistently. Record activities when they occur, maintain traceability of changes, preserve context, and ensure records remain readable and retrievable.
Think about data throughout its lifecycle. Creation is only the beginning. Consider review, correction, audit trail, backup, retention, retrieval, export, migration, and eventual system retirement.
Keep systems in a validated state. Validation is not complete forever on the day a system goes live. Significant changes should be assessed and tested as appropriate.
Make inspection readiness part of routine operation. It is much easier to maintain complete, readily retrievable records as work occurs than to reconstruct them before an inspection.
Avoid unnecessary complexity. A system should provide the controls the organization needs without creating an administrative burden that makes the system itself difficult to maintain.
Frequently Asked Questions
What is GxP compliance in simple terms?
GxP compliance means performing regulated work under appropriate controls and maintaining records that are accurate, traceable, reliable, and available. The specific requirements depend on the type of regulated activity and the rules that apply to it.
What does GxP stand for?
GxP means "Good x Practice." The "x" identifies a specific practice area, such as GMP for Good Manufacturing Practice, GLP for Good Laboratory Practice, GCP for Good Clinical Practice, or GDP for Good Distribution Practice. Good Documentation Practices (GDocP) provide documentation principles that apply across these areas.
What are Good Documentation Practices (GDocP)?
Good Documentation Practices (GDocP) are cross-cutting principles used to ensure that regulated records accurately document what occurred and remain attributable, legible, contemporaneous, original or appropriately preserved, accurate, complete, consistent, enduring, and available.
Why are both GDP and GDocP used?
GDP commonly means Good Distribution Practice, but GDP is also sometimes used informally for Good Documentation Practices. To avoid ambiguity, this guide uses GDP for Good Distribution Practice and GDocP for Good Documentation Practices.
Are spreadsheets prohibited in GxP environments?
No. Spreadsheets are not inherently prohibited. The issue is whether a spreadsheet used for a regulated purpose has appropriate validation and controls for its intended use. As spreadsheets become more complex or are used as important systems of record, maintaining adequate access control, change history, version control, review, and validation can become difficult.
What is the difference between GMP and GxP?
GxP is the broader umbrella term for Good Practice frameworks. GMP is one specific GxP area focused on manufacturing and associated quality controls.
Does every computerized system require IQ/OQ/PQ?
No single validation format is appropriate for every computerized system. IQ, OQ, and PQ terminology is common and may be useful, but validation should be based on intended use, risk, complexity, and applicable requirements. The key is documented evidence that the system is suitable for its intended use.
What is 21 CFR Part 11 and how does it relate to GxP?
21 CFR Part 11 establishes FDA requirements for certain electronic records and electronic signatures. Its applicability depends on the underlying FDA record requirements and how the organization maintains and relies on those records electronically.
Conclusion
GxP compliance is an operating discipline rather than a single regulation, document, or validation activity. The applicable requirements vary across manufacturing, laboratory, clinical, distribution, and other regulated activities, but the underlying principles are consistent: work should be controlled, responsibilities should be defined, records should be reliable, and organizations should be able to demonstrate what occurred.
Good Documentation Practices (GDocP) support these principles across GxP activities by helping ensure that records remain complete, traceable, understandable, and available.
Effective GxP programs apply controls in proportion to intended use and risk, maintain equipment and systems in an appropriate state of control, preserve trustworthy records, and make inspection readiness part of routine operation rather than a last-minute exercise.
Regulatory references:
