What is GxP compliance?
GxP compliance is the umbrella term for the quality guidelines and regulations that govern how medicinal products are researched, manufactured, tested, stored, distributed, and monitored. The "G" stands for Good, the "P" for Practice, and the "x" is a placeholder for the discipline in scope - Manufacturing, Clinical, Laboratory, Distribution, Pharmacovigilance, and more.
The goal of every GxP framework is the same: ensure that products are safe, that they do what they claim to do, and that the data generated along the way is trustworthy enough for regulators, patients, and clinicians to rely on. In practice, GxP is how pharmaceutical, biotech, and medical-device organisations translate that goal into SOPs, validated systems, and inspection-ready records.
The expectation is codified across jurisdictions: the US FDA enforces current Good Manufacturing Practice through 21 CFR Parts 210 & 211 and electronic recordkeeping under 21 CFR Part 11; the European Commission publishes EudraLex Volume 4 (EU GMP), including Annex 11 for computerised systems and Annex 15 for qualification and validation; the International Council for Harmonisation issues ICH Q7 (API GMP), Q9(R1) (Quality Risk Management), Q10 (Pharmaceutical Quality System), and E6(R3) (Good Clinical Practice); and the WHO's TRS 986, Annex 2 sets the baseline GMP guide adopted by most national regulators. Inspectorates in 50+ countries align on PIC/S PE 009, and medical-device manufacturers layer ISO 13485:2016 and ISO 14971:2019 on top. Data integrity expectations are set out in MHRA "GXP" Data Integrity Guidance (2018), FDA Data Integrity and Compliance With Drug CGMP (2018), and WHO TRS 1033, Annex 4.
The core GxP disciplines
Each discipline addresses a different stage of the product lifecycle. Most regulated organisations operate under several of them at once.
Governs the manufacture of medicinal products and APIs. Anchored by FDA 21 CFR 210/211, EU GMP Parts I–IV, and ICH.
Standards for designing, conducting, and reporting clinical trials involving human subjects. Defined by ICH E6(R3).
Applies to non-clinical safety studies. Codified in FDA 21 CFR Part 58 and OECD Principles of GLP.
Ensures medicinal products are stored, transported, and handled under conditions that preserve their quality (EU 2013/C 343/01).
EMA guidelines covering the collection, detection, assessment and prevention of adverse effects for marketed products.
Applies to the sourcing of herbal starting materials feeding into GMP manufacturing.
The regulations behind GxP
GxP itself is not a single law. It is enforced through a web of regional regulations and internationally harmonised guidelines. The ones you will encounter most often:
US current Good Manufacturing Practice for finished pharmaceuticals.
US requirements for electronic records and electronic signatures to be considered trustworthy and equivalent to paper.
European GMP guide including Annex 1 (sterile products), Annex 11 (computerised systems), and Annex 15 (qualification & validation).
Harmonised guidelines on API GMP, Quality Risk Management, and Pharmaceutical Quality Systems.
The modernised Good Clinical Practice standard for interventional trials.
GMP guide used by inspectorates across 50+ participating authorities worldwide.
Quality management and risk management standards for medical devices.
ISPE framework for a risk-based approach to computerised system validation and data integrity (ALCOA+).
21 CFR Part 11 vs. EU GMP Annex 11
The two clauses most often quoted in the same breath as "GxP compliance" both govern computerised systems, but from different angles.
- 21 CFR Part 11 — the US FDA rule that makes electronic records and electronic signatures legally equivalent to paper. It is prescriptive about audit trails, system access, record retention, and signature manifestation.
- EU GMP Annex 11 — the European counterpart, broader in scope. It treats a computerised system as part of a GMP process and expects risk-based validation, supplier assessment, data integrity controls, and business-continuity planning.
Global manufacturers typically design one control set that satisfies both, layered on top of GAMP 5's risk-based validation methodology.
The five pillars of a GxP quality system
Behind every GxP audit sits the same underlying structure. Getting these right is what "being GxP-compliant" actually looks like day-to-day.
- People — trained, qualified, and accountable roles across quality, production, and QC.
- Processes — documented SOPs, deviation and CAPA handling, change control, and validation.
- Facilities & equipment — qualified, maintained, and monitored to preserve product quality.
- Records — contemporaneous, attributable, legible, and preserved per ALCOA+ principles.
- Suppliers — qualified and audited across the extended manufacturing and distribution chain.
Data integrity and ALCOA+
Inspectors have shifted focus over the last decade from paper batch records to the electronic systems that generate them. Data is expected to be Attributable, Legible, Contemporaneous, Original, and Accurate — plus Complete, Consistent, Enduring, and Available (the "+" extensions). Both FDA and MHRA guidance on data integrity codify this expectation, and it is the single most common source of Form 483 observations and EU inspection findings.
How organisations stay GxP-compliant
- Maintain a Pharmaceutical Quality System aligned with ICH Q10.
- Run periodic self-inspections and management reviews.
- Qualify suppliers and audit critical contract manufacturers and CROs.
- Validate computerised systems using a GAMP 5 category-based approach.
- Manage deviations, complaints, and CAPAs with documented root-cause analysis.
- Train and re-qualify personnel against role-based curricula.
Frequently asked questions
What does GxP stand for?
"Good x Practice", where x is a placeholder for the regulated discipline — Manufacturing (GMP), Clinical (GCP), Laboratory (GLP), Distribution (GDP), or Pharmacovigilance (GVP), among others.
Who has to comply with GxP?
Any organisation that develops, manufactures, tests, distributes, or monitors human or veterinary medicines and medical devices — plus the software vendors, CROs, and logistics providers that support them.
Is GxP the same as ISO 9001?
No. ISO 9001 is a generic quality management standard. GxP frameworks are product-safety regulations enforced by health authorities such as the FDA, EMA, MHRA, and PMDA, and non-compliance can trigger warning letters, import alerts, or product recalls.
Get cited answers on any GxP topic
GxPAnswers turns any natural-language question about GxP into an answer with the specific clause, chapter, or guideline it draws from — across FDA, EU GMP, ICH, GAMP 5, ISO, and PIC/S.