21 CFR 58Good Laboratory Practice for Nonclinical Laboratory Studies

21 CFR Part 58 is the FDA's Good Laboratory Practice (GLP) regulation. It governs the conduct of nonclinical laboratory studies — animal toxicology, in-vitro biocompatibility, environmental fate and effects, residue analysis — whose results are submitted to FDA in support of regulatory applications: INDs, NDAs, BLAs, 510(k)s, PMAs, food and color additive petitions, animal-drug applications, and others. Studies that fail to meet GLP can result in FDA refusing to accept the submission or requiring the study to be repeated.

GLP applies to nonclinical safety studies only. It does not apply to clinical trials (governed by 21 CFR Parts 50, 56, 312 and 812 — the GCP framework) and it does not apply to routine quality-control testing of commercial product (governed by 21 CFR 211 Subpart I — the cGMP lab-controls rule). Confusing GLP with GCP or cGMP is one of the most common compliance themes in inspection observations.

Subpart H was reserved (used to cover physical and chemical characterisation studies; the requirements were folded into Subpart F). The 2016 proposed rule would have reorganised some subparts but as of 2025 the 1978-vintage structure remains operative.

Every GLP study has one Study Director (SD), designated before study start, named on the protocol, and personally responsible for the overall conduct and reporting. The SD signs the protocol, signs the final report, and is the person FDA holds accountable when something goes wrong. SD assignments cannot be informal — the SD's name, signature and the date of designation must be in the study file from day one.

The SD's responsibilities (§58.33(a)–(f)) include: assuring the protocol is followed, that all data are accurately recorded and verified, that unforeseen circumstances are documented, that test systems are as specified, and that all raw data, documentation, protocols, specimens and final reports are transferred to the archive at study completion. Sites that informally rotate the SD role or assign it nominally to a senior person without involvement routinely receive 483s.

Every GLP testing facility must have a Quality Assurance Unit (QAU) that is entirely separate from and independent of the personnel engaged in the direction and conduct of the study. The QAU's job is to monitor each study to assure management that the facilities, equipment, personnel, methods, practices, records and controls are in conformance with GLP. The QAU is the GLP analogue of the cGMP Quality Unit, but with a narrower, study-monitoring focus.

Specific QAU duties (§58.35(b)): maintain a master schedule of all studies, maintain copies of all protocols, inspect each study at intervals adequate to assure integrity, periodically submit written status reports to management and the SD, determine that no deviations from protocol or SOP occurred without authorisation, review the final report for accuracy of description, and prepare and sign a QA statement specifying the dates inspections were performed and findings reported.

§58.120 requires every study to have a written protocol approved by the sponsor and the study director before study initiation. The protocol must contain a defined set of elements including title and purpose, identification of the test and control articles, name of the sponsor and testing facility, proposed start and end dates, justification for the test system, route and dosage of administration, type and frequency of tests and analyses, records to be maintained, and the proposed statistical methods.

Changes to the protocol must be documented as protocol amendments signed by the SD and dated. Unexpected events during study conduct that affect study integrity must be recorded as protocol deviations with the reason, the corrective action and the SD's signature. The audit trail of amendments and deviations is what an FDA inspector reads first when reconstructing a study's integrity.

§58.130(e) requires that all data generated during a study, except those that are generated by automated data-collection systems, be recorded directly, promptly, and legibly in ink. Each entry must be dated and signed or initialled by the person entering the data. Changes must not obscure the original entry, must indicate the reason for the change, and must be dated and signed. For automated systems, the person responsible for direct data input is identified at the time of input.

This is the original 'ALCOA' rule, predating the acronym by decades. The 2018 FDA Data Integrity Q&A guidance for cGMP reads almost identically — GLP got there first. The most common GLP raw-data 483 is the same as cGMP's: end-of-shift transcription from working sheets to formal records, with no contemporaneous original on file.

All raw data, documentation, protocols, final reports and specimens (except wet specimens of blood, urine, faeces and biological fluids) generated as a result of a nonclinical laboratory study shall be retained in an archive. The archive must be designated and accessible only to authorised personnel. Retention periods (§58.195) depend on the submission supported: at least two years following the date on which an application for a research or marketing permit is approved; at least five years following the date on which the results are submitted in support of an application that is not approved; and in other cases, at least two years following the date on which the study is completed, terminated or discontinued.

Specimens and raw data must be retained for the same period. Wet specimens are exempt because of practical storage limits, but slides, blocks and electronic data files are not. The archive is the first thing an FDA Bioresearch Monitoring (BIMO) inspector asks to see during a GLP inspection.

1. §58.33 — Study director not personally involved in study conduct; SD signature on the final report without evidence of oversight during the study.
2. §58.35 — QAU inspections not performed at adequate intervals; QA statements signed without supporting inspection records.
3. §58.120 — Protocol deviations not documented; unauthorised changes to study parameters.
4. §58.130 — Raw data transcribed from working sheets to formal records at end of shift, with no contemporaneous originals on file.
5. §58.81 — SOPs absent for procedures performed routinely; SOPs not followed; SOPs revised without documented review.
6. §58.105 — Test-article characterisation incomplete; identity, strength, purity and stability not established before study start.
7. §58.63 — Equipment calibration certificates not on file or not current.
8. §58.190 — Archive not secure; access not restricted; specimens or records not retrievable.

• Study setup binds the protocol to a named Study Director and to the QAU reviewer; signatures and dates are required before the study can start.
• Raw data capture at instruments is contemporaneous and attributable; manual entries require dated signatures; changes preserve the original with reason-for-change captured.
• SOP library is version-controlled with training-acknowledgement enforcement; a study step cannot be executed by personnel whose training on the relevant SOP is overdue.
• Equipment records track calibration and maintenance with hard-block on use of out-of-cal instruments.
• QAU inspection schedule is built from the master study schedule; missed inspections surface to facility management.
• Archive enforces access control and the §58.195 retention clocks per study, with retrievability tested by periodic spot-check.