GxP

GxP is the umbrella term for the family of "Good x Practice" regulatory disciplines that govern the safe, ethical and traceable conduct of life-sciences activity. The "x" is a variable: G L P for laboratory, G C P for clinical, G M P for manufacturing, G D P for distribution, G V P for pharmacovigilance, G A M P for automated manufacturing computerised systems, G A C P for agricultural collection practice (botanicals), G E P for engineering, G T P for tissue practice. Each Practice is enforced by its own regulations, inspected by its own programmes, and documented in its own standards.

The GxP umbrella exists because regulators discovered in the 1970s and 1980s that data fraud and quality failure could happen at any stage of the drug lifecycle — not just manufacturing. A clinical trial with falsified data led to bad drug approvals; a research lab with fabricated toxicology results led to unsafe candidates entering trials; a distribution chain with broken cold-chain led to subpotent product reaching patients. Each gap got its own Practice.

Beyond the original lifecycle Practices, the GxP family has expanded with each new technology and supply-chain risk. GxP today is whatever the regulator inspects against — and as the technology stack evolves (cell therapy, AI-driven manufacturing, decentralised trials), new Practices appear.

GLP governs non-clinical safety studies on candidate substances — toxicology, pharmacology, environmental fate, ecotox. It is NOT a quality-control lab rule (despite the name). 21 CFR Part 58 (effective 1979, revised most recently in 2024) requires GLP for studies submitted to FDA in support of marketing applications.

Core elements: a designated Study Director responsible for the overall conduct of each study; a Quality Assurance Unit independent of study execution; written protocols; controlled SOPs; archived raw data; OECD GLP Principles for international acceptance (the OECD MAD — Mutual Acceptance of Data — agreement means a GLP-compliant study performed in one OECD jurisdiction is accepted by all others).

Common confusion: "is my QC lab GLP?" Almost always no. QC labs at a pharma plant follow 21 CFR 211 (cGMP), not GLP. GLP is for the studies that supported the original NDA / BLA — typically conducted by contract research organisations under separate FDA inspection programmes.

GCP governs clinical trials in humans — Phase I through IV. The defining standard is ICH E6, currently at R3 (2024). FDA regulations 21 CFR Parts 11, 50, 54, 56, 312, 314 and 812 implement GCP for trials supporting US marketing applications. The EU implements GCP through the Clinical Trial Regulation (CTR) 536/2014, in force since 2022.

ICH E6(R3) shifted the focus toward critical-to-quality factors and risk-based monitoring rather than 100% source-data verification. Decentralised trials (DCTs) — telehealth visits, direct-to-patient drug shipping, e-consent — have driven much of the recent change, accelerated by the COVID-19 pandemic.

Core actors: the Sponsor (responsible for trial design and oversight), the Investigator (responsible for trial conduct at the site), the IRB / IEC (Institutional Review Board / Independent Ethics Committee — protects participants), the CRO (Contract Research Organisation — delegated sponsor functions). Every clinical-trial document is subject to GCP record-keeping: protocol, informed consent, monitoring reports, source documents, case report forms, safety reports.

GMP is the most operationally familiar GxP because it covers the activity most companies do day-to-day: making product. The US framework: 21 CFR 210 (general definitions), 211 (finished pharmaceuticals), 820 (medical devices), 111 (dietary supplements), 117 (food preventive controls), 212 (positron emission tomography drugs), 1271 (HCT/Ps). The EU framework: EudraLex Volume 4 — Parts I (medicinal products), II (active substances), III (GMP-related documents) and a long list of Annexes (Annex 1 sterile, Annex 11 computerised, Annex 13 IMPs, Annex 16 QP release, etc.).

GMP requires written procedures (SOPs), trained personnel, validated processes, qualified equipment, controlled documents, immutable batch records, formal deviation and change-control, CAPA, internal audit, and an independent Quality Unit. The cGMP — current Good Manufacturing Practice — language means the standards evolve: what was acceptable in 2005 may be below expectation today. FDA's Quality Management Maturity (QMM) initiative is the modern expression of that evolution.

GMP is the GxP that V5 Ultimate is built around. See our deep guides to 21 CFR 211, 21 CFR 820, 21 CFR 117, 21 CFR 111, 21 CFR 212 and EU GMP for the sector-specific detail.

GDP picks up where GMP stops — the moment the product leaves the manufacturer's release. Cold-chain integrity, controlled storage, secure transport, qualified wholesalers, traceability through the supply chain, returns and recall handling, prevention of falsified medicines.

The EU GDP Guideline (2013/C 343/01) is the operational standard. The US analogue is fragmented: 21 CFR Part 205 covers wholesale distribution, the Drug Supply Chain Security Act (DSCSA, 2013) layers serialisation and chain-of-custody traceability for prescription drugs, state-level licensing fills the rest. For temperature-sensitive biologics, USP <1079> (Good Storage and Distribution Practices for Drug Products) is the operational reference.

DSCSA's unit-level traceability requirement reached full force in November 2023 (extended enforcement through November 2024). Every transaction in the prescription supply chain must now be captured electronically. See our DSCSA pillar for the EPCIS / VRS detail.

GVP governs post-marketing safety monitoring — the obligation to track adverse drug reactions (ADRs) after a product is on the market, detect safety signals, and update the product label / Risk Evaluation and Mitigation Strategy (REMS) accordingly. The US framework: 21 CFR Part 314.80 (post-marketing reporting), FAERS (FDA Adverse Event Reporting System), REMS programmes. The EU framework: GVP Modules I through XVI, EudraVigilance database.

Key elements: spontaneous ADR reporting from clinicians and patients; periodic safety update reports (PSURs); risk management plans (RMPs); signal detection methodology; pharmacovigilance system master file (PSMF). EU GVP is more prescriptive than the US framework: each marketing authorisation holder must appoint a Qualified Person for Pharmacovigilance (QPPV), maintain a PSMF, and submit PSURs on a defined schedule.

For medical devices, the parallel discipline is Medical Device Reporting (21 CFR Part 803 in the US, EU MDR Articles 87–90 in the EU). Cosmetics under MoCRA now have analogous adverse event reporting.

GAMP is not codified in regulation directly — it is the de-facto industry standard for validating computerised systems used in GxP environments. GAMP 5 (2nd Edition, 2022, published by ISPE) is the current reference. It defines a risk-based, category-driven approach (5 software categories from off-the-shelf infrastructure to bespoke custom code) with proportional validation effort.

GAMP 5 is the operational answer to "how do I satisfy 21 CFR Part 11 and EU GMP Annex 11 for my MES / QMS / LIMS / eBMR system?" Every regulator inspects against Part 11 / Annex 11; GAMP 5 is how the industry interprets and operationalises those rules. FDA's 2022 Computer Software Assurance (CSA) draft guidance shifts further toward GAMP-style risk-based validation effort.

See our GAMP 5 pillar for the full category breakdown and lifecycle.

• Documented procedures — every activity has a controlled written instruction (SOP).
• Qualified personnel — training records, competence assessment, role-appropriate qualification.
• Approved suppliers — quality agreements, supplier audits, incoming material qualification.
• Change control — formal evaluation of every change to procedure, process, material, equipment, system.
• Deviation handling — capture, investigate, root-cause, disposition, CAPA when warranted.
• Audit and self-inspection — internal verification that the system is followed and effective.
• Records retention — proven retention for the regulatory window (typically 5–25 years depending on the Practice and the regulator).
• Data integrity — ALCOA+ (Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available).
• Computerised systems validation — Part 11 / Annex 11 across every GxP that uses electronic records.
• Risk management — ICH Q9 for pharma, ISO 14971 for devices, formal risk-based thinking throughout.

GxP boundaries are not always crisp. A few common overlaps:

• Investigational Medicinal Products (IMPs) sit at the GMP/GCP boundary — manufactured under GMP (EU GMP Annex 13), administered under GCP.
• Cold-chain handling spans GMP (release temperature confirmed at dispatch) and GDP (cold-chain maintained in transit).
• Pharmacovigilance signal detection often pulls batch genealogy (GMP) to investigate whether an ADR cluster maps to a manufacturing root cause.
• Computerised systems validation (GAMP) is required by every other GxP — there is no Practice that doesn't run on software now.
• Clinical trial supply (GMP / GCP intersection) — drug for trial must be GMP-manufactured but is administered under GCP protocol.
• Post-approval changes can trigger requirements across multiple Practices: a manufacturing change (GMP) may require an FDA submission (regulatory affairs), a label update (GVP), a clinical bridging study (GCP), and a distributor re-qualification (GDP).

V5 Ultimate is built for the GxP disciplines that touch manufacturing and distribution — GMP (the core), GDP (the downstream supply chain), GAMP (the validation discipline V5 itself satisfies), and the parts of GVP that link adverse events back to specific batches. GLP and GCP are out of scope; those Practices belong to non-clinical research labs and clinical trial sponsors / CROs, not to manufacturing platforms.

Within scope, V5 ships the GxP cross-cutting layer — document control, training, change control, deviation, CAPA, internal audit, ALCOA+, Part 11 / Annex 11 — once, applied uniformly across MES, QMS, eBMR / eDHR, LIMS, dispense, in-process control, release and distribution. GDP-relevant features (cold-chain monitoring at dispatch, lot-level distribution genealogy, DSCSA / FMD serialisation integration, recall execution) live on the same record as the manufacturing data they reference. Adverse-event-driven batch traceability (an ADR comes in, V5 surfaces the batch, the production conditions, the deviations, the distribution chain) is one query, not a week of investigation.