Good Laboratory Practices Under 21 CFR Part 58: What Testing Facilities and Sponsors Must Know

A pharmaceutical sponsor submits a new drug application. The FDA reviews the nonclinical safety package and discovers that the toxicology studies were conducted at a contract laboratory that failed to maintain adequate raw data, did not have a functioning Quality Assurance Unit, and could not demonstrate that its study director had reviewed and signed the final reports.

The data are declared unreliable. The application cannot proceed until the studies are repeated at a compliant facility. The sponsor loses two years and significant investment.

This outcome is not hypothetical. FDA warning letters to Jiangsu Kerbio in July 2025, CCIC Huatongwei in June 2025, and Vedic Lifesciences in March 2026 all describe versions of the same failure: GLP nonclinical studies that cannot be trusted because the laboratories that produced them did not meet the requirements of 21 CFR Part 58.

Understanding what GLP requires, who it applies to, and what inspectors look for is not optional for anyone involved in developing products regulated by the FDA.

21 CFR Part 58 establishes Good Laboratory Practice regulations for nonclinical laboratory studies conducted to support applications for research or marketing permits for FDA-regulated products. These products include drugs, biologics, medical devices, food additives, color additives, and electronic products.

GLP applies whenever a nonclinical laboratory study is intended to be submitted to or reviewed by the FDA as part of a regulatory application. The obligation applies to the testing facility conducting the study, not just the sponsor. When a sponsor uses a contract research organisation, consulting laboratory, or grantee to conduct any part of a GLP study, the sponsor must notify that organisation that the work is part of a GLP study and must ensure compliance.

GLP is not a documentation preference. It is a federal regulation with enforcement consequences ranging from Form 483 observations to warning letters to disqualification of the testing facility, which bars the facility from conducting studies accepted by the FDA.

GLP applies to the testing facility, not just the sponsor. Contract laboratories conducting nonclinical studies for FDA submissions are subject to FDA inspection and enforcement under 21 CFR Part 58 regardless of where the sponsor is located or the contractual arrangements between the parties.

Every testing facility must have sufficient personnel with the education, training, and experience to perform their assigned functions. All personnel involved in conducting a study must understand the portions of the GLP regulations applicable to their work.

The Study Director is the most important personnel requirement. Under 21 CFR Part 58.33, a single study director must be designated for each study before the study begins. The study director is responsible for the overall conduct of the study and is the single point of study control. The study director must be present during the conduct of the study or have documented arrangements for management of the study in their absence.

No study may proceed without a designated study director. A study conducted without a named study director, or where the study director changed without documentation of the transition, is a GLP violation.

Inspectors frequently review whether the study director named in the final report was the individual who actually directed the study throughout its conduct. Discrepancies between the named study director and the individuals who made day-to-day study decisions are a common finding, particularly in studies conducted over extended periods.

Every testing facility must have a Quality Assurance Unit (QAU) that is entirely separate from and independent of the personnel engaged in the direction and conduct of the study. The QAU cannot be the same people who run the study.

The QAU’s responsibilities include maintaining copies of all approved protocols and amendments, inspecting each study at intervals adequate to ensure GLP compliance, reviewing the final study report to confirm it accurately describes the methods and procedures, preparing written inspection records, and reporting findings directly to management and the study director.

The QAU is the internal audit function for GLP. A testing facility without a functioning QAU, or where the QAU is staffed by study personnel, does not meet the organisational requirements of 21 CFR Part 58.

The QAU must inspect studies during their conduct, not only at the end. A QAU that reviews records only when the final report is being prepared has not met the inspection requirements of 21 CFR Part 58.35. Inspectors ask for QAU inspection records that show the dates of inspections during study conduct and the findings and corrective actions documented at each inspection.

Every GLP study must have a written protocol approved by the study director and, where applicable, the sponsor before the study begins. The protocol must describe the objectives, methods, procedures, and statistical methods to be used. Any changes to the protocol must be documented as amendments, approved by the study director, and maintained with the original protocol.

Raw data is the central evidentiary requirement of GLP. Under 21 CFR Part 58.3, raw data means any laboratory worksheets, records, memoranda, notes, or exact copies that are the result of original observations and activities in a study. All raw data must be retained.

Raw data must be recorded directly and promptly at the time of observation. Data cannot be recorded on scratch paper and transcribed later. Corrections to raw data must be made by a single line through the incorrect entry, with the correct data entered alongside, signed, dated, and accompanied by the reason for the change. No original entry may be obscured.

GLP data integrity requirements align with ALCOA+ principles. Attributable, Legible, Contemporaneous, Original, and Accurate. FDA warning letters to Chinese and Indian GLP laboratories in 2025 and 2026 consistently identified failures in these areas: animal weights recorded inaccurately, data entries that could not be traced to the individuals who made them, and final reports that did not match the underlying raw data. These failures resulted in the studies being declared unreliable for regulatory purposes.

Upon completion of a GLP study, the study director must prepare and sign a final report. The final report must describe the study completely and accurately, including all methods, procedures, and results. Any significant unexpected results must be included. The study director’s signature represents their professional certification of the accuracy and completeness of the report.

GLP records must be archived. The archive must be maintained in a secure location, with controlled access, indexed for retrieval, and protected from physical damage. Records subject to archiving include raw data, protocols and amendments, QAU inspection records, specimens, final reports, and all other documents generated in the conduct of the study.

Retention periods depend on how the study is used. For studies supporting a marketing permit, records must generally be retained for the required period specified in the applicable regulation or, if no period is specified, until the FDA has taken final action on the application. The facility must notify the FDA before destroying any records covered by GLP.

Having records does not satisfy the archive requirement if those records cannot be promptly retrieved during an inspection. A GLP archive must be indexed and organised so that any record can be located without relying on institutional memory. Inspectors test archive integrity by requesting specific records and evaluating how quickly and completely they are produced. An archive that functions as a storage room rather than a controlled retrieval system is a GLP finding regardless of whether the documents physically exist.

The 2025 and 2026 enforcement cluster targeting Chinese and Indian contract research organisations signals intensified FDA scrutiny of foreign GLP facilities. Sponsors relying on overseas contract laboratories for GLP studies should verify facility compliance status, review audit reports, and confirm that quality agreements specifically address GLP obligations before submitting data from those facilities to the FDA.

GLP was established in 1978 for paper-based laboratory environments. Modern GLP studies increasingly generate electronic data, use computerised laboratory information management systems, store data in cloud environments, and employ automated instruments that produce digital raw data files.

Electronic records used in GLP studies must comply with 21 CFR Part 11 requirements for electronic records and signatures. Instrument software must be validated. Electronic raw data files must be protected against alteration. Audit trails must record who accessed data, when, and what changes were made. Access controls must prevent unauthorised modification.

The OECD, which coordinates international GLP mutual acceptance of data, has published specific guidance on electronic data integrity (Advisory Document No. 22, 2021), cloud computing in GLP environments (No. 17 Supplement 1, 2023), and IT security for GLP facilities (Position Paper No. 25, December 2024). These documents represent the current international standard for electronic GLP compliance and are increasingly referenced during FDA and international GLP inspections.

The testing facility must designate a study director before initiating any GLP study. The QAU must be independent of study personnel and must inspect each study during conduct. All raw data must be recorded in real time and retained in a controlled archive. The facility must permit FDA inspection at reasonable times. Final reports must be signed by the study director and accurately represent the conduct and results of the study.

Sponsors must notify any contract laboratory that the work is part of a GLP study. Sponsors bear regulatory responsibility for ensuring that contracted studies are conducted in compliance with Part 58. A sponsor cannot use a non-compliant laboratory and rely on the contract to shift legal responsibility. Before engaging a contract laboratory for GLP studies, sponsors should conduct audits, review qualification records, and execute quality agreements that specifically address GLP obligations including study director designation, QAU structure, raw data management, and archiving.

Test your understanding of GLP requirements under 21 CFR Part 58.

GLP compliance is not a one-time certification. It is an ongoing operational commitment that must be verified continuously.

Testing facilities should conduct annual self-inspections that trace complete studies from raw data to final report, test archive retrievability without institutional memory, verify QAU independence and inspection records, and confirm that all electronic systems have current validation documentation.

Sponsors should audit contract laboratories before submitting studies from those facilities to the FDA. An audit that confirms a facility has a QAU, a designated study director, and an organised archive provides more regulatory protection than a quality agreement alone.

The cluster of FDA enforcement actions against foreign GLP laboratories in 2025 and 2026 demonstrates that geographic distance from the FDA’s headquarters does not reduce the expectation of full GLP compliance. Any laboratory whose data supports an FDA submission is subject to the same regulatory standard.