Good Laboratory Practice isn't a quality aspiration. It's a legal requirement. 21 CFR Part 58 specifies exactly what "good" means in this context, and FDA has the authority to reject any nonclinical safety study that doesn't comply. Your $800,000 28-day repeat-dose tox study, conducted at a top-tier CRO, with clean data and no adverse findings? If the GLP documentation isn't right, FDA treats it as if the study doesn't exist.
I'm a preclinical biologist by training. I spent years inside labs where GLP was something QA worried about and everyone else treated as overhead — expensive overhead, honestly, the kind you resent until you need it. Then I watched a colleague's IND get a clinical hold because a pivotal repeat-dose toxicity study had undocumented protocol deviations. The data was fine. The science was solid. The paperwork wasn't. I remember thinking: this is the dumbest reason to lose four months. And then I realized that was exactly the wrong way to frame it. The paperwork is the point. GLP isn't a tax on science. It's the mechanism that makes your science admissible as evidence. Without it, you've produced an expensive internal memo.
What GLP actually requires
Part 58 is organized into subparts. I'm going to walk through each one with the specific things that trip people up. Not the generic "follow good practices" advice you get from consulting firms. The actual requirements, with the specific sections cited, and the things FDA inspectors look for.
Subpart A: General provisions (§58.1-58.3)
Scope: GLP applies to nonclinical laboratory studies that support research or marketing permits for FDA-regulated products. For IND-enabling studies, this means your pivotal toxicology studies, your safety pharmacology core battery, and your genotoxicity battery.
What's NOT required to be GLP: exploratory pharmacology, PK screening studies, dose range-finding studies. These can be — and often should be — conducted under scientific best practices without the full GLP apparatus. But the moment a study is designated as pivotal for regulatory submission, GLP applies.
The compliance statement: Every study report must include a statement from the study director indicating whether the study was conducted in compliance with GLP (§58.3). If there were deviations, they must be described. This statement is one of the first things FDA reviewers check.
Subpart B: Organization and personnel (§58.29-58.35)
Testing facility management must designate a study director for each study, replace the study director promptly if needed, and ensure that personnel have the education, training, and experience to perform their assigned functions.
The study director is the single point of study control (§58.33). One study, one study director. The study director approves the protocol, ensures amendments are documented, ensures raw data are recorded properly, and signs the final report. If you're a biotech sponsor outsourcing to a CRO, the study director is at the CRO — not at your company.
Checklist items:
- Study director designated before study initiation
- Study director's CV on file documenting relevant qualifications
- Training records for all personnel involved in the study
- Organizational chart showing reporting relationships
- SOPs for all routine procedures (archiving, equipment maintenance, animal husbandry, etc.)
Subpart C: Facilities (§58.41-58.51)
FDA wants to know that the physical lab environment doesn't compromise the data. Separate areas for animal housing, test article handling, laboratory operations, and data storage.
The facility requirements are mostly the CRO's responsibility, but if you're doing any work in-house — formulation, analytical testing, bioanalysis — your facilities need to comply too.
Checklist items:
- Adequate separation of animal species
- Separate areas for test article receipt, storage, and mixing
- Environmental controls (temperature, humidity) documented
- Pest control program in place and documented
- Archive storage with controlled access
Subpart D: Equipment (§58.61-58.63)
Every piece of equipment used in a GLP study must be adequately inspected, cleaned, maintained, tested, and calibrated. Calibration records must be maintained. Written SOPs for equipment operation and maintenance are required.
The calibration gap is the single most common equipment-related finding in FDA inspections. A balance that hasn't been calibrated within the required interval. A spectrophotometer with an expired calibration certificate. Trivial-sounding, right? I used to think so. But here's what actually happens: if the inspector finds that the analytical balance used to weigh dose formulations was overdue for calibration during your study, every measurement from that balance becomes suspect. Not just the ones from the overdue period — the inspector's confidence in your entire quality system takes a hit. It's a trust problem dressed up as a calibration problem.
Checklist items:
- Equipment identification and location log
- Calibration schedule with defined intervals
- Calibration records — certificates or internal records showing results
- Maintenance logs
- SOPs for operation of each critical instrument
- Documentation of equipment malfunctions and corrective actions
Subpart E: Testing facilities operation (§58.81-58.90)
SOPs (§58.81): Written standard operating procedures for every aspect of the study that could affect quality and integrity. This includes animal receipt and quarantine, randomization, dose preparation, dose administration, sample collection, necropsy, histopathology, clinical pathology, and data recording.
The SOP question that catches sponsors: are the SOPs current? An SOP written five years ago for a procedure that's changed since then is a deviation. SOPs must be reviewed and updated. The original must be retained (you can't destroy old versions).
Reagents and solutions (§58.83): Labeled with identity, titer or concentration, storage requirements, and expiration date. Expired reagents used in a GLP study = GLP deviation.
Test and control articles (§58.105-58.113): This is where I've seen the most problems for small biotech sponsors. The test article (your drug) must be characterized for identity, strength, purity, and composition. You need a certificate of analysis. Stability data covering the study duration. If you're using a different batch for tox studies than what you'll use clinically, you need comparability data.
Checklist items:
- SOPs current, reviewed, and authorized
- Test article characterization (identity, purity, stability)
- Certificate of analysis for each batch used
- Test article storage conditions documented
- Reserve samples retained
- Dose formulation analysis (concentration, homogeneity, stability)
- Control article (vehicle) characterized similarly
Subpart F: Test and control articles
Expanding on test article management because this is a frequent audit finding:
§58.105 — Test article characterization: Before the study starts, the sponsor must provide characterization data. For a small molecule, this typically means identity (structure confirmation), purity (HPLC or equivalent), and potency. For a biologic, add specifications for aggregation, charge variants, and glycosylation pattern.
§58.107 — Handling: Procedures to prevent contamination, deterioration, or loss of identity. Sounds basic. Then you read an FDA warning letter where two test articles were stored in the same freezer without adequate separation, and cross-contamination wasn't ruled out.
§58.113 — Mixtures of articles with carriers: If you're dosing animals with test article mixed in a vehicle (standard practice), you need stability and homogeneity data for the formulation at the concentrations used. This gets missed more than anything else in Subpart F, and it makes me genuinely frustrated because it's so preventable. The sponsor provides stability data for the neat compound. The CRO formulates it in methylcellulose. Nobody — and I mean nobody, not the sponsor, not the CRO, not the study director — checks whether the compound is stable in methylcellulose at the actual study concentrations. Then an inspector asks, and everybody looks at each other. I've seen this exact scenario play out at least three times. It's... well, it's a whole separate conversation about how sponsor-CRO communication actually works versus how people assume it works.
Subpart G: Protocol and conduct (§58.120-58.130)
The protocol must be written before the study starts and must include: title, objectives, test article identification, test system description (species, strain, age, weight), study design (number of animals, dose levels, route, frequency, duration), methods, and planned statistical analysis.
Protocol amendments (§58.120): Any change to the protocol after initiation must be documented as an amendment, must include the reason for the change, must be signed by the study director, and must be maintained with the protocol. Undocumented protocol changes are one of the most serious GLP violations.
I want to stress this because I've lived it: a study director decides mid-study to add a dose group or change a sacrifice timepoint. Scientifically? Makes perfect sense. But if there's no formal protocol amendment with a rationale, it's a GLP deviation. Full stop. The inspector won't ask "was this scientifically justified?" They'll ask "was this documented?" And if the answer is no — actually, let me back up. The real problem isn't the individual deviation. It's the inference. An undocumented change leads the inspector to wonder what else changed without documentation. The second question is always worse than the first.
Checklist items:
- Protocol finalized and signed before study initiation
- All protocol amendments documented with rationale
- Protocol amendments signed by study director
- Protocol amendments indexed chronologically
- Study conduct follows protocol (or deviations are documented)
Subpart J: Records and reports (§58.185-58.195)
The final report (§58.185) must include: name and address of the facility, dates of study initiation and completion, objectives and methods, statistical methods, results, description of all deviations and their impact, quality assurance statement, and the compliance statement I mentioned earlier.
Raw data (§58.190): All raw data must be retained. "Raw data" means original observations, including worksheets, records, computer printouts, and dictated notes. If data are entered directly into a computer system, the electronic record is the raw data, and the system must be validated. Correction of errors must be dated, the reason for the correction documented, and the original entry must remain legible (no whiteout, no deletion without audit trail).
Retention (§58.195): Records must be retained for a minimum of 2 years following FDA approval (or, if the drug isn't approved, for 5 years following the date the study results were submitted to FDA). In practice, retain them longer. No one has ever been penalized for keeping records too long.
Checklist items:
- Final report includes all required elements per §58.185
- Raw data preserved — original entries legible, corrections documented
- Computer systems validated (if electronic data capture)
- Audit trail for electronic records
- Archive access restricted and documented
- Retention period established and communicated
Subpart K: Quality assurance (§58.35)
The quality assurance unit (QAU) is independent. It does not report to the study director or to anyone involved in study conduct. The QAU inspects each study at intervals adequate to ensure compliance, reviews the final report, and prepares a statement that is included in the report.
Phase inspections: The QAU must inspect critical phases of each study — animal receipt, dose initiation, interim sacrifices, terminal sacrifice. These inspections must be documented.
The QA statement: Included in the final report. States the dates of inspections, the phases inspected, and that the results were reported to management and the study director. This statement is a mandatory element of a GLP study report. If it's missing, the study doesn't meet GLP.
Checklist items:
- QAU identified and independent from study conduct
- Master schedule of studies maintained by QAU
- Phase inspections conducted and documented
- QA findings reported to study director and management
- QA statement included in final report
- QAU reviewed final report before issuance
What FDA inspectors actually look for
I've talked to people who've been through GLP inspections. The consistent themes:
Traceability. Can the inspector follow a data point from the final report back to the raw data? If the report says the NOAEL is 100 mg/kg, the inspector will trace that back through the statistical analysis, the individual animal data, the clinical chemistry values, and the histopathology slides. If the chain breaks at any point, that's a finding.
Contemporaneous recording. Data must be recorded at the time of observation. Retrospective data entry — recording today what was observed last week — is a GLP violation. This is why training on data recording practices is critical.
Equipment calibration currency. Inspectors check calibration dates against study dates. If the analytical balance used to weigh dose formulations was due for calibration on March 1 and the study dosed on March 15 with no calibration record in between, that's a finding.
Test article accountability. How much test article was received, how much was used, how much is in the reserve sample. The numbers should reconcile.
For sponsors: what you're responsible for
If you're a biotech company outsourcing GLP studies to a CRO, you're not off the hook. Under Part 58, the sponsor is responsible for:
- Providing characterized test article with a certificate of analysis
- Providing stability data for the test article
- Reviewing and approving the protocol
- Receiving and reviewing the final report
- Ensuring the study is conducted at a facility that complies with GLP
In practice: get the CRO's GLP compliance status. Ask for their most recent FDA inspection outcome (483 observations, if any). Review the QA statement in the final report carefully. If there are deviations listed, understand what they are and whether they affect data integrity.
Don't just send the compound and wait for the report. Stay engaged. Review interim data if available. Ask for the QA inspection schedule. Your name is on the IND. The CRO's GLP compliance is your problem.
Connecting GLP to the IND
When you assemble your IND, each pivotal nonclinical study report in Module 4 should include the GLP compliance statement. The Nonclinical Overview in Module 2 should summarize the GLP status of each study. If a study has deviations, discuss their impact on data interpretation.
Non-GLP studies can be included in the IND as supportive data. Label them clearly as non-GLP. The problem isn't including non-GLP data — it's submitting non-GLP data for studies that should have been GLP.
Related reading:
- FDA IND Submission Checklist 2026 — complete requirements by CTD module
- ICH S2 Genotoxicity Testing Guide — S2(R1) battery requirements
- Clinical Holds: Why FDA Stops Trials — the 7 most common reasons
RegFo — nonclinical compliance checks against ICH M3(R2) and 21 CFR Part 58.