Quality is the law: GMP, GLP, and GCP in practice

# Quality is the law: GMP, GLP, and GCP in practice

In 2022, Emergent BioSolutions' Baltimore plant made headlines when the FDA forced the destruction of an estimated 400 million doses of COVID-19 vaccine after inspectors found mold, peeling paint, and cross-contamination between two different vaccine products. No fraud. No poison. Just a factory that could not prove it was clean and controlled. That is the whole point of GxP: in this sector, quality is not a competitive nicety. It is a legal requirement, and failing it can shut you down overnight.

What "GxP" actually means

"GxP" is shorthand for a family of "Good Practice" regulations, where the "x" stands for the domain. The three you must know:

• GMP (Good Manufacturing Practice): how you make a product.
• GLP (Good Laboratory Practice): how you run non-clinical safety studies.
• GCP (Good Clinical Practice): how you run trials in humans.

They cover different stages of a product's life, and each is enforced by real regulators with real teeth: the FDA (US Food and Drug Administration) in the United States and the EMA (European Medicines Agency) plus national authorities in Europe.

The core philosophy across all three is identical and worth memorizing: if it isn't documented, it didn't happen. Regulators do not just want a safe product. They want proof, in writing, that every step was controlled.

GMP: on the factory floor

GMP governs manufacturing of drugs, biologics, and medical devices. In the US the legal basis is 21 CFR Parts 210 and 211 (CFR = Code of Federal Regulations) for drugs, and 21 CFR Part 820 (the Quality System Regulation) for devices. In the EU, it is EudraLex Volume 4.

What GMP demands in practice:

• Validated processes. You must prove your process reliably makes the same product every time. If you sterilize vials at 121°C for 20 minutes, you need data showing that cycle actually kills microbes, every batch.
• Environmental control. Cleanrooms are graded (Grade A through D in the EU, or ISO classes). A fill line for an injectable operates under Grade A conditions with strict particle and microbe limits.
• Batch records. Every batch has a document trail: raw material lots, equipment used, operator signatures, test results. A single missing signature can make a batch non-releasable.
• Deviation management. When something goes off-script (a temperature spike, an out-of-spec test result), you must investigate, document root cause, and decide whether the batch is safe.

Why one deviation halts production

Here is the mechanism that makes GMP so consequential. An FDA inspector who finds serious problems issues a Form 483, a list of observations. If the company's response is weak, the FDA escalates to a Warning Letter, a public document. If violations persist, the FDA can issue an import alert (blocking products at the border) or seek an injunction that legally stops production.

Because customers, partners, and the public can read Warning Letters, searchable in the FDA's public database, reputational damage often arrives before legal consequences. A generics maker with a Warning Letter can lose contracts within weeks.

The Emergent case shows the cascade: contamination found, production paused, a Warning Letter issued, hundreds of millions of doses destroyed, and the CDMO (Contract Development and Manufacturing Organization) losing major business.

GLP: in the lab

GLP applies to non-clinical safety studies, the animal and lab toxicology work done before a drug ever touches a human. Legal basis: 21 CFR Part 58 in the US, and OECD GLP Principles adopted across Europe.

Important boundary: GLP is not about scientific quality of research generally. It is specifically about the integrity and traceability of safety data submitted to regulators. A university discovery lab does not need GLP. The tox lab generating data for an IND (Investigational New Drug) application does.

GLP in practice requires:

• A study director with single-point accountability for each study.
• A written protocol locked before the study starts.
• Raw data preservation. Every observation, retained and attributable.
• An independent Quality Assurance Unit that audits studies and reports to management, separate from the scientists doing the work.

The classic GLP failure is data that cannot be reconstructed: an animal weight recorded on a sticky note, later transcribed, with the original lost. Under GLP, that break in the chain can invalidate the study.

GCP: in the clinic

GCP governs clinical trials in humans. The global reference standard is ICH E6(R3), the International Council for Harmonisation guideline (a 2023 revision now in force for 2026). In the US it is enforced through FDA regulations (21 CFR Parts 50, 54, 56, 312); in the EU through the Clinical Trials Regulation (EU No 536/2014), which since 2022 runs trials through the centralized CTIS (Clinical Trials Information System) portal.

GCP has two overriding goals: protect trial subjects and ensure data credibility.

Key requirements:

• Informed consent. Every participant must understand and voluntarily agree, documented before any trial procedure.
• IRB / Ethics Committee approval. An independent IRB (Institutional Review Board), called an Ethics Committee in Europe, must approve the trial before it starts.
• Investigator responsibilities. The site principal investigator is accountable for protocol adherence and subject safety.
• Source data verification. Trial data must trace back to source records (the patient's actual chart), so a monitor can confirm the reported blood pressure matches the clinic's own record.
• Adverse event reporting. Serious unexpected reactions must be reported to regulators on strict timelines (often 7 or 15 calendar days).

A GCP failure example: if a site enrolls a patient who did not meet eligibility criteria, or backdates a consent form, the FDA can issue a Warning Letter to the investigator and, in severe cases, exclude that site's data from the entire application. Lose enough data and the trial may fail its statistical endpoints.

🎬 [VIDEO: "Good Clinical Practice (GCP) Explained" - youtube.com - a concise walkthrough of GCP principles and trial roles for non-specialists]

How the three fit together

Follow one molecule through its life:

1. GLP: safety studies in animals generate the tox data for the IND.

2. GCP: human trials test safety and efficacy for the marketing application.

3. GMP: once approved, every commercial batch is manufactured under GMP forever.

A weakness at any stage can sink the whole program. Great trial data (GCP) means nothing if you cannot manufacture the product reproducibly (GMP).

Data integrity: the thread through all of GxP

Modern enforcement centers heavily on data integrity. Regulators use the mnemonic ALCOA+: data must be Attributable, Legible, Contemporaneous, Original, and Accurate, plus Complete, Consistent, Enduring, and Available.

In practice this shapes how software and lab systems are built. Electronic records must be governed by 21 CFR Part 11 in the US, which requires audit trails, access controls, and legally valid electronic signatures. A quick illustration of what an audit trail entry must capture:

User: j.rivera (analyst, ID 4471)
Action: MODIFIED result field "Assay_Purity"
Old value: 98.2%   New value: 99.1%
Timestamp: 2026-03-14 14:22:07 UTC
Reason: transcription error, verified against instrument printout #A-2231

Notice: who, what, when, and why, all captured automatically. A lab notebook or LIMS (Laboratory Information Management System) that lets someone quietly overwrite a failing result without this trail is a data integrity violation, and one of the most common triggers for serious FDA action against overseas APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → (Active Pharmaceutical Ingredient) manufacturers.

The compliance constraint, in business terms

GxP is not free. It imposes real structural costs and constraints: