GxP vs GMP vs GLP vs GCP: What Each One Actually Covers

Side by side

GMP — Good Manufacturing Practice

Covers: everything involved in making a product — premises, equipment, materials, personnel, batch records, in-process control, packaging, release. Key question: was this batch made correctly and can you prove it? Unit of scrutiny: the batch. Where it lives: 21 CFR 210/211 in the US, EudraLex Volume 4 in the EU, ICH Q7 for active ingredients.

GMP is continuous. There is no start and end date; it applies to every batch, every day the facility operates. This is why GMP organisations carry the heaviest routine documentation burden of the three.

GLP — Good Laboratory Practice

Covers: non-clinical safety studies submitted to regulators — toxicology, safety pharmacology, and similar. Key question: can this study be reconstructed and relied upon? Unit of scrutiny: the study. Where it lives: 21 CFR 58 in the US, OECD GLP Principles internationally.

GLP is the most frequently misapplied of the three. It governs specific safety studies intended for regulatory submission — not laboratory work generally. Routine QC release testing in a manufacturing lab is GMP. Analytical method development is usually neither. The distinguishing features of GLP are the Study Director role and an independent Quality Assurance Unit, neither of which exists in GMP with the same meaning.

GCP — Good Clinical Practice

Covers: the design, conduct, monitoring, recording and reporting of trials in human subjects. Key question: were subjects protected and is the data credible? Unit of scrutiny: the subject and the trial. Where it lives: ICH E6(R3), 21 CFR 312 and 50/56 in the US, EU Clinical Trials Regulation 536/2014.

GCP is the only one with an explicit ethical mandate as its first principle. It is also the most distributed: the sponsor, the CRO, and every investigator site all carry obligations, and the sponsor remains accountable for work it does not directly perform.

Where they genuinely overlap

Four requirements appear in all three, which is why the collective term is useful at all.

• Data integrity. ALCOA+ applies identically. An inspector examining a GCP source document and one examining a GMP batch record are applying the same underlying test.
• Computerised system validation. A system supporting any of the three must be validated. Annex 11 and Part 11 apply across disciplines.
• Qualified, trained personnel with documented evidence.
• Change control and deviation management. The terminology shifts — GCP says protocol deviation, GMP says deviation and CAPA — but the obligation to detect, assess, document and act is common.

This overlap is what makes a shared platform practical. The same validated document control and audit trail infrastructure can serve all three, which is the usual argument for consolidating onto GxP software rather than running discipline-specific tools.

Where the differences actually bite

Who holds final accountability. In GMP it is the Qualified Person or equivalent, who personally certifies batch release. In GLP it is the Study Director, who has sole responsibility for the scientific conduct of the study. In GCP it is split — the sponsor holds overall responsibility, the principal investigator holds site-level responsibility for subject welfare. Applying one model to another discipline creates approval chains that do not match the regulation.

What an inspection looks like. A GMP inspection is a site inspection — the facility, the equipment, the records. A GLP inspection is usually study-based — reconstructing a specific study from raw data. A GCP inspection is often site-based at an investigator location, comparing case report forms against source documents. Preparation for one does not prepare you for another.

Retention periods. These differ materially by discipline and jurisdiction, and getting them wrong in either direction is costly. Covered in detail in GxP archiving and data retention.

The independent quality function. GLP requires a Quality Assurance Unit structurally independent of study conduct. GMP requires a Quality Unit with defined release authority. GCP has no exact equivalent — monitoring and audit serve a related purpose with a different structure.

The boundary mistakes that cause findings

• Calling QC testing "GLP". The single most common error. Release testing in a manufacturing quality control lab is GMP. Claiming GLP status invites an inspector to look for a Study Director and a QAU that do not exist.
• Treating clinical manufacturing as GCP-only. Investigational medicinal product is manufactured under GMP. A trial sponsor making its own supply is under both, and the GMP obligations do not soften because the material is for a trial.
• One SOP set stretched across disciplines. A generic deviation procedure that ignores the difference between a protocol deviation and a manufacturing deviation produces records that satisfy neither inspector.
• Assuming a vendor's GxP claim covers your discipline. A system validated for GMP document control is not automatically fit for trial master file obligations. Ask which discipline the vendor's evidence actually addresses — a point covered in qualifying an AI vendor and equally true of conventional software.
• Uniform validation rigour across every system. Effort should follow risk, not habit. See GxP risk assessment.

Which applies to you

Work backwards from the activity, not the job title. Ask what regulatory decision the output of this work supports.

• Output supports releasing a batch to market, or controls how product is made → GMP.
• Output is a non-clinical safety study submitted to support a regulatory application → GLP.
• Output involves human subjects in a trial → GCP.
• Output concerns storage and transport of released product → GDP.
• Output concerns post-market safety surveillance → GVP.

Most organisations land in more than one. That is normal, and the right response is a common quality backbone with discipline-specific procedures layered on top — not five parallel quality systems. If you are new to the terrain, start with what GxP means.