{"head":{"title":"What Is GxP? Good Practice Rules for Software | OceanLab","description":"GxP is the family of good practice rules for regulated life sciences work, such as GMP and GCP. What it means for software, an example and common mistakes.","canonical":"https://oceanlab.in/glossary/gxp"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"GxP","path":"/glossary/gxp"}],"slug":"gxp","term":"GxP (good practice regulations)","aka":["good practice","GMP, GCP, GLP"],"category":"Compliance","short":"The family of good practice rules, such as manufacturing (GMP), clinical (GCP) and laboratory (GLP) practice, that regulated life sciences work must follow.","body":[["The x in GxP stands for the area: manufacturing, clinical, laboratory, distribution and others. The rules come from regulators such as the FDA and their counterparts elsewhere. They share one aim: products are safe and the records about them can be trusted."],["When software creates or stores records used for GxP work, it is in scope too. In the US, 21 CFR Part 11 sets the rules for those electronic records and signatures, including ",{"href":"/glossary/audit-trail","text":"audit trails"},", access control and system validation."]],"why":["Software used in GxP work usually has to be validated: shown, with documented tests, to do what it is meant to do. That adds work to every release. Knowing early that a system is GxP-relevant changes how requirements, testing and change control are run."],"example":["A pharma company wants a tool to track equipment cleaning in its plant. Because cleaning records feed manufacturing quality, the tool is GxP-relevant. It needs user access control, an audit trail, ",{"href":"/glossary/e-signature","text":"e-signatures"}," for sign-off and a validation pack before go-live."],"inBuild":["We keep requirements, risk notes and test evidence traceable to each other, run releases through change control and keep a validation summary up to date. We also tell the customer which parts of validation are theirs, such as testing in their own setup."],"mistakes":[["Treating validation as one big test at the end instead of evidence from each release."],["Using cloud services in the GxP data path without checking the vendor's own controls."],["Making small changes in production without going through change control."]],"related":[{"href":"/glossary/audit-trail","label":"Audit trail","detail":"A secure, time-stamped history of who created, changed or deleted a record, kept so the record can be trusted later."},{"href":"/glossary/e-signature","label":"Electronic signature (e-signature)","detail":"A way of signing a document or approving a record electronically, so it carries the signer's intent the way a handwritten signature would."},{"href":"/glossary/conformity-assessment","label":"Conformity assessment","detail":"The process of showing that a product meets the EU rules that apply to it before it is placed on the market."},{"href":"/glossary/samd","label":"SaMD (software as a medical device)","detail":"Software meant for one or more medical purposes that does that job on its own, without being part of a hardware medical device."},{"href":"/glossary/maker-checker","label":"Maker-checker (four-eyes principle)","detail":"A control where one person makes a change and a different person must approve it before it takes effect."}],"tools":[],"links":[{"href":"/software/pharma","label":"Software for pharma","detail":"Life sciences systems and validated software."},{"href":"/compliance/21-cfr-part-11","label":"21 CFR Part 11 guide","detail":"FDA rules for electronic records and signatures."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"sources":[{"title":"21 CFR Part 11, Electronic records; electronic signatures (eCFR)","url":"https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}