21 CFR Part 58: GLP Requirements for Nonclinical Studies

21 CFR Part 58, Good Laboratory Practice for Nonclinical Laboratory Studies, is the FDA regulation that governs how nonclinical (preclinical) safety and toxicology studies must be planned, conducted, monitored, recorded, and reported when that data is intended to support a research or marketing permit application. It applies to the studies that generate the safety data behind an IND, an NDA, a BLA, or a device submission — not to manufacturing (that is GMP) and not to human trials (that is GCP). CASRAI’s GLP dictionary entry covers the operational definition; this guide goes subpart by subpart through what Part 58 actually requires of a testing facility — the study director’s authority, the independence of the quality assurance unit, how protocols and SOPs govern conduct and deviations, and what has to survive in the archives.

If you are trying to place GLP relative to GCP and GMP first, start with CASRAI’s GxP compliance overview, which orients across the whole “Good … Practice” family. This page deliberately does not repeat that orientation — it assumes you already know GLP is the nonclinical-study framework and want the actual Part 58 compliance mechanics.

What Counts as a “Nonclinical Laboratory Study” Under Part 58

Part 58 applies specifically to a nonclinical laboratory study: an in vivo or in vitro experiment in which a test article is studied prospectively in a test system, under laboratory conditions, to determine its safety properties — and where the results are intended to be submitted to, or held for inspection by, FDA as part of a research or marketing permit application. Basic exploratory research with no such regulatory intent falls outside GLP scope, which is why a university core facility running early discovery screens is not automatically GLP-obligated the way an IND-enabling study is. Once a sponsor is filing an IND, 21 CFR 312.23(a)(8)(iii) requires the application to state, for each covered nonclinical study, whether it was conducted in compliance with GLP — or, if not, a brief statement of the reason for noncompliance. FDA expects the pivotal nonclinical safety studies behind an IND to be GLP-compliant; non-GLP pivotal toxicology data is a recognized clinical-hold risk, not an automatic rejection, but it invites exactly the scrutiny a testing facility is trying to avoid by following Part 58 in the first place.

The Study Director: Single Point of Study Control

Every GLP study must have one named, qualified study director who, under 21 CFR 58.33, “represents the single point of study control” and holds overall responsibility for the study’s technical conduct and for the interpretation, analysis, documentation, and reporting of results. That authority is not honorary — the study director is specifically responsible for ensuring:

• The protocol, and any change to it, is approved as required under 58.120 and is actually followed during conduct.
• All experimental data — including observations of unanticipated responses of the test system — are accurately recorded and verified.
• Unforeseen circumstances that could affect the quality and integrity of the study are documented and addressed with corrective action.
• Test systems match what the protocol specifies.
• All applicable GLP regulations are followed throughout the study.
• All raw data, documentation, protocols, specimens, and the final report are transferred to the archives during, or at the close of, the study.

In practice, this makes the study director the person an FDA inspector holds accountable when protocol conduct and the raw data disagree — the single-point-of-control language exists precisely so responsibility cannot be diffused across a study team with no one person answerable for it.

The Quality Assurance Unit: Independence Is the Whole Point

21 CFR 58.35 requires every testing facility to maintain a quality assurance unit (QAU) that is entirely separate from and independent of the personnel engaged in directing and conducting the study. That independence is the regulation’s central control against a study grading its own work. A compliant QAU:

• Keeps copies of all study protocols and maintains a master schedule of nonclinical laboratory studies — test article, test system, initiation date, current status, sponsor, and study director for each.
• Conducts periodic inspections at intervals adequate to ensure study integrity, documenting findings, problems, recommended corrective actions, and reinspection dates.
• Immediately notifies the study director and management of any problem likely to affect study integrity.
• Delivers written periodic status reports to management and the study director noting problems and the corrective action taken.
• Verifies that any protocol deviation was authorized and documented before the QAU signs off on it.
• Reviews the final study report to confirm it accurately describes the methods and procedures used and that the reported results reflect the raw data.

The QAU’s own procedures, records, and indexing methods must themselves be maintained in writing and made available for FDA inspection — the auditor is itself auditable. Note this is a structurally different unit from a clinical trial’s SOP-driven quality function; a GLP QAU’s mandate is specifically nonclinical-study integrity, reporting on a study-by-study basis rather than site-level clinical monitoring.

Protocol Requirements, Amendments, and How Deviations Are Handled

Subpart G (58.120–58.130) governs the protocol itself. Before a study starts, the protocol has to specify, at minimum, a descriptive title and statement of purpose, identification of the test and control articles, the sponsor and testing facility names, the proposed experimental start and completion dates, a justification for the test system and route of administration selected, the study design (including how bias is controlled and how data will be interpreted), and the methods, materials, and schedule of events for the study. Any change to an approved protocol is a protocol amendment: it must be documented, signed and dated by the study director, and maintained with the original protocol — it cannot simply be a verbal instruction to the study team or a note in a lab notebook that never makes it back to the controlling document.

An unplanned departure from the approved protocol is handled differently from a deliberate amendment: the QAU’s job under 58.35 is specifically to verify that any such deviation was authorized by the study director and documented, not simply discovered after the fact during final-report review. This is a related but distinct concept from a clinical trial’s protocol deviation, which is IRB/IEC-facing and governed under GCP — Part 58 has no equivalent external ethics-board reporting channel; the control is entirely internal, running through the study director and QAU.

Standard Operating Procedures

Subpart E (58.81) requires a testing facility to have written SOPs covering the routine aspects of study conduct that a protocol should not need to restate every time — test system observations, laboratory tests, animal care, sample handling and storage, chemical and reagent handling, equipment maintenance and calibration, data handling, and computerized-system controls, among others. SOPs are approved by facility management and kept current in a location accessible to the personnel performing the work; historical versions have to be retained rather than simply overwritten, since an inspector may need to confirm which version was in effect during a specific study. CASRAI’s guide to writing a lab SOP covers structure and version-control practice in more depth if you are building this document set from scratch.

Raw Data, Records, and the Archives

Subpart J (58.185–58.195) governs records and reports. Under 58.33, the study director is personally responsible for ensuring raw data, documentation, protocols, specimens, and the final report are transferred to the archives during, or at the close of, the study — not left in a working lab notebook indefinitely. Part 58 designates a specific individual as the archivist, responsible for controlling access to and indexing material in the archives, which must be a facility (or contracted space) providing orderly storage and expedient retrieval. The exact retention period for a given study’s records depends on the regulatory disposition of the application it supports — whether a marketing application was ever filed, and if so, its approval status — and is set out in 58.195; the practical implication for a testing facility is that a retention schedule needs to be tied to application status, not a single fixed default. The recordkeeping obligation dovetails with ALCOA+ data-integrity principles more broadly — raw data has to remain attributable, legible, contemporaneous, original, and accurate for as long as it is retained, not just at the moment it was first recorded.

The GLP Compliance Statement in the Final Report

The final study report is where Part 58’s controls converge into a single auditable artifact. Alongside the study director’s own sign-off, the QAU is required to prepare and sign a statement, included with the final report, specifying the dates inspections were made and the dates any findings were reported to management and the study director. That QAU statement — commonly referred to as the GLP compliance statement — is what an FDA reviewer or inspector checks first: it is the QAU’s own certification that the process was actually followed, not just that the final numbers look reasonable. A report missing this statement, or with an assurance function that was not genuinely independent of the study team, is a documentation-integrity finding in its own right, separate from any question about the underlying science.

Disqualification of Testing Facilities

Subpart K (58.200–58.219) gives FDA a formal disqualification process for a testing facility whose noncompliance is serious enough to raise doubts about the validity of its studies. Disqualification carries real consequences beyond the facility itself: FDA may refuse to consider data from a disqualified facility’s studies in support of an application, which is why sponsors typically vet a contract testing laboratory’s GLP inspection history before committing pivotal nonclinical work to it.

How Part 58 Relates to GCP and GMP

Part 58 sits upstream of both of the other major GxP frameworks in a typical drug or device development timeline: nonclinical GLP studies generate the safety data that supports moving into GCP-governed human trials, while the product itself is eventually manufactured under GMP. See CASRAI’s GCP vs. GLP, GLP vs. GMP, and three-way GCP/GLP/GMP comparison for the direct side-by-side differences if you need to explain scope to someone working in an adjacent framework.

Internationally, the OECD Principles of GLP are structured on the same core commitments as Part 58 — a named study director, an independent quality assurance function, controlled protocols, and archived raw data — and underpin the OECD’s Mutual Acceptance of Data (MAD) system: a nonclinical safety study run under OECD Test Guidelines and OECD GLP Principles in one MAD-adherent country can be accepted for regulatory assessment in every other adherent country, without having to be repeated. A sponsor running multinational nonclinical programs generally designs one GLP-compliant study rather than separate FDA- and OECD-facing versions.

Frequently Asked Questions

Does 21 CFR Part 58 apply to all laboratory research?

No. It applies specifically to nonclinical laboratory studies whose results are intended to support, or be available for inspection as part of, a research or marketing permit application to FDA. General exploratory or hypothesis-driven research with no such regulatory purpose is outside GLP scope, even when it happens in the same facility.

Who can be a GLP study director?

Part 58 does not prescribe a specific credential; it requires the testing facility to designate a qualified scientist or other professional as study director for each study, who then holds the single-point-of-control responsibilities described in 58.33 for that study’s technical conduct, data accuracy, and reporting.

Why does the quality assurance unit have to be independent?

Because 58.35 is built to prevent a study from auditing itself. A QAU that reports through the same management chain as the study team, or that participates in study conduct, cannot credibly certify — via the compliance statement required with the final report — that protocol and SOP requirements were actually followed.

What is the difference between a protocol amendment and a protocol deviation under GLP?

An amendment is a planned, approved change to the protocol, signed and dated by the study director and filed with the original document before or as the change takes effect. A deviation is an unplanned departure from the already-approved protocol; the QAU’s role is to confirm any deviation was authorized and documented, rather than discovered only at final-report review.

How is Part 58 different from the GxP family overview?

CASRAI’s GxP compliance guide orients across GLP, GCP, GMP, and GDP at a scope level — which framework applies to which stage of work. This page stays inside GLP specifically and goes through Part 58’s actual operational requirements: study director authority, QAU independence, protocol and SOP control, and archiving.

Does GLP compliance ever expire or need recertification?

GLP is not a certification a facility earns once; it is a set of requirements a facility has to demonstrate it followed on a study-by-study basis, verified through FDA inspection and the QAU’s own compliance statement in each final report. A facility’s inspection history, including any prior findings, is what sponsors and FDA actually rely on when assessing whether to trust a given study’s data.