GxP / Guide 1
What GxP means for IT
The GxP family, predicate rules, the regulations and guidance that matter for computer systems, ALCOA+, and who is responsible for what in the cloud.
GxP is shorthand for the "good practice" rules that govern how medicines, medical devices, biologics and other regulated products are researched, made, tested, stored and monitored. For IT, it means one thing: if a system creates, changes, stores or reports data that a regulator relies on to judge product quality or patient safety, you have to show that the system does what it's meant to, that the data can be trusted, and that you can prove both years later. These notes cover how that works on Azure, AWS and SharePoint.
A note before you start: this is practical guidance from running GxP infrastructure, not legal or regulatory advice. Your quality unit, your procedures and your regulators decide what applies to your systems.
The GxP family
| Practice | Covers | Typical systems |
|---|---|---|
| GMP: Good Manufacturing Practice | Making and releasing product | ERP batch records, MES, LIMS, QMS, building management and environmental monitoring |
| GLP: Good Laboratory Practice | Non-clinical safety studies | Study management, instrument data systems, archives |
| GCP: Good Clinical Practice | Clinical trials | EDC, eTMF, CTMS, IRT, ePRO |
| GDP: Good Distribution Practice | Storage and transport | Warehouse management, temperature monitoring |
| GVP: Good Pharmacovigilance Practice | Safety monitoring after approval | Safety databases, case intake |
Medical device companies also work under design controls and a quality management system (in the US, the QMSR, which aligned 21 CFR 820 with ISO 13485 from 2 February 2026).
Predicate rules come first
The predicate rules are the underlying regulations that say which records you must keep: for example 21 CFR 211 for US drug manufacturing, 21 CFR 58 for GLP, or EU GMP Chapter 4 for documentation. The computer system rules (Part 11 and Annex 11) only apply because a predicate rule requires the record in the first place. So the first question for any system is always: which regulated records does it create or hold, and under which rule? That answer decides whether the system is GxP-relevant and how much control it needs.
The rules for computer systems
| Document | From | What it's for |
|---|---|---|
| 21 CFR Part 11 | US FDA, 1997 | Electronic records and electronic signatures. Read with FDA's 2003 Scope and Application guidance, which narrowed how it's enforced. |
| EU GMP Annex 11 | European Commission, 2011 | Computerised systems in GMP. A much longer revision was published as a draft in July 2025 (consultation closed October 2025), alongside a revised Chapter 4 and a new Annex 22 on AI. Check EudraLex Volume 4 for the current status before you rely on either version. |
| Computer Software Assurance (CSA) | US FDA, final September 2025 | Risk-based assurance for production and quality system software. Replaces section 6 of the 2002 General Principles of Software Validation. |
| Part 11 in clinical investigations Q&A | US FDA, final October 2024 | How Part 11 applies to clinical trial systems, including cloud and IT service providers. |
| ISPE GAMP 5, second edition | Industry, 2022 | The standard industry approach to computerized system validation, updated for critical thinking, agile, cloud and CSA. |
| Data integrity guidance | MHRA (2018), PIC/S PI 041-1 (2021), WHO | What inspectors expect for data integrity across the whole data life cycle. |
| ICH E6(R3) | ICH, 2025 | Good clinical practice, including computerised systems used in trials. |
Guide 2 goes through Part 11 and Annex 11 requirement by requirement, and Guide 3 covers validation.
ALCOA+: what trustworthy data means
Inspectors judge data against ALCOA+. It's the most useful checklist you can give an IT team, because every item maps to a technical control:
| Principle | Meaning | Where IT comes in |
|---|---|---|
| Attributable | You can tell who did it, and when | Unique named accounts, no shared logins, audit trails |
| Legible | Readable for the whole retention period | Formats and viewers that still work in 10 or 25 years |
| Contemporaneous | Recorded when it happened | Trusted time sources, time-stamped entries |
| Original | The first record, or a certified true copy | Controls on copies, exports and migrations |
| Accurate | Correct and free from errors | Validated interfaces, input checks, checksums |
| Complete | Nothing missing, including repeats and changes | Audit trails that can't be turned off; no silent deletes |
| Consistent | Same sequence and time stamps across systems | Time synchronization, controlled workflows |
| Enduring | Lasts for the retention period | Backups, immutable storage, archiving |
| Available | Can be retrieved for review and inspection | Searchable archives, tested restores |
What's in scope, and how much control
Not every system in a life sciences company is GxP, and treating everything as GxP is expensive and dilutes attention. Most companies classify each system with a short assessment:
- Is it GxP-relevant? Does it create, change, hold or report records required by a predicate rule, or does it support a GxP process (release, deviation, complaint, training, stability)?
- How much risk? What happens to product quality, patient safety or data integrity if it fails or gives a wrong result? This drives the depth of validation and the strength of controls.
- What kind of software? Infrastructure, standard, configured or custom (the GAMP categories in Guide 3).
Infrastructure under a GxP system (the subscription, VPC, directory, backup, logging) isn't "validated" itself, but it must be qualified and kept under control, because the validated system depends on it. Guide 4 covers that.
In these notes, GxP scope is marked with a tag: GxP = Yes on the Azure subscription or resource group, or on the AWS account and resources. The evidence scripts use the same tag, so the scope you declare is the scope you report on.
Shared responsibility in the cloud
There is no such thing as a "GxP-certified" or "Part 11-certified" cloud. Microsoft and AWS both say so directly. What they provide is a platform with independent audits (ISO 9001, ISO 27001, SOC 1 and SOC 2) and GxP guidance documents, and you remain responsible for the regulated system and its data:
| Layer | Cloud provider | You |
|---|---|---|
| Data centers, hardware, hypervisor | Operates, secures, audits | Assess the provider as a supplier and review its audit reports |
| Platform services (PaaS) | Operates the service | Configure it, control changes, keep logs and backups |
| Accounts, networks, identities | Provides the tools | Design, qualify and control them |
| Operating systems and applications | — | Validate, patch, back up, review access |
| GxP data and records | — | Integrity, retention, audit trails, availability |
For SaaS (for example a hosted LIMS or QMS), the vendor takes on more of the stack, but you still own the validation of your intended use, the supplier assessment and the quality agreement.
How these notes are organised
- Regulations and validation (Guides 2 and 3): what the rules ask for, and how to show you meet them without drowning in paperwork.
- Platforms (Guide 4): qualifying Azure and AWS landing zones.
- Controls (Guides 5 to 8): audit trails, access control, change control, and backup and disaster recovery. These are the controls inspectors test most often, and the ones IT owns.
- Documents and operations (Guides 9 and 10): SharePoint for controlled documents, periodic review and inspection readiness.
The scripts are all read-only. Each one writes a CSV plus a .sha256 file recording the file's hash, who ran it, when and with which parameters, so the output can go straight into an evidence folder.