GxP

What is GxP?

GxP is the umbrella term for the ‘Good Practice’ guidelines and regulations, such as GMP, GLP, GCP and GDP, that define how regulated sectors like pharmaceuticals, biotech, medical devices and food demonstrably keep products, research and data safe, of high quality and traceable. The “G” stands for Good, the “P” for Practice, and the “x” is a placeholder for the domain, such as Manufacturing, Laboratory or Clinical. GxP is therefore not a single law but a family of rules and guidelines enforced by regulators such as the FDA and the Dutch Health and Youth Care Inspectorate (IGJ). For IT and OT, GxP matters mainly because SCADA, MES, LIMS and the historian record the data on which a batch is released.

🧠 Which guidelines fall under GxP?

Most GxP guidelines cover one phase of a product’s lifecycle, while GDocP applies to all of them: from laboratory research and clinical trials to manufacturing, distribution and monitoring after marketing authorisation.

Watch out for the double meaning of GDP: in pharma it usually means Good Distribution Practice, but some organisations use the same abbreviation for Good Documentation Practice. Outside pharma there are further variants, such as Good Agricultural Practice in farming.

GAMP is often listed alongside them, but it is of a different kind. GAMP 5 is a good-practice guide from the professional society ISPE that describes how to validate computerised systems; its second edition appeared in July 2022. The legal requirement to validate comes from GMP and the other GxP rules themselves.

🎯 Why is GxP important?

GxP exists because errors in medicines or research data can directly harm patients. The rules ensure that every step is repeatable, controlled and reconstructable afterwards.

• Patient safety and public health - wrong dosing, contamination or mix-ups must be prevented, and if they do happen you must be able to trace them
• Reliable data - clinical results, laboratory results and batch records must meet the principles of data integrity (ALCOA+)
• Market access - no manufacturing licence without a positive GMP inspection, no marketing authorisation without a GCP-compliant trial
• Verifiability - GxP enables audits, inspections, validation and traceability
• Foundation for systems - GxP sets the requirements for QMS, LIMS, DMS and MES

The consequences of non-compliance are concrete: an FDA warning letter, an import alert, a suspended licence or batches that may not be released. A cyber incident affects GxP too: the NotPetya wiper disrupted the production of medicines and vaccines at Merck in 2017.

🏛️ Who supervises GxP?

Since July 2019 the EU and the US have recognised each other’s GMP inspections for human medicines, so an IGJ inspection is sufficient in many cases. In the EU, GMP inspections are generally repeated at least once every three years. In the Netherlands, clinical trials are reviewed beforehand by an accredited medical research ethics committee or the CCMO, since 31 January 2022 through the EU portal of Regulation 536/2014.

🔧 What does GxP mean for IT and OT systems?

Every computerised system that affects product quality or records GxP data must be validated and kept in a state of control. In Europe this is set out in Annex 11 of EudraLex Volume 4 (2011); in the US, 21 CFR Part 11 covers electronic records and signatures and has applied since 1997.

Typical inspection findings in OT include shared accounts on an HMI, a disabled audit trail, operators with administrator rights and system clocks that are not synchronised. The draft revision of Annex 11 published on 7 July 2025 aims to make security, identity and access management and patching explicit requirements, and introduces a new Annex 22 on AI. Until the final version takes effect, the 2011 text applies.

🛠 How do you approach GxP compliance in an OT environment?

A practical approach follows the lifecycle from GAMP 5. The risk-based approach in the FDA’s final Computer Software Assurance (CSA) guidance of September 2025 is also useful: it was written for medical device production and quality system software, but serves as a reference in pharma as well. The steps:

1. Inventory and classify - build a system list and determine the GxP impact of each system; an energy dashboard is usually out of scope, a batch recipe is not
2. Perform a risk assessment - focus validation effort on functions with a high impact on patient, product and data, in line with risk management under ICH Q9(R1)
3. Specify and qualify - from user requirements (URS) through installation, operational and performance qualification (IQ, OQ, PQ), as described in Annex 15 since 1 October 2015
4. Secure the operational phase - change control, version control of PLC code and recipes, periodic review and backups with tested restores
5. Protect the system - zones and conduits according to IEC 62443, because an attack on the availability or integrity of data is also a GxP problem
6. Plan for the full lifetime - lifecycle management through to decommissioning, including readable archives

Some typical values from practice: cold-chain products are usually stored and shipped at 2–8 °C and room-temperature products at 15–25 °C, and the EU GDP Guidelines require qualified transport equipment and temperature mapping for temperature-sensitive products. Under EU GMP you keep batch documentation for at least one year after the batch’s expiry date or five years after certification by the Qualified Person, whichever is longer. Since 9 February 2019 most prescription medicines in the EU must also carry a unique identifier and an anti-tampering device, which makes track and trace a fixed part of the packaging line.

Pharmaceutical manufacturers may also fall under NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026. GxP and cybersecurity reinforce each other: the same measures for access, logging and change management serve both frameworks.

✅ What does working in line with GxP deliver?

• Better product quality and patient safety - fewer deviations, recalls and complaints
• Compliance with international laws and regulations - one approach for the EU, the US and PIC/S countries
• Standardised procedures and processes - captured in SOPs and a QMS
• Control of risks and deviations - through CAPA and risk-based validation
• Support during audits and inspections - demonstrable evidence instead of verbal explanation

❓ Frequently asked questions

What does the x in GxP stand for?

The x in GxP is a placeholder for the domain the good practice applies to. GMP stands for Good Manufacturing Practice, GLP for Good Laboratory Practice and GCP for Good Clinical Practice. GxP is therefore the collective name for all of these guidelines together.

Is GxP a legal requirement?

GxP as a collective term is not a law, but the underlying rules are. EU GMP is anchored in European directives and national medicines legislation, and in the US, GMP, GLP and Part 11 are part of the Code of Federal Regulations. Supporting guides such as GAMP 5 are not binding, but inspectors accept them as a well-founded way to comply.

What is the difference between GxP and ISO 9001?

ISO 9001 is a voluntary, general standard for quality management that any organisation can have certified. GxP rules are sector-specific, enforced by government inspectorates and set much more concrete requirements for validation, documentation and data integrity. A pharmaceutical company can be ISO 9001 certified and still fail to meet GMP.

Which OT systems fall under GxP?

GxP covers every OT system that affects product quality or records data used for release or investigations. Examples are SCADA, DCS, MES with electronic batch records, LIMS, historians and environmental monitoring systems. Systems without GxP impact, such as a building energy dashboard, are usually out of scope.

What is GxP validation?

GxP validation is documented evidence that a system or process consistently does what it is supposed to do. For computerised systems this is done on a risk basis according to Annex 11, 21 CFR Part 11 and GAMP 5, with qualification steps such as IQ, OQ and PQ. After go-live, change control and periodic review keep the system in a validated state.

Who enforces GxP in the Netherlands?

In the Netherlands, the Health and Youth Care Inspectorate (IGJ) checks whether manufacturers, wholesalers, laboratories and investigators comply with GxP. The IGJ is also the Dutch monitoring authority for Good Laboratory Practice. Licences for manufacturers and wholesalers are granted by Farmatec, part of the CIBG.

📌 In summary

GxP covers all ‘Good Practice’ guidelines, from GLP and GCP to GMP and GDP, that safeguard quality, safety and traceability in pharmaceuticals, biotech, medical devices and food.

For IT and OT, GxP means that systems affecting product quality must be validated, secured and ALCOA+-compliant, with audit trails, access control and controlled changes. Organisations that treat GxP, data integrity and cybersecurity as one coherent whole are well prepared for any inspection.