What is a LIMS?
A LIMS (Laboratory Information Management System) is software that manages the complete lifecycle of laboratory samples, from registration and analysis planning to results entry, approval, reporting and archiving, with full traceability. In manufacturing companies, the LIMS is where the quality control laboratory records whether a raw material, intermediate or finished product meets its specification. That makes it the digital link between analysis, release and process improvement, and it is usually integrated with MES, ERP and the organisation’s compliance processes. A LIMS supports the laboratory’s quality management system, but it only works when processes, people and data are defined together.
🧠 What does a LIMS do?
A LIMS takes every sample through a fixed sequence of steps. Each step is recorded with the user, the timestamp and, where relevant, the reason for a change.
| Function | Description |
|---|---|
| Sample registration | Booking in samples from production, goods receipt or the environment, with a unique sample ID and often a barcode label |
| Analysis management | Planning and assigning tests, methods, instruments and analysts |
| Results entry | Manual or automatic entry of measured values, checked against specification limits |
| Review and approval | Second-person review and electronic signature before a result becomes final |
| Certificates and reports | Automatic generation of certificates of analysis (CoA) or rejection notices |
| Traceability | Origin, analysis history, reagents used and instrument calibration status per sample |
| Trend analysis | Statistical monitoring of results, for example with SPC control charts |
| Compliance | Support for GMP, GLP, ISO/IEC 17025 and 21 CFR Part 11 |
A typical flow: production takes a sample, the LIMS creates a sample ID linked to the batch number, the analyst runs the tests, a second analyst approves the results and the LIMS generates a release certificate. If a value falls outside the specification, the LIMS starts an OOS (Out of Specification) investigation instead of releasing the batch.
🔄 How does a LIMS differ from an ELN, CDS and MES?
A LIMS is one of several laboratory systems. The ASTM guide E1578 (Standard Guide for Laboratory Informatics, current edition E1578-18) therefore covers not just the LIMS but the entire laboratory informatics landscape.
| System | Core task | Relationship to the LIMS |
|---|---|---|
| LIMS | Samples, tests, specifications, release | The central system of record of the lab |
| ELN (Electronic Lab Notebook) | Recording experiments and unstructured observations | Mainly in R&D; sometimes passes results to the LIMS |
| CDS (Chromatography Data System) | Controlling chromatographs and processing raw data | Sends calculated results to the LIMS |
| SDMS (Scientific Data Management System) | Archiving raw instrument data | Stores the source files the LIMS refers to |
| MES | Executing and recording production | Requests samples and receives the release status |
In the ISA-95 model, the LIMS sits at level 3 under quality operations management, next to the MES. The ERP system at level 4 uses that quality status to decide whether a lot may be sold or shipped.
🏭 Where is a LIMS used?
- Pharmaceutical industry - GMP quality control laboratories, where no batch may be released without a complete record
- Food industry - microbiological and chemical testing within HACCP and ISO 22000
- Chemicals and energy - raw material analyses, product specifications and process monitoring
- Water and environment - air, soil and water samples, including at drinking water companies
- Manufacturing - quality testing integrated with MES or SCADA
In the Netherlands, testing and calibration laboratories are accredited against EN-ISO/IEC 17025 by the Dutch Accreditation Council (Raad voor Accreditatie, RvA). Accreditation applies per scope, meaning per specific test, and is assessed periodically. A well-configured LIMS provides much of the evidence the assessors want to see.
🔗 How does a LIMS connect to production and instruments?
| System | Integration with the LIMS |
|---|---|
| MES | Provides batch data and sample requests; receives the quality status |
| ERP | Receives release or rejection for inventory, sales and logistics |
| Instruments | Direct data link with analytical equipment such as HPLC, GC or ICP-OES, often via a CDS |
| SCADA and historian | Process context for a sample, or a sample request after a process deviation |
| Inline analysers | Continuous measurements that reduce the number of manual samples |
For a long time, instruments were connected through file exports, serial ports or vendor-specific middleware. Open standards are now emerging: SiLA 2 is an open connectivity standard for laboratory equipment, and OPC UA LADS (Laboratory and Analytical Device Standard) is an OPC UA companion specification from the German industry association Spectaris, first released in November 2023. This allows laboratory data to follow the same route as process data, for example through a Unified Namespace.
🔐 Which regulations must a LIMS meet?
- FDA 21 CFR Part 11 - the US requirements for electronic records and signatures since 1997, including a mandatory audit trail
- EU GMP Annex 11 - the European requirements for computerised systems; the 2011 text still applies, while a draft revision was published in July 2025 together with a new Annex 22 on AI
- ISO/IEC 17025:2017, clause 7.11 - the LIMS must be validated before use, including its interfaces; every change to configuration or software must be authorised, documented and validated
- GAMP 5 - ISPE’s risk-based validation approach, second edition July 2022
- ALCOA+ - data must be attributable, legible, contemporaneous, original and accurate, and also complete, consistent, enduring and available
In September 2025 the FDA published its final guidance on Computer Software Assurance (CSA), which focuses testing effort on high-risk functions. The guidance formally addresses production and quality system software at medical device manufacturers, but the pharmaceutical industry widely adopts it as a way of thinking. For a LIMS, that approach means thorough testing where specification checks, calculations and release take place, and lighter evidence for report layouts or list views. Every change goes through change management and version control.
🛡️ How do you secure a LIMS in an IT/OT environment?
A LIMS sits on the boundary between IT and OT: the application often runs in the data centre or the cloud, while the instrument PCs sit in the lab and sometimes stay on an old operating system for years because the vendor supports only that version. That makes the lab a well-known weak spot.
- Segment the lab network - place instrument PCs in their own zone using network segmentation and IEC 62443, with only the connections needed to the LIMS and CDS
- Treat old instrument PCs as legacy systems - compensating controls, application whitelisting and no internet access
- Use personal accounts and MFA - shared lab accounts undermine both the audit trail and security
- Make backups and test restores - a ransomware attack on the LIMS stops batch release and therefore deliveries
- Run patch management in a validated way - patches are changes and require an assessment of the validation status
Pharmaceutical manufacturers fall under the health sector of NIS2; food production and chemical manufacturing are listed in the annex of other critical sectors. In the Netherlands, NIS2 has been transposed into the Cybersecurity Act, which entered into force on 15 August 2026. A LIMS whose failure blocks release therefore belongs in the risk assessment and the business continuity plan.
🧭 How do you implement a LIMS step by step?
- Map the lab processes - which sample flows, tests, specifications and reports exist, and who approves?
- Write a User Requirements Specification - including integrations with MES, ERP and instruments, and the regulatory requirements
- Select a vendor - well-known packages include LabWare, Thermo Fisher SampleManager, LabVantage and STARLIMS; also assess supplier security
- Configure rather than customise - custom code increases the validation burden at every upgrade
- Validate based on risk - following GAMP 5 and CSA, with testing in a separate OTAP environment (development, test, acceptance, production)
- Migrate master data carefully - specifications, methods and product codes are the core of the system
- Train users and secure governance - define who approves changes and how audit trails are reviewed periodically
❓ Frequently asked questions
What does LIMS stand for?
LIMS stands for Laboratory Information Management System. A LIMS manages samples, tests, results and reports in a laboratory and records every action in a traceable way. It is used in quality control, research and environmental laboratories.
What is the difference between a LIMS and an ELN?
A LIMS focuses on structured, repeatable tests on samples with fixed specifications, such as quality control in production. An ELN (Electronic Lab Notebook) records experiments and free-form observations, mainly in research and development. Many organisations use both systems side by side.
Does a LIMS need to be validated?
A LIMS in a GMP environment must be validated under EU GMP Annex 11 and, when exporting to the US, 21 CFR Part 11. ISO/IEC 17025:2017 also requires in clause 7.11 that a LIMS is validated before use and after every change. Validation is usually risk-based, following GAMP 5.
How does a LIMS work with an MES?
The MES requests a sample at a production step and passes the batch number to the LIMS. The LIMS records the analyses and reports the quality status back, after which the MES or ERP releases or blocks the batch. This creates a closed chain from production to quality release.
Can a LIMS run in the cloud?
A LIMS can run in the cloud as a SaaS service, and many vendors offer this. The regulated company remains responsible for validation, data integrity and supplier assessment. The 2025 draft revision of EU GMP Annex 11 therefore pays explicit attention to cloud services.
Why is a LIMS attractive to attackers?
A LIMS holds the release status of every batch, so an outage immediately halts product deliveries. Instrument PCs in the lab also often run outdated software. That is why a LIMS belongs in the OT security approach, with segmentation, personal accounts and tested backups.
📌 In summary
A LIMS manages the complete lifecycle of laboratory samples and is the digital link between analysis, quality release and production. With integrations to MES, ERP and instruments, validation under Annex 11, Part 11, ISO/IEC 17025 and GAMP 5, and security that treats the lab as an OT zone, a LIMS delivers reliable and traceable quality data.