GLP-compliant practices in medical technology (GLP practices): 10 key elements for audit-ready preclinical reports

Good Laboratory Practice (GLP) often determines success or setbacks in MedTech projects much earlier than many teams expect. Not when writing the final report, but at the moment the first measurement is documented.

Regulators do not only assess the outcome of a preclinical study, but above all whether the research question, execution, data basis and documentation are robust and usable for the respective regulatory context. The key audit question is rarely “Did you apply GLP?”. It is: “Can you demonstrate what was done, when, why and who was responsible?”

This article shows which 10 core elements of GLP practices auditors actually assess, where the biggest gaps arise in practice, when a structured GLP-like approach is sufficient and when it is not. Good Laboratory Practice (GLP) principles provide the regulatory benchmark.

Note on this article series: This article answers the operational question of what exactly needs to be implemented once a team has decided on a GLP-like approach. The upstream strategic question of whether GLP or GLP-like is the right choice, when GLP becomes regulatorily mandatory and what both approaches cost is covered in the article GLP vs. “GLP-like” in MedTech studies. Both articles complement each other: strategy there, operational implementation here.

GLP-aligned practices: What authorities actually assess in preclinical reports

From a regulatory perspective, the real question is not: “Was the result positive?” It is: Can this evidence be used reliably for a regulatory decision?

Authorities such as the FDA or Notified Bodies under the EU MDR (Medical Device Regulation) assess the logic behind how a report was created. In practice, auditors work along an evidence logic with four blocks:

• Was the study meaningfully defined in advance?
• Are execution and data flow controlled?
• Were deviations transparently evaluated?
• Can the study be reconstructed later?

Teams that establish these four elements properly have often already answered the toughest questions. This is particularly relevant for medical device development (MedTech): preclinical data feed into technical documentation, support internal decisions and are often questioned from a regulatory perspective at the same time.

Principle: At their core, GLP and GLP-like principles are trust mechanisms. They ensure that measurements and observations become a robust chain of evidence, starting with the first documented action.

The most common misconception: Good results are enough

Many project teams focus on the quality of the experimental data. Auditors, however, start at the system level: roles, processes, documents. A technically clean experiment with incomplete documentation fails in review just as much as a poorly planned study design.

A strong final report cannot heal missing raw data logic, unclear responsibilities or unevaluated deviations. It can smooth over gaps linguistically, but it cannot close them from a regulatory perspective. Audit readiness begins with planning and design, not with writing the report.

The second misconception concerns GLP-like. The term may sound intentionally informal. In practice, however, it only works if the relevant control points are binding: clean study plan, defined raw data, robust SOPs (standard operating procedures), documented qualification of participants, independent quality assurance (QA), controlled systems, a traceable archiving process.

GLP-like in the MedTech context: not a compromise, but a clear framework

GLP-like is not a formal legal status. It describes a structured approach that reflects relevant GLP principles without claiming formal GLP compliance or a monitored GLP test facility status under nationally implemented OECD GLP principles (Organisation for Economic Co-operation and Development).

Authorities still expect substantive evidence. A GLP-like study must reflect the relevant core elements of GLP practices, even if it does not formally fall under the GLP regime. Where formal GLP applies, compliance is not a one-off exercise but an ongoing demonstration that processes, data and documentation meet regulatory expectations. Those who understand this boundary and build the right structures early avoid subsequent rework and unnecessary follow-up studies.

The 10 GLP-like core elements for audit-ready reports

A practical GLP-aligned approach depends on ten core elements. They translate regulatory expectations into operational checkpoints that can be implemented even without operating under a formally monitored GLP framework. The shared goal: an audit-ready report that withstands regulatory review, regardless of whether the study operates under a formally monitored GLP framework or not. Each of the following core elements directly contributes to the defensibility of the study.

01	Clear research question, endpoints & predefined acceptance criteria Before the study starts, it must be defined in writing which question the study is intended to answer. Predefined endpoints and acceptance criteria form the basis of any defensible evidence and are the first control question for every auditor.
02	Study plan with version management Every GLP-like study begins with a written study plan that was created before the start of the study, not afterward. The plan must be versioned, dated and signed off. Protocol amendments are only permissible if numbered and accompanied by an assessment of their regulatory impact. Anything not captured in the plan may be difficult to defend during an audit.
03	Raw data definition according to ALCOA+ Raw data are all original data from which results are derived, e.g. measurement data, images, calibration records, handwritten notes. They must be created according to the ALCOA+ criteria: A – attributable, L – legible, C – contemporaneously recorded, O – original, A – accurate, as well as complete, consistent, enduring and available. Overwritten Excel files are among the most common serious findings — clearly defined raw data workflows are therefore an indispensable component.
04	Test item characterization & complete sample and material chain Auditors and Notified Bodies assess whether the tested samples are representative of the later marketed product. The report must document material composition, batch traceability and manufacturing history including cleaning and sterilization without gaps. If this documentation is missing, the regulatory usability of the study may be significantly limited.
05	SOPs, equipment calibration & system validation SOPs (standard operating procedures) for study-critical processes must reflect actual practice, not merely exist. All measuring instruments are regularly calibrated and documented in equipment logbooks. Computerized systems additionally require computer system validation (CSV), including software version and audit trails. Many GLP practice concepts address this point too late.
06	Independent quality assurance (QA) Quality assurance reviews the study plan, protocols and final report independently from study conduct. In a GLP-like framework, this function can be commissioned externally. What matters is traceability: Who reviewed what, when and with what result? Without documented evidence of the review steps performed by quality assurance, the report’s audit readiness is often significantly weakened.
07	Study Director, roles & training records Every study needs a named Study Director who signs off the study plan and final report. All participants document education, training and suitability for their specific task with date, SOP content and signature. Who was involved, and were they qualified for their assigned tasks? This question is often among the early checkpoints in audits.
08	Complete deviation documentation & CAPA process (corrective and preventive actions) Deviations from the study plan occur in every study. Auditors expect timely recording, an assessment of regulatory impact and a clear decision: accepted or escalated. Data-relevant deviations must be documented and evaluated; for critical, recurring or systemic causes, a CAPA with a deadline and documented evidence of effectiveness should follow. Open CAPAs at the time of regulatory submission signal systemic documentation problems and invite deeper review.
09	Statistical validity & traceable data analysis Evaluation methods must be scientifically and methodologically appropriate, predefined and documented transparently. This also applies to handling statistical outliers, repetitions and negative results. Anyone who selects statistical methods only after data collection risks being interpreted as post-hoc study design, which is a classic signal for deeper review by regulators.
10	Final report, quality assurance statement, archiving & authority inspection readiness The final report references all primary data, summarizes deviations and documents the CAPA status. The final report is approved by the Study Director. In a formal GLP framework, a documented QA statement is mandatory in the final report. In a GLP-like context, at least a traceably documented, independent quality review should be part of the report. This is followed by access-restricted archiving of all relevant study documents. The specific retention periods should be defined according to the applicable regime, submission context and product type. Audit readiness does not end with the signature; documents must remain readily retrievable.

Graphic: “GLP-aligned evidence chain in the MedTech context”

Where the biggest gaps typically occur

In early MedTech programs, the biggest weaknesses are rarely spectacular errors. They are small gaps in the evidence chain that later have major consequences.

Unclear raw data status

Experimental data exist, but it is not clearly marked as primary data and not properly linked to the analysis. Auditors then cannot understand which data set actually formed the basis for the calculation. In practice, this problem is among the most common and can usually be addressed early with clear raw data rules.

Weak change and deviation management

Changes were made but not documented in a way that later makes clear why they were necessary and what impact they had. Regardless of the experimental quality of the study, missing or incomplete documentation of deviations is among the most common serious findings in preclinical audits.

Informal quality assurance without evidence of review steps

The review may have taken place, but without documented evidence, it cannot be verified. Without evidence of the independence of the review result, the quality assurance review is unlikely to provide meaningful support in an audit. In addition, missing audit trails in computerized systems and insufficiently validated software can become hidden weaknesses that significantly weaken the GLP-aligned evidence chain.

Teams that address these three points early prevent small gaps in the report or audit from becoming structural problems.

Your self-check: the GLP-like evaluation matrix

The 10 core elements can be used directly as a self-check within the project team. Assess each point using a traffic-light system:

• Green = fully present and documented
• Yellow = present, but incomplete or not up to date
• Red = completely missing

Three or more red points are a strong indication that the defensibility of the report in a review, regardless of experimental quality, is significantly reduced. The status of the raw data is particularly critical: Can all primary data be traced back to their origin without gaps and are they clearly linked to the analysis? The earlier these gaps are identified, the less effort remediation usually requires.

Download: The GLP-like evaluation matrix is available as a PDF download and can be used directly within the project team. To the evaluation matrix

When switching to formal GLP makes sense

GLP-like is not a permanent state. There are situations in which switching to formal GLP under OECD principles becomes necessary or strategically appropriate:

• FDA regulatory submission with IDE (Investigational Device Exemption) or PMA (Premarket Approval) requirements
• MDR submissions for high-risk products where safety-relevant animal experimental data play a key role in the regulatory rationale
• Repeated findings in GLP-like reports
• Study partner or contract research organization (CRO) with formal GLP compliance monitoring planned

When data is no longer used only internally but is intended to directly support a regulatory decision, expectations in GLP inspections and external audits increase significantly. A pragmatic GLP-like approach is then often no longer sufficient.

The critical timing for this decision is before the study design is finalized, not afterward. Retrospectively upgrading a GLP-like data set to GLP level is generally not possible. Early project scoping with an experienced regulatory affairs consultant saves considerable time and budget here.

Conclusion

Many MedTech teams discuss the GLP or non-GLP label too early and the real question too late: Is our evidence logic robust?

This is where GLP-aligned practices add value. Those who consistently secure research question, plan, roles, SOPs, training, data integrity, test item, equipment, statistics and archiving create a GLP-like maturity level that bridges early development and later audit readiness and prevents regulatory surprises.

Frequently asked questions about GLP-aligned practices

What is the difference between GLP and GLP-like?

GLP (Good Laboratory Practice) is a formally regulated standard according to OECD principles with regulatory recognition, mandatory independent quality assurance and GLP compliance monitoring of the test facility. GLP-like describes a pragmatic approach that implements the essential structural elements of GLP practices without falling under the formal GLP regime. The key difference lies in the scope of obligations: Formal GLP requires formally monitored GLP test facilities, independent quality assurance and GLP inspections or compliance monitoring. GLP-like, by contrast, implements the substantive core elements but remains below this formal threshold. GLP-like is not a recognized legal term, but it is a common categorization in practice.

Is GLP-like sufficient for submitting relevant data?

For early exploratory work, often yes. For central safety-relevant data, a GLP-like approach is often not sufficient in the long term. This depends on device class, risk level and study type. If there is uncertainty, early clarification with a regulatory affairs consultant or the Notified Body is recommended before the study design is finalized.

What is the most common blind spot in GLP practices?

In most cases, it is not visible documents that are missing, but unclear raw data pathways, informal quality assurance or poorly controlled software systems. Missing audit trails and unclear role permissions significantly weaken the evidence chain without being immediately apparent immediately.

Can missing GLP practices be documented retrospectively at the end of the project?

Partially documented: yes. Fully remediated: no. Audit readiness is created during the study. A strong final report cannot close gaps in raw data logic, responsibilities or deviations from a regulatory perspective.

What does an auditor check first?

In practice, audits begin at the system level: Is the study plan available and signed? Is the Study Director named? Is the deviation documentation complete? Is training documentation available? Only then does the scientific review of the data follow. Those who have set up the system structure cleanly have often already answered the toughest questions.

Do animal studies for medical devices always have to be GLP?

Not every animal study must automatically be conducted fully under GLP. For early phases, GLP-like can be appropriate. For central safety evidence, however, the requirements increase significantly. Early regulatory assessment is recommended here.

Can GLP inspections also affect GLP-like studies?

Formal GLP inspections relate to registered GLP test facilities. Authorities and Notified Bodies can also critically assess GLP-like studies as part of submissions and audits with regard to traceability, documentation and data integrity, and may place very high demands on the usability of the evidence.

Sources & further reading

• OECD Principles of Good Laboratory Practice
• FDA – 21 CFR Part 58
• EMA GLP Compliance Overview
• BASG – Good Laboratory Practice

Status: April 2026 | Last reviewed: April 2026