GLP vs GMP vs ISO 17025: What Small Labs Actually Need

Choosing between GLP, GMP, and ISO 17025 is one of the most consequential decisions a small lab makes—it dictates your SOP structure, record retention policy, equipment qualification requirements, and which auditors will show up at your door.

Why the Three Frameworks Exist and Who Enforces Them

Each framework was written to solve a different problem for a different audience, which is why their requirements diverge even when the underlying lab work looks identical.

Good Laboratory Practice (GLP) originated in the 1970s after the Industrial Bio-Test Laboratories scandal, in which fabricated toxicology data supported pesticide registrations. The FDA's GLP regulations (21 CFR Part 58) and the OECD Principles of GLP (OECD Series on Principles of GLP, ENV/MC/CHEM(98)17) were written specifically for non-clinical safety studies submitted to regulatory agencies. The enforcers are the FDA (for studies submitted to support drug, device, or pesticide applications in the US) and national monitoring authorities in OECD member countries.

Good Manufacturing Practice (GMP), codified in 21 CFR Parts 210/211 for pharmaceuticals and 21 CFR Part 117 for food, governs production environments. Laboratories operating within a GMP facility—QC labs testing in-process samples, finished product, raw materials, or stability samples—fall under GMP by extension. The laboratory-specific requirements live in 21 CFR 211.160–211.194. Enforcement is via FDA inspection; for EU-regulated product, EudraLex Volume 4 Annex 11 and Chapter 6 apply.

ISO/IEC 17025:2017 is a voluntary international standard administered through accreditation bodies (A2LA, NVLAP, ILAC-MRA signatories). It defines competence requirements for testing and calibration laboratories. Unlike GLP or GMP, conformance is demonstrated by third-party technical assessment, not regulatory inspection. The standard is organized around two principle clusters: management requirements (Clauses 8.1–8.9) and technical/metrological requirements (Clauses 6.1–7.11).

The Core Technical Differences That Affect Day-to-Day Lab Operations

At the bench level, the differences feel abstract until you trace them through specific requirements.

Study Director vs. Quality Unit vs. Technical Manager

Under 21 CFR Part 58, every GLP study must have a designated Study Director who holds single-point scientific control and signs the final report. The Quality Assurance Unit (QAU) is organizationally independent and performs scheduled and unscheduled inspections of the study and the final report.

GMP places authority in the Quality Unit (21 CFR 211.22), which must approve or reject materials, review production records, and release or reject finished product. There is no concept of a single study director; batch record review is a standing function, not a study-specific one.

ISO 17025 Clause 5.2 requires a Technical Manager and a Quality Manager (or one person performing both roles in smaller labs), but the standard does not prescribe organizational hierarchy beyond ensuring freedom from commercial pressure on technical judgments (Clause 4.1.4).

Raw Data and Record Retention

GLP: Raw data must be retained for the period specified by the regulatory authority receiving the study—typically the lifetime of the regulatory submission plus two years (OECD Principles, Section 10). All handwritten entries require a single line through errors, a correction, the reason, and the initials and date of the person making the correction. Electronic raw data is governed by 21 CFR Part 11.

GMP: The retention period for laboratory records is the shelf life of the batch plus one year, or one year after the expiry date—whichever is longer (21 CFR 211.180(a)). Complete data integrity requirements for computerized systems are addressed in FDA's 2018 Data Integrity guidance and the EMA's 2018 reflection paper.

ISO 17025: Clause 7.5 requires that records be retained long enough to meet contractual and legal obligations, with a minimum typically defined by the accreditation body or customer contracts. The standard emphasizes traceability of results back to raw observations but does not specify a retention period numerically.

Method Validation Requirements

This is where small labs feel the most friction.

• GLP (21 CFR 58.113): Analytical methods used in GLP studies must be validated and the validation data included in or referenced by the study report. The scope mirrors ICH Q2(R2) expectations—specificity, accuracy, precision, linearity, range, LOD, LOQ.
• GMP (21 CFR 211.165(e)): Methods must be validated to demonstrate suitability under actual conditions of use. USP <1225> defines categories of analytical methods and the required characteristics for each. Compendial methods require verification, not full validation.
• ISO 17025 (Clause 7.2): Non-standard methods, laboratory-developed methods, and methods used outside their intended scope require validation. The standard requires that the laboratory confirm it can properly perform standard methods before introducing them (Clause 7.2.2, termed "verification"). Measurement uncertainty (Clause 7.6) must be estimated for all results—a requirement with no direct parallel in GLP or GMP.

Overlapping Zones: Where the Frameworks Converge

Despite distinct origins, all three frameworks share a set of requirements that map onto each other closely enough that building a single compliant process often satisfies two or all three.

Requirement area	GLP (21 CFR 58)	GMP (21 CFR 211)	ISO 17025:2017
Equipment calibration	§58.63	§211.68	Clause 6.4
Personnel training records	§58.29	§211.68	Clause 6.2
SOP documentation	§58.81	§211.100	Clause 8.2
OOS/deviation handling	§58.35 (QAU)	§211.192	Clause 7.10
Environmental monitoring	§58.51	§211.42	Clause 6.3

For a contract lab that tests both GMP pharmaceutical samples and non-GMP food matrices, this overlap means a single document control system, a single training matrix, and a shared equipment calibration program can underpin both regulatory regimes—provided the procedures explicitly reference both sets of requirements.

Concrete Scenario: A 12-Person Environmental Testing Lab

Consider Meridian Analytical, a fictional 12-person lab in the Midwest that tests drinking water for municipal clients and environmental compliance samples for industrial facilities. They have pursued ISO/IEC 17025 accreditation through A2LA.

When a client submits a PFAS panel, the lab's ISO 17025 Clause 7.5 obligation requires that every raw instrument output—every chromatogram—be retained and linked to the sample record. Their LIMS flags any result outside the reportable range defined in EPA Method 533 as a nonconformance (Clause 7.10.1), triggering a documented investigation before the result appears on the COA.

If this same lab were asked to perform a GLP ecotoxicology study for a pesticide registrant, they would need to designate a Study Director, establish a QAU, and restructure their archive to meet 21 CFR 58.190. Their existing ISO 17025 infrastructure covers equipment and personnel—but the organizational overlay of GLP would require new SOPs, new roles, and a separate archive function. Many small labs conclude this is not worth the investment unless GLP work represents a sustainable revenue stream.

This scenario illustrates why the decision is not purely technical. It involves personnel overhead, infrastructure cost, and market positioning.

Selecting the Right Framework for Your Lab's Work

The selection logic is largely dictated by who is receiving your data and for what regulatory purpose.

Choose GLP if: Your customers are submitting non-clinical safety studies to FDA, EPA, or an OECD-member national authority. Contract research organizations (CROs) supporting pharmaceutical or agrochemical development fall here. There is no option—the receiving agency requires it.

Choose GMP if: You are operating within or as a contract laboratory for a pharmaceutical, biologic, dietary supplement, or food manufacturer subject to FDA or EMA oversight. GMP is mandatory for QC laboratories releasing product to market in regulated industries.

Choose ISO 17025 if: Your primary customers are requesting accredited test reports—environmental regulators, commercial clients, government tenders, or international trade. ISO 17025 is the global baseline for laboratory technical competence and is recognized under ILAC mutual recognition arrangements in 100+ economies.

You may need more than one if your lab services clients across sectors. A cannabis testing laboratory, for example, may need ISO 17025 accreditation to satisfy state regulators and simultaneously operate under state-specific GMP-equivalent rules for licensed producers. A pharmaceutical contract lab may hold ISO 17025 accreditation for its reference standard characterization work while operating its QC release testing under 21 CFR Part 211.

Building Infrastructure That Scales Across Frameworks

For small labs, the strategic approach is to build to the most demanding applicable requirement in each category, then verify the less demanding requirements are a subset.

Document Control

ISO 17025 Clause 8.3, 21 CFR 211.100, and 21 CFR 58.81 all require documented procedures, version control, and retention of superseded versions. Build a document control SOP that satisfies all three simultaneously: controlled numbering, approval signatures (or electronic equivalents with 21 CFR Part 11 compliance), defined review cycles, and secure archiving of prior versions.

Sample and Aliquot Tracking

GMP 21 CFR 211.188 requires complete batch production records traceable to each sample tested. GLP §58.105 requires the study report to reference all specimens. ISO 17025 Clause 7.4 requires chain of custody from receipt through disposal. A sample tracking system that records receipt condition, assigns unique identifiers, tracks sub-sampling (aliquoting), and logs every transfer and test event satisfies all three. This is precisely where a LIMS like Aliquora adds structural value—every aliquot action, OOS flag, and disposition decision generates a timestamped, user-attributed audit trail that can be exported to satisfy any of these regimes without rekeying data.

Out-of-Specification Handling

GMP: FDA's 2006 OOS guidance requires a Phase I laboratory investigation (instrument function, analyst error, calculation error) before expanding to a Phase II full-scale investigation. Results cannot be averaged away; invalidation requires documented assignable cause.

ISO 17025 Clause 7.10 (nonconforming work) requires that work be stopped when a nonconformance is detected, the impact assessed, and corrective action evaluated. It does not prescribe Phase I/II language but the technical intent is equivalent.

GLP §58.35 requires the QAU to report deviations to the Study Director immediately and to management upon completion of the study.

A single OOS/nonconforming result SOP can address all three if it includes: initial laboratory investigation, root cause classification, impact assessment, CAPA trigger criteria, and management notification thresholds.

Audit Trail and Data Integrity Requirements Compared

All three frameworks now converge on ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available). The difference is in how enforcement plays out.

FDA inspectors arriving for a GMP inspection will pull audit trail reports from your LIMS or instrument software and look for backdated entries, deleted records, and shared login credentials. EIR observations (Form 483 items) for data integrity failures in laboratory systems are among the most cited in recent FDA inspection data.

ISO 17025 technical assessors review audit trails during initial accreditation and surveillance assessments. Clause 7.11 (management of data and information) explicitly requires that the LIMS protect data from unauthorized access, tampering, and inadvertent loss. Assessors will request evidence that audit trail review is part of routine QA activity, not just something performed before the assessment.

GLP inspectors focus on the integrity of the raw data archive and the QAU inspection records. The expectation under OECD Principles Section 10 is that the archive is physically and electronically secured, with access logs.

The practical implication: a system that generates immutable, user-attributed, timestamped audit trails—and that has a documented procedure for reviewing those trails on a defined schedule—will satisfy all three frameworks without customization.

Frequently Asked Questions

Does ISO 17025 accreditation satisfy GMP laboratory requirements?

No. ISO 17025 and GMP are parallel frameworks with different scopes and enforcement mechanisms. Accreditation demonstrates technical competence to an international standard, but it does not substitute for the organizational and procedural requirements of 21 CFR Parts 210/211 that FDA inspectors assess. Some elements overlap, but a pharmaceutical QC lab must comply with GMP regardless of its accreditation status.

Can a small lab be compliant with both GLP and ISO 17025 simultaneously?

Yes, but it requires deliberate infrastructure design. The study-director and QAU model of GLP imposes organizational requirements that ISO 17025 does not, so maintaining both means layering GLP-specific roles and records onto an ISO 17025 management system. Labs that do this successfully maintain separate study archives under GLP while running their general testing under ISO 17025 accreditation.

What does ISO 17025 Clause 7.6 require regarding measurement uncertainty, and do GMP labs need it?

Clause 7.6 requires that testing laboratories estimate measurement uncertainty for all test results and include uncertainty statements in reports when relevant. GMP regulations (21 CFR 211) do not explicitly mandate measurement uncertainty estimation in the same terms, though FDA's process validation guidance and ICH Q2(R2) address intermediate precision and reproducibility. Labs transitioning from a GMP-only background to ISO 17025 often find measurement uncertainty estimation the most technically demanding new requirement.

Which framework is most likely to be required if I want to test cannabis or hemp products?

State cannabis testing regulations in the US most commonly mandate ISO/IEC 17025 accreditation, often with additional state-specific requirements layered on top. GMP requirements may apply separately if the lab or its clients are subject to FDA oversight under the 2018 Farm Bill or emerging FDA cannabis regulations. GLP is not typically required for cannabis testing unless the work supports a formal regulatory submission.

How long must laboratory records be retained under each framework?

Retention periods vary: GLP records must be retained for the period specified by the receiving regulatory authority, typically the life of the regulatory submission plus two years. GMP records (21 CFR 211.180) must be retained for at least one year after the expiration date of the batch, or one year after distribution, whichever is longer. ISO 17025 requires retention sufficient to meet legal, contractual, and accreditation body obligations—practically, three to five years is common, but check your specific accreditation body's supplemental requirements.