Nonclinical/preclinical toxicology and pharmacology study requirements — for companies running their own preclinical labs.
21 CFR Part 58 Audit-Readiness Rubric — Regscribe v0
(US Good Laboratory Practice for Nonclinical Laboratory Studies)
This is distinct from the Part 11 and Parts 210/211 rubrics. Part 58 governs the nonclinical (preclinical) safety studies — toxicology and safety pharmacology — that support an IND, NDA, or BLA submission to FDA. It does not cover clinical trials (governed by 21 CFR Parts 50/56/312 — GCP, not GLP) and it does not cover efficacy/pharmacodynamic screening studies, which are not GLP-covered even when run in the same lab. Part 58 is also structurally distinct from CGMP: it introduces two concepts that have no Part 211 analogue — a single, personally-accountable Study Director, and a Quality Assurance Unit (QAU) that must be organizationally independent of the study team, not merely a separate department. A document-analysis pass on a nonclinical study report should treat "was there a Study Director with documented authority" and "did an independent QAU actually inspect this study" as the two highest-value binary gates before scoring anything else.
Sources used
Regulatory text (structure, section numbers, section titles):
- eCFR.gov direct fetch was not attempted this session given the established pattern (blocked/bot-checked) from the Part 11 and 210/211 rubric sessions.
- Structure/section-title extraction succeeded cleanly from two independent sources that agreed with each other:
- GovInfo.gov CFR XML — fetched via
govinfo.gov/content/pkg/CFR-2023-title21-vol1/xml/CFR-2023-title21-vol1-part58.xml (the official U.S. Government Publishing Office codification), which returned full subpart/section titles and requirement-level text summaries.
- Cornell Legal Information Institute — 21 CFR Part 58, which independently confirmed the subpart letter/section-range structure (Subparts A–G, J, K; Subparts H–I reserved/not used).
- Cross-check: no discrepancies found between the two sources on subpart structure or section numbering.
- Note on subpart lettering: Part 58 skips Subparts H and I (reserved, never populated) and jumps from Subpart G (Protocol/Conduct) to Subpart J (Records and Reports). This is a real gap in the CFR's own numbering, not a fetch error — confirmed identically by both sources.
- Part 58's core structure dates to the original 1978 final rule (effective June 1979) with amendments in 1987; no evidence surfaced this session of a recent structural overhaul, but — unlike the 210/211 rubric, where decades of stability could be asserted with confidence — this session did not independently verify the current-as-of-2026 text against a dated eCFR snapshot, only against the govinfo.gov XML (undated vintage in the fetch, filename suggests a 2023 codification cycle). Flagged as a residual currency risk below.
Enforcement / failure-pattern data:
- WebSearch was unavailable this session (quota exhausted, 200/200) — all lookups used WebFetch directly against known/guessed URLs, per instruction.
- This was a materially harder sourcing problem than the 210/211 rubric: CGMP (Part 211) warning letters are common and heavily aggregated by industry sites (qbench.com, redica.com, klyverity.com, gmp-compliance.org); GLP (Part 58) enforcement content is not. Multiple direct attempts failed:
fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters → 404- Two FDA.gov GLP-program landing-page URL guesses → both 404
qbench.com's 2025 470-warning-letter aggregate article was re-fetched and explicitly confirmed (via the fetch tool's own read of the page) to contain zero GLP/Part 58 content — it covers CGMP/device/biologics manufacturing warning letters only, not nonclinical testing facilities.redica.com's GLP-findings blog URL guess → 403 (blocked to automated fetch, consistent with the pattern noted in the 210/211 rubric for some sites)gmp-compliance.org GLP-specific article URL guesses (2 attempts) → both 404- A RAPS.org article URL guess for the Cetero Research data-integrity case → returned a generic search-results page instead of the article, with no Cetero content
- What did work: two well-documented historical GLP fraud/enforcement cases, confirmed via Wikipedia (a tertiary source, flagged accordingly, but one describing well-established public-record facts — congressional hearings and DOJ criminal convictions — not disputed industry commentary):
- Industrial Bio-Test Laboratories (IBT), Northbrook, IL — the case that directly caused Part 58 to be written. FDA/EPA inspections in the mid-1970s found "thousands of safety tests... were either falsely claimed to have been performed or were of such poor quality that police investigators could not determine the extent of the work completed," spanning drugs, pesticides, food additives, and cosmetics. This precipitated FDA's Nov 19, 1976 draft GLP rule and the June 20, 1979 final rule. This is origin-story context, not a "current" failure pattern — flagged as [HISTORICAL] below, used only where it directly illustrates why a specific clause exists (Study Director accountability, QAU independence, raw-data integrity).
- Craven Laboratories, Austin, TX — pesticide-residue/safety-testing data falsification uncovered by EPA in 1991, resulting in a 1991 federal grand jury indictment and Feb 25, 1994 criminal convictions of the lab's president and 14 employees. Important caveat: Craven Labs operated under EPA's FIFRA/TSCA Good Laboratory Practice Standards (40 CFR Part 160), not FDA's 21 CFR Part 58. The two GLP rules are near-identical in structure and intent (both descend from the same mid-1970s scandal), so this is included as a structurally analogous, not directly-on-point failure pattern — flagged as [ANALOGOUS — EPA GLP, not FDA] below, not attributed to Part 58 itself.
- No 2025-2026-dated, named FDA Part 58 warning letter was found or verified this session, in contrast to the 210/211 rubric's ~11 confirmed-real recent letters. This is the single biggest sourcing gap in this document relative to the established rubric standard — see Gaps section.
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern
Failure-pattern cells are marked:
- [HISTORICAL] — a real, confirmed, publicly-documented FDA/DOJ case, but from the founding era of GLP (1970s), used to illustrate why a clause exists rather than as a current enforcement trend.
- [ANALOGOUS — EPA GLP, not FDA] — a real, confirmed case, but prosecuted under EPA's parallel 40 CFR Part 160 GLP rule, not FDA's 21 CFR Part 58. Structurally on-point (same clause concepts) but not evidence of FDA Part 58 enforcement specifically.
- [REPRESENTATIVE] — a well-established, textbook-level GLP failure mode described in FDA's own regulatory preamble/guidance language or standard GLP-auditor practice, not tied to a specific named enforcement action verified this session.
- [UNVERIFIED — flagged, not used] — reserved marker; not needed in this document since no unverified claim was retained (anything not independently confirmed was dropped rather than guessed).
PART 58 — Good Laboratory Practice for Nonclinical Laboratory Studies
Subpart A — General Provisions
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 1 | Scope: applies to nonclinical laboratory studies — in vivo/in vitro experiments in which a test article is studied prospectively in a test system under lab conditions to determine its safety (toxicology, safety pharmacology) — that support (or are intended to support) an application for a research/marketing permit (IND, NDA, BLA, 510(k), PMA, food/color additive petition). Efficacy and pharmacodynamic screening studies are explicitly out of scope — GLP governs safety, not efficacy. | 21 CFR 58.1 | N/A — reference/gating section. Use to confirm a given study report is actually GLP-claimed/GLP-required before applying any other row of this rubric — a report that never invokes Part 58 compliance (e.g., an exploratory efficacy study) should not be scored against it. | N/A |
| 2 | Definitions — test article, control article, "nonclinical laboratory study," "sponsor," "testing facility," "study director," "quality assurance unit," "specimen," "raw data" are all defined here and drive downstream scoring (e.g., whether a given document is "raw data" subject to §58.130(e)/§58.185 requirements). | 21 CFR 58.3 | N/A — reference section | N/A |
| 3 | Applicability to studies performed under grants/contracts: a sponsor who contracts out a nonclinical study must notify the contract facility, in writing, that the study must be conducted in compliance with Part 58. | 21 CFR 58.10 | Sponsor-to-CRO (contract research organization) engagement letter or contract clause explicitly invoking GLP/Part 58 compliance | [REPRESENTATIVE] A study run by a CRO with no documented GLP-compliance notification from the sponsor is a common, easy-to-miss gap — the CRO may run "GLP-like" procedures without ever being contractually bound to Part 58, which becomes an issue at FDA inspection/submission review. |
| 4 | Inspection of testing facility: the facility must permit an authorized FDA employee, at reasonable times and in a reasonable manner, to inspect the facility and to have access to and copy all records/specimens required to be maintained regarding a study — refusal to permit inspection may be grounds for FDA to refuse to consider the study in support of an application. | 21 CFR 58.15 | Facility SOP on regulatory-inspection readiness/response; log of any prior FDA inspections and findings | [REPRESENTATIVE] Refusal or excessive delay in producing records during an inspection is treated by FDA as presumptively disqualifying for the study's regulatory reliance, independent of the study's underlying scientific quality. |
Subpart B — Organization and Personnel
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 5 | Personnel engaged in the study must have education, training, and experience (or a combination) to enable them to perform their assigned functions; the facility must maintain current summaries of training/experience/job description for each professional/technical individual. | 21 CFR 58.29(a)-(b) | Personnel training/qualification files; current job-description-to-role mapping; CVs/training logs for study staff | [REPRESENTATIVE] Missing or stale training-summary records (not updated as staff take on new study roles) is a routine, low-severity but frequently-cited gap in GLP audits generally. |
| 6 | Testing facility management must, for each study: designate a Study Director before the study begins; ensure there is a Quality Assurance Unit; ensure test/control article characterization occurs; ensure personnel/resources/facilities/equipment are available as scheduled; ensure deviations from the protocol reported by the QAU are communicated to the Study Director and corrective action is documented; and ensure the Study Director has appropriate qualifications/training. Management must also, if a Study Director is replaced during a study, document the replacement. | 21 CFR 58.31(a)-(f) | Study Director designation memo/letter with date; management-level SOP on Study Director appointment and replacement; QAU-existence/charter document | [REPRESENTATIVE] A Study Director appointment made retroactively (i.e., dated after study initiation, or missing entirely) is one of the single most fundamental GLP gaps an inspector or document-analysis tool can catch — it's a bright-line, low-ambiguity check. |
| 7 | Study Director: a single, appropriately qualified individual has overall responsibility for the technical conduct of the nonclinical laboratory study, as well as for its overall interpretation, analysis, documentation, and reporting of results — this is the distinctive GLP concept with no direct Parts 210/211 analogue (Part 211's closest equivalent, the QCU, is a unit with disposition authority, not a single accountable scientist-in-charge of study conduct). The Study Director must ensure the protocol (including approved changes) is followed, all experimental data are accurately recorded/verified, unforeseen circumstances affecting quality/integrity are noted and corrective action taken and documented, test systems are as specified in the protocol, and all applicable GLP regulations are followed. | 21 CFR 58.33(a)-(b) | Study Director designation record naming one specific individual (not a committee/rotating role); Study Director's signature/date on the protocol and final report; documented corrective-action records bearing the Study Director's authorization | [HISTORICAL] The absence of a single accountable Study Director — responsibility diffused across a lab or unsupervised technical staff — is precisely the organizational failure mode that the 1970s Industrial Bio-Test Laboratories (IBT) scandal exposed: studies were "falsely claimed to have been performed" with no single individual answerable for the study's actual technical conduct, which directly motivated this clause's inclusion in the original 1979 GLP final rule. |
| 8 | Quality Assurance Unit (QAU): a unit (which may be one or more individuals) responsible for monitoring each study to assure management that the facilities/equipment/personnel/methods/practices/records/controls conform to Part 58, and that this unit is "entirely separate from and independent of the personnel engaged in the direction and conduct of that study." The QAU must maintain a master schedule of all studies, maintain copies of all protocols, inspect each study at intervals adequate to ensure integrity (with written/dated inspection records), submit periodic status reports to management/Study Director, determine no deviations were made from approved protocols/SOPs without proper authorization/documentation, review the final report to confirm it accurately describes methods/procedures and reflects raw data, and prepare/sign a QA statement in the final report specifying inspection dates and dates findings were reported. | 21 CFR 58.35(a)-(c) | QAU organizational chart showing reporting line outside the study-conduct chain of command (e.g., QAU reports to a compliance/quality executive, not to the Study Director or head of the testing lab); QAU master study schedule; dated QAU inspection reports for the specific study; the QA statement embedded in the final report | [HISTORICAL] QAU independence is the single clause with the most direct causal link to the scandal that created Part 58 — IBT had no functionally independent quality-review layer separating study-execution staff from compliance oversight, and the resulting congressional pressure is what produced this "entirely separate from and independent of" language verbatim in the 1979 rule. [REPRESENTATIVE, current] A QAU that reports up through the same head of toxicology/study-conduct management it is meant to police is a "independence-in-name-only" pattern that GLP auditors treat as a structural finding regardless of whether any individual study shows a specific error — this is the GLP equivalent of the CGMP QCU-independence findings documented in the companion 210/211 rubric (§211.22), and should be scored the same way: check the actual reporting line, not just the org-chart label. |
Subpart C — Facilities
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 9 | General: testing facility must be of suitable size/construction to facilitate the proper conduct of studies, with adequate separation of areas to prevent any function/activity from having an adverse effect on the study. | 21 CFR 58.41 | Facility layout/floor-plan documentation showing functional separation | [REPRESENTATIVE] |
| 10 | Animal care facilities: sufficient separate space/rooms to ensure isolation of species/test systems, isolation of individual projects, quarantine of newly received animals, and isolation of animals known/suspected to be diseased (with appropriate disease-control measures). | 21 CFR 58.43(a)-(c) | Vivarium floor plan showing quarantine/isolation rooms; animal-receipt and quarantine logs | [REPRESENTATIVE] Housing test-system animals from concurrently running studies in the same room without documented species/project isolation is a classic contamination/cross-study-influence risk flagged in GLP facility audits. |
| 11 | Animal supply facilities: separate storage areas for feed/bedding/supplies, with protection against infestation/contamination, and separate from areas housing test systems. | 21 CFR 58.45(a)-(b) | Feed/bedding storage area documentation; pest-control records | [REPRESENTATIVE] |
| 12 | Facilities for handling test/control articles: separate areas for (a) receipt/storage of test/control articles, (b) mixing test/control articles with a carrier, and (c) storage of test/control article mixtures, adequate to prevent contamination or mix-up, with storage conditions that preserve identity/strength/purity/stability. | 21 CFR 58.47(a)-(d) | Test-article receiving/storage-area documentation; segregated mixing-area layout; storage-condition monitoring records (temperature/humidity logs) | [REPRESENTATIVE] Test-article and control-article mixtures stored in the same unlabeled refrigerator/cabinet without physical separation is a routine, low-severity but easy-to-catch facility gap. |
| 13 | Laboratory operation areas: adequate separate lab space for the various procedures performed (e.g., necropsy, histopathology, analytical chemistry) to prevent interference between activities. | 21 CFR 58.49 | Lab floor plan showing procedure-specific space allocation | [REPRESENTATIVE] |
| 14 | Specimen and data storage facilities: space provided for archives, limited to authorized personnel access, for storage/retrieval of raw data and specimens from completed studies. | 21 CFR 58.51 | Archive-room access-control log (badge/key records limited to named authorized personnel); archive indexing system | [REPRESENTATIVE] An archive that is physically accessible to general lab staff (not access-controlled to a named, limited list) undermines the raw-data-integrity chain the rest of Part 58 depends on — this is a foundational, not cosmetic, gap. |
Subpart D — Equipment
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 15 | Equipment used in the generation, measurement, or assessment of data, and equipment used for facility environmental control, must be of appropriate design and adequate capacity to function according to the protocol, and must be suitably located for operation, inspection, cleaning, and maintenance. | 21 CFR 58.61 | Equipment inventory with design/capacity specifications mapped to protocol requirements | [REPRESENTATIVE] |
| 16 | Equipment must be adequately inspected, cleaned, and maintained; equipment used for generating/measuring/assessing data must be adequately tested, calibrated, and/or standardized per written SOPs that set forth in sufficient detail the methods, materials, and schedules for these operations, and specify remedial action if a malfunction/deficiency is found. Written records of these activities (including dates) must be maintained, and any unusual occurrence should be noted. Deviations must be recorded. | 21 CFR 58.63(a)-(c) | Equipment maintenance/calibration SOP; per-instrument calibration log with dates and technician identity; documented remedial-action records for out-of-calibration findings | [REPRESENTATIVE] This is Part 58's rough analogue to Part 211's §211.68 equipment/calibration clause; a calibration log with gaps (missed scheduled calibrations, or calibration performed but not documented until much later) is the standard failure pattern GLP auditors and FDA GLP inspectors check first, since out-of-calibration analytical equipment directly undermines the reliability of any safety data generated on it. |
Subpart E — Testing Facilities Operation
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 17 | Standard Operating Procedures (SOPs): a testing facility must have written SOPs setting forth study methods that management is satisfied are adequate, covering (among other things) test/control article handling, animal room preparation, animal care, receipt/id/storage/handling/mixing of test articles, test-system observations, laboratory tests, handling of animals found moribund/dead, necropsy/histopathology, data handling/storage/retrieval, equipment maintenance/calibration, and transfer/proper storage of specimens. A historical file of SOPs and all revisions must be maintained. Significant changes/deviations from an SOP in the conduct of a study must be authorized by the Study Director and documented in the raw data. | 21 CFR 58.81(a)-(d) | Master SOP index with version-control history; Study-Director-signed deviation record tied to specific raw data | [REPRESENTATIVE] Undocumented deviations from an SOP (a technician improvising a procedure without Study Director sign-off, discovered only via inconsistent raw-data entries) is a standard GLP-audit finding — structurally identical to the CGMP "deviation not recorded/justified" pattern under §211.100(b) documented in the companion 210/211 rubric. |
| 18 | Reagents and solutions: must be labeled to indicate identity, titer/concentration, storage requirements, and expiration date; deteriorated or outdated reagents must not be used. | 21 CFR 58.83 | Reagent/solution labeling audit; inventory-management records showing expired-reagent disposal | [REPRESENTATIVE] |
| 19 | Animal care: SOPs must exist for the housing, feeding, handling, and care of animals; newly received animals must be isolated and evaluated for health status; at study initiation animals must be free of disease/conditions that could interfere with study purpose; diseased animals must be isolated/treated or removed per protocol; animals must be uniquely identified when more than one is housed in a cage; food/water must be analyzed for contaminants that could interfere with the study, with results documented. | 21 CFR 58.90(a)-(g) | Animal health-screening/quarantine records; individual-animal identification records; feed/water contaminant-analysis certificates | [REPRESENTATIVE] Feed/water contaminant analysis not documented (or documented but not cross-checked against the study's own endpoints, e.g., a hepatotoxicity study using feed with undocumented hepatotoxic contaminant levels) is a subtle but real GLP finding — it goes directly to whether the study's safety conclusions are confounded. |
Subpart F — Test and Control Articles
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 20 | Test and control article characterization: the identity, strength, purity, and composition (or other characteristics appropriate to define the test/control article) of each batch must be determined and documented before its use in a study; methods of synthesis/fabrication/derivation must be documented by the sponsor or testing facility; the stability of the test/control article must be determined, either before study initiation or concomitantly, per defined SOPs. Each storage container must be labeled with identity, batch/lot number, expiration date (if any), and storage conditions. Reserve samples of each batch must be retained for studies lasting more than four weeks. | 21 CFR 58.105(a)-(f) | Certificate of Analysis (identity/strength/purity/composition) for the specific batch used; stability-study data/protocol referenced in the final report; reserve-sample retention log for studies >4 weeks | [REPRESENTATIVE] This is arguably Part 58's single highest document-analysis-value clause: a final study report that references a test article by name/lot but does not attach or cross-reference a batch-specific identity/strength/purity/stability determination is a fundamental, easily-automatable gap check — the study's safety conclusions are only as reliable as the certainty about what was actually administered. |
| 21 | Test and control article handling: procedures must be established for the receipt, distribution, and use of test/control articles to ensure proper storage, distribution that precludes contamination/deterioration/damage, and proper identification is maintained throughout the distribution process; the date and quantity of each batch received/dispensed, and the name of the individual who performed the receipt/dispensing, must be documented. | 21 CFR 58.107(a)-(d) | Test-article chain-of-custody log (receipt date, quantity, dispensing date/quantity, responsible individual) | [REPRESENTATIVE] Gaps in the chain-of-custody log (missing dispensing dates, no named responsible individual) undermine the ability to reconstruct exactly what dose was administered to which animal cohort on which date — a recurring GLP-audit finding. |
| 22 | Mixtures of articles with carriers: for test/control articles mixed with a carrier, tests must be conducted to determine the uniformity of the mixture and to determine, periodically, the concentration of the test/control article in the mixture; the stability of the test/control article in the mixture must be determined before study initiation, or concomitantly per SOPs; where any component has an expiration date, that date (or the earliest applicable date if multiple components) must be applied to the mixture. | 21 CFR 58.113(a)-(c) | Mixture-uniformity/homogeneity test data; periodic concentration-verification (e.g., dosing-formulation analysis) records; expiration-date rollup calculation showing the earliest component date was applied | [REPRESENTATIVE] Dosing-formulation analysis (verifying the actual administered concentration matches the nominal/intended concentration) is one of the most frequently deficient areas in toxicology-study GLP audits generally — a study can be perfectly conducted in every other respect and still be unreliable if the animals were never actually dosed at the concentration the report claims. |
Subpart G — Protocol for and Conduct of a Nonclinical Laboratory Study
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 23 | Protocol: each study must have an approved written protocol that clearly indicates the objectives and all methods for the conduct of the study, and must contain (at minimum): a descriptive title and statement of purpose; identification of the test/control article; the sponsor's name/address and the name/address of the testing facility; the number, body weight range, sex, source, species, strain, substrain, and age of the test system; the procedure for identification of the test system; a description of the experimental design including methods for control of bias; a description/rationale of the dosage/dose-conversion-factor used; the type and frequency of tests/analyses/measurements; the records to be maintained; the proposed statistical methods; and dates of approval by the sponsor and the Study Director's dated signature. The protocol must be approved (Study-Director-signed and dated) before the study begins. | 21 CFR 58.120(a)-(b) | The approved protocol document itself, bearing the Study Director's signature/date preceding the recorded study-start date; protocol amendment log for any changes made during conduct | [REPRESENTATIVE] A protocol signed/dated after the study's actual start date (a retroactive approval) is one of the most bright-line, high-severity GLP findings — it is the temporal equivalent of the CGMP "master batch record executed before batch production" requirement, but arguably more consequential here because the protocol is what defines what "compliance" even means for that specific study. Document-analysis tooling should flag any protocol-approval date that is on or after the first recorded raw-data entry date. |
| 24 | Conduct of a nonclinical laboratory study: the study must be conducted in accordance with the protocol; test systems must be monitored per the protocol; specimens must be identified by test system/study/nature/date of collection; such identification must be on the specimen container or accompany it in a manner that precludes error; all data generated during study conduct must be recorded directly, promptly, and legibly in ink; all data entries must be dated on the date of entry and signed/initialed by the person entering the data; any change to an entry must be made so as not to obscure the original entry, must indicate the reason for the change, and must be dated and signed/initialed at the time of the change. | 21 CFR 58.130(a)-(e) | Raw-data pages/lab notebooks/LIMS records showing contemporaneous ink entries, dated and initialed by the recording individual; correction entries showing strikethrough (not obliteration), reason, date, and initials | [REPRESENTATIVE] This is Part 58's version of ALCOA(+) data-integrity principles (Attributable, Legible, Contemporaneous, Original, Accurate) — the specific, distinctive GLP failure mode auditors look for is use of correction fluid/whiteout, overwriting, or backdated entries that obscure the original value, which is treated as a data-integrity red flag rather than a minor documentation lapse, structurally identical to the "obscured original entry" pattern flagged in electronic-record contexts under the companion Part 11 rubric's audit-trail requirements. |
Subparts H & I — Reserved
Not populated in the current CFR structure (confirmed via both GovInfo.gov XML and Cornell LII) — no requirements exist under these subpart letters. No gap-check applicable.
Subpart J — Records and Reports
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 25 | Reporting of nonclinical laboratory study results: a final report must be prepared for each study and must include: name/address of the facility performing the study and dates the study was initiated/completed; objectives and methods stated in the protocol, including any changes; statistical methods employed; test/control article identification and characterization (including stability); stability of the test/control article under conditions of administration; a description of the methods used; a description of the test system (species/strain/etc.); a description of the dosage/dosage-regimen/route/duration; a description of all circumstances that may have affected the quality/integrity of the data; the name of each scientist/professional involved in the study; a description of transformations/calculations/operations performed on the data; the signed/dated reports of each individual scientist/professional involved (e.g., pathologist's report); the locations where all specimens/raw data/final report are to be retained; and a "Quality Assurance Unit" statement listing the dates inspections were made and findings reported to management/Study Director. The final report must be signed and dated by the Study Director. | 21 CFR 58.185(a)-(b) | The final study report itself, checked section-by-section against this list; specifically confirm the embedded QAU statement (dates of inspection + dates reported) and the Study-Director signature/date are present | [HISTORICAL] A final report that narrates a study's conduct in a way inconsistent with, or unsupported by, the underlying raw data — reporting results for procedures that (per the IBT scandal record) "were either falsely claimed to have been performed or were of such poor quality that [investigators] could not determine the extent of the work completed" — is the founding failure mode this entire clause exists to prevent. [REPRESENTATIVE, current] The single most common current-practice gap flagged by GLP auditors is a final report with a boilerplate or missing QAU statement (generic language with no actual inspection dates, or a QAU statement referencing a different study by copy-paste error) — a fast, automatable check for a document-analysis tool. |
| 26 | Storage and retrieval of records and data: all raw data, documentation, protocols, specimens (except those subject to specific decay/degradation, e.g., wet tissue specimens per the SOP), and final reports generated as a result of a nonclinical laboratory study must be retained in an archive; the archive must be designed/maintained to provide orderly storage and expedient retrieval of materials; conditions of storage must minimize deterioration; access to archive materials must be limited to authorized personnel only, and an individual must be identified as responsible for the archives. Material retrieved from the archives must be logged (in/out). | 21 CFR 58.190(a)-(e) | Archive access-control log (authorized-personnel list, named archivist/records custodian); material-retrieval sign-out log | [REPRESENTATIVE] An archive with no designated responsible individual, or one where in/out retrieval isn't logged, breaks the chain of custody needed to demonstrate raw data hasn't been altered post-study — this compounds directly with the §58.130(e) raw-data-entry integrity requirement above. |
| 27 | Retention of records: — the distinctive, long-retention-period clause of Part 58, notably different in structure from Part 211's flat "1 year past expiration / 3 years past distribution" rule. Records/specimens must be retained for whichever of the following periods is shortest: (1) at least 2 years following the date on which an application (NDA, PMA, etc.) relying on the study is approved by FDA; (2) at least 5 years following the date the study results are submitted to FDA in support of an application; or (3) in situations where a study does not result in submission/approval of an application (e.g., a negative/abandoned study, or one never submitted), at least 2 years following the date the study is completed, terminated, or discontinued. Wet specimens, specimens of blood/urine/etc., and other perishable specimens must be retained only as long as the quality of the preparation affords evaluation; correspondence and other documents relating to interpretation/evaluation of data must be retained for whichever period specified above is applicable. Records of QAU inspection dates/findings, personnel qualification/training summaries, and equipment maintenance/calibration records must also be retained for the applicable period(s). If a testing facility goes out of business, all raw data/records must be transferred to the archives of the sponsor(s). | 21 CFR 58.195(a)-(g) | Records-retention schedule explicitly built around the three trigger-events above (approval date / submission date / completion-without-submission date), not a flat calendar rule; documented sponsor-transfer-of-records procedure for facility closure scenarios | [REPRESENTATIVE] Because retention is keyed to submission/approval events that occur years after study completion rather than a fixed post-study clock, a common document-analysis-relevant gap is a retention schedule that was calculated once at study completion and never revisited when the sponsor later submitted (or resubmitted, or received approval for) the application — the true retention trigger date can shift years after the study itself is archived, and an outdated schedule risks premature destruction. This is structurally the single most distinctive record-keeping risk in Part 58 relative to Part 211's simpler flat rule, and worth flagging as a standalone check in Regscribe's scoring logic rather than reusing the 210/211 retention-scoring node as-is. |
Subpart K — Disqualification of Testing Facilities
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 28 | Purpose: disqualification is intended to permit FDA to identify facilities whose noncompliance is so serious that data from the facility can no longer be relied upon; a disqualified facility's studies are presumed unacceptable in support of any application unless the sponsor can establish the study was not affected by the noncompliance. | 21 CFR 58.200 | N/A — reference/consequence section; use to flag maximum-severity risk when scoring a study from a facility with any known disqualification history | N/A |
| 29 | Grounds for disqualification: the FDA Commissioner may disqualify a facility upon finding (1) the facility failed to comply with one or more GLP regulations (in operations affecting the studies at issue), (2) the noncompliance may have affected the validity of nonclinical studies submitted to FDA, and (3) other lesser regulatory actions (e.g., warning letters, individual study rejection) have not been or would not be adequate to correct the noncompliance. | 21 CFR 58.202(a)-(b) | N/A — reference section | [ANALOGOUS — EPA GLP, not FDA] Craven Laboratories' 1991-1994 pesticide-safety-data-falsification case resulted in the equivalent outcome (facility disqualification/criminal conviction) under EPA's parallel 40 CFR Part 160 GLP rule rather than FDA's Part 58 — included here as the clearest real-world illustration of what "noncompliance affecting study validity" looks like in practice, but it is not an FDA Part 58 disqualification precedent and should not be cited as one. |
| 30 | Disqualification procedures, actions upon disqualification, public disclosure, alternative actions, sponsor termination, and reinstatement: FDA must issue written notice proposing disqualification, which triggers a hearing opportunity (per 21 CFR Part 16); if disqualified, existing/pending studies from that facility are reviewed for validity and generally presumed unacceptable; FDA may publicly disclose a disqualification; FDA may take lesser action against individual studies without disqualifying the whole facility; a sponsor voluntarily terminating use of a facility for GLP noncompliance reasons must notify FDA within 15 working days; and a disqualified facility may seek reinstatement by demonstrating corrective action, subject to FDA inspection. | 21 CFR 58.204–58.219 | Sponsor's 15-working-day notification record (if applicable); any facility reinstatement petition + supporting corrective-action evidence | [REPRESENTATIVE] For Regscribe's purposes, the practical, document-analysis-relevant use of this subpart is a pre-screening gate: before scoring a study's substantive GLP compliance, check whether the originating testing facility appears on FDA's public disqualification list (maintained by FDA, not independently re-verified this session — see Gaps below) — a disqualified facility's study is a red flag regardless of how clean the individual document package looks. |
Cross-reference: how Part 58 findings relate to the 210/211 and Part 11 rubrics
| Part 58 concept | Nearest 210/211 (CGMP) analogue | Nearest Part 11 analogue |
|---|
| Study Director (§58.33) — single accountable individual for study conduct | No direct analogue — QCU (§211.22) is a unit with disposition authority, not one accountable scientist | — |
| QAU independence (§58.35) | QCU independence (§211.22(a)) — same "organizationally separate from the operation it polices" principle | — |
| Equipment calibration/maintenance (§58.63) | §211.68(a) equipment calibration | §11.10(a) system validation, if computerized instrumentation is involved |
| Raw-data entry integrity, no-obscured-corrections (§58.130(e)) | §211.194 lab-record completeness | §11.10(e) audit trail — same "don't obscure the original value" principle for electronic records |
| Archive access control (§58.190) | §211.180 record availability/retrievability | §11.10(d) access control |
| Retention keyed to approval/submission events (§58.195) | §211.180(a) flat post-expiration/distribution retention | §11.10(c) record retention |
Recommendation: given how closely the QAU-independence and raw-data-integrity concepts mirror the CGMP QCU and Part 11 audit-trail nodes already modeled in the existing rubrics, extend the same shared "Evidence Type" layer (e.g., add study_director_designation, qau_inspection_report, test_article_characterization as new evidence-type tags alongside the existing audit_trail_config, access_control_matrix) rather than building a fourth parallel evidence taxonomy.
Gaps / follow-ups before this goes into production scoring
- No 2025-2026 FDA Part 58 warning letter was found or verified this session, unlike the 210/211 rubric's ~11 confirmed-real recent CGMP letters. Every attempted source either 404'd, 403'd, or (in qbench.com's case) was confirmed on re-fetch to contain zero GLP content — CGMP enforcement data is heavily aggregated by industry compliance sites, GLP enforcement data apparently is not, at least not at URLs guessable without a working search tool. Recommend a dedicated follow-up session with a working WebSearch budget, targeting specific terms like
"21 CFR 58" warning letter 2025, FDA GLP untitled letter nonclinical, FDA disqualified testing facility list, and "Study Director" OR "quality assurance unit" FDA 483 GLP.
- FDA's official list of disqualified/restricted GLP testing facilities was not located this session (two URL guesses 404'd). FDA does maintain such a list publicly (it is a matter of public record under §58.213), but the correct current URL was not found via direct fetch without search. This is a meaningful gap for Subpart K (row 30) — recommend a follow-up to locate and, if useful, mine this list for named current-era examples to upgrade the Subpart K failure-pattern cell.
- The Craven Laboratories example (row 29) is EPA GLP (40 CFR Part 160), not FDA GLP (21 CFR Part 58) — flagged explicitly in that row and in the Sources section, but worth restating here: do not let this get cited in Regscribe's UI as an "FDA Part 58 enforcement precedent" without the caveat attached. It's real, well-documented, and structurally on-point (near-identical GLP concepts, same causal origin), but it's the wrong regulator.
- The Industrial Bio-Test Laboratories (IBT) case (rows 7, 8, 25) was sourced via Wikipedia, a tertiary source. The underlying facts (congressional hearings, FDA's 1976 draft rule, 1979 final rule) are well-established and uncontroversial, but this session did not independently pull a primary FDA or DOJ document confirming the specific quoted language ("thousands of safety tests... falsely claimed"). Treat the existence and broad outline of the IBT scandal as high-confidence (it's universally cited as the reason GLP exists, including in FDA's own rulemaking history), but the exact quoted phrasing as secondary/tertiary-sourced, not independently verified against a primary FDA/DOJ document this session.
- Regulatory-text currency: the GovInfo.gov XML fetch succeeded and matched Cornell LII's structure, but this session could not confirm the specific codification year/vintage of the govinfo.gov file fetched (URL pattern suggests a 2023 cycle) against a current 2026 eCFR snapshot. Given Part 58's history of infrequent amendment (last substantive change 1987, per general regulatory-history knowledge, not independently re-verified this session), structural currency risk is assessed as low but not zero — flag for a follow-up eCFR cross-check when tooling allows.
- No aggregate frequency/severity table by subpart exists for Part 58, mirroring the same gap noted in the 210/211 rubric for Parts 210/211 — FDA does not appear to publish (or this session could not locate) a GLP-specific "most-cited 483 observation" dataset analogous to CDER's CGMP inspectional-observation frequency reports. If Regscribe wants severity-weighting for Part 58 findings, the Study Director/QAU/protocol-approval-date/test-article-characterization clauses (rows 7, 8, 20, 23) are the ones this session's research converged on as highest-consequence based on regulatory-history and structural-uniqueness grounds, not a citation-frequency dataset — this weighting should be treated as a reasoned default, not an empirically-derived one, until better data surfaces.