Regulatory References
Curated index of primary regulatory sources for GxP quality, data integrity, computer system validation, equipment qualification, and inspection readiness. Organized by jurisdiction. Links go to official sources where available.
This index is a navigation aid, not a substitute for reading the actual documents. Regulatory guidance is updated, always check the current version at the official source. Links are provided for reference; verify currency before citing in quality documentation.
United States, FDA
- 01.01
21 CFR Part 11, Electronic Records; Electronic Signatures
Governs when electronic records may be used in place of paper records under FDA GxP regulations, and the requirements for electronic signatures. Audit trails, system validation, access controls, and signature authentication are the core requirements.
- 01.02
21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals
The GMP regulation for finished drug products. Relevant sections for DI and CSV: §211.68 (automatic, mechanical, electronic equipment), §211.180 (general records retention), §211.188 (batch production records), §211.194 (laboratory records).
- 01.03
21 CFR Part 210, cGMP in Manufacturing, Processing, Packing, or Holding of Drugs
Companion regulation to Part 211. Sets out the definitions and scope of GMP requirements.
- 01.04
FDA Guidance: Data Integrity and Compliance With Drug CGMP, Questions and Answers
The primary FDA guidance on data integrity. Covers ALCOA+ definitions, audit trails, backup, metadata, original records, raw data, true copies, hybrid records, shared accounts, computer access controls, and the "data integrity framework." Referenced in nearly every DI inspection.
- 01.05
FDA Guidance: Guidance for Industry: Part 11, Electronic Records; Electronic Signatures, Scope and Application
Clarifies when Part 11 applies and FDA's risk-based enforcement approach. Introduced the "predicate rule" concept, Part 11 requirements apply when electronic records are used under predicate regulations (Part 211, Part 58, etc.).
- 01.06
FDA Guidance: Computer Software Assurance for Production and Quality System Software
Introduces the FDA's CSA approach: risk-based, intended-use focused, emphasizing critical thinking over documentation volume. Applies to software used for production and quality activities. Supplements but does not replace GAMP 5.
- 01.07
FDA Guidance: Process Validation: General Principles and Practices
Defines the three-stage process validation lifecycle (Process Design, PPQ, Continued Process Verification). The current FDA framework for pharmaceutical manufacturing validation.
- 01.08
FDA Guidance: Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production
The step-by-step FDA framework for OOS investigations: Phase I laboratory investigation, Phase II full investigation, invalidation criteria, and reporting requirements.
- 01.09
FDA Guidance: Submission of Electronic Records in Regulatory Submissions
Guidance on electronic submissions to FDA, electronic record standards, and eCTD format. Relevant to BLA/NDA submissions and data packages.
European Union, EMA / EudraLex
- 02.01
EudraLex Volume 4, EU Guidelines for Good Manufacturing Practice, Annex 11: Computerised Systems
EU GMP requirements for computerized systems in pharmaceutical manufacturing. Covers validation, audit trails, data storage, backup and recovery, access controls, incident management, periodic review, and electronic signatures. The European counterpart to 21 CFR Part 11.
- 02.02
EudraLex Volume 4, EU GMP Annex 15: Qualification and Validation
EU GMP requirements for the qualification lifecycle (DQ, IQ, OQ, PQ), process validation, cleaning validation, change control, and revalidation. The foundational EU document for the validation lifecycle.
- 02.03
EudraLex Volume 4, EU GMP Chapter 4: Documentation
EU GMP documentation requirements: data integrity requirements for paper and electronic records, retention, document control, and the definition of original records and true copies.
- 02.04
EudraLex Volume 4, EU GMP Part II: Basic Requirements for Active Substances Used as Starting Materials
ICH Q7 implemented as EU GMP Part II. Covers API manufacturing with the same data integrity and documentation requirements as finished product manufacturing.
MHRA (UK)
- 03.01
MHRA GxP Data Integrity Guidance and Definitions
One of the most specific and detailed DI guidances available. Covers ALCOA+ in depth, shared accounts, audit trail review, backup, hybrid records, management responsibilities, and what inspectors look for. Widely used alongside FDA guidance even outside UK.
ICH, International Council for Harmonisation
- 04.01
ICH Q10, Pharmaceutical Quality System
Describes a model pharmaceutical quality system applicable across the product lifecycle. Covers quality manual, knowledge management, quality risk management, process performance and product quality monitoring, and CAPA system requirements.
- 04.02
ICH Q9(R1), Quality Risk Management
Provides principles and tools for quality risk management across the pharmaceutical lifecycle. Tools include FMEA, HACCP, and risk ranking/filtering. R1 revision added guidance on subjectivity and human error in risk assessment.
- 04.03
ICH Q2(R2), Validation of Analytical Procedures
Current ICH guideline on method validation parameters: specificity, linearity, range, accuracy, precision, detection limit, quantitation limit, and robustness. R2 updated to address lifecycle approach and modern analytical technologies.
- 04.04
ICH E6(R3), Good Clinical Practice
International standard for designing, conducting, recording, and reporting clinical trials. R3 revision adds risk-based monitoring, electronic records, and proportional oversight principles.
PIC/S, Pharmaceutical Inspection Co-operation Scheme
- 05.01
PIC/S PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments
Comprehensive PIC/S guidance on data management and data integrity. Covers the data governance framework, risk-based approach to DI, ALCOA+ application, computerized systems, paper systems, hybrid systems, and expectations for quality culture. Widely cited alongside FDA and MHRA guidance.
WHO, World Health Organization
- 06.01
WHO TRS 996 Annex 5, Guidance on Good Data and Record Management Practices
WHO guidance on data and record management. Covers data lifecycle, ALCOA principles, computerized systems, data integrity culture, and the responsibilities of management. Widely used as a reference in developing country regulatory contexts.
ISPE / GAMP
- 07.01
GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems, Second Edition
The industry standard framework for GxP computerized system validation. Covers software categorization (Categories 1-5), validation lifecycle, supplier assessment, testing strategies, cloud systems, data integrity, and change control. Published by ISPE. Copyright protected, reference by concept only.
- 07.02
ISPE Baseline Guide: Commissioning and Qualification, Second Edition
ISPE framework for equipment and facility qualification (IQ/OQ/PQ). Covers the lifecycle approach, risk-based qualification, DQ, IQ, OQ, PQ, and integration with process validation. Referenced in EU Annex 15 context.
USP, US Pharmacopeia
- 08.01
USP <1058>, Analytical Instrument Qualification
USP general chapter on the qualification of analytical instruments. Defines four groups of instruments by complexity and sets out qualification activities for each group. Group A (simple), Group B (instruments with measurable performance characteristics), Group C (complex computerized systems).
How to use this index
These sources are the primary regulatory basis for the content on this site. When an article makes a regulatory claim, it references one of these documents. Reading the primary sources, even selectively, is the most effective way to build regulatory knowledge that holds up under scrutiny in an inspection room.
For most GxP professionals, five documents cover 80% of the regulatory framework: FDA DI Q&A (2018), MHRA DI Guidance (2018), 21 CFR Part 11, Annex 11, and GAMP 5 Second Edition. Start there.