A GLP compliance statement is per study, not per lab

This blog has already covered how an investigator's brochure has to marshal preclinical evidence into an affirmative case for human exposure, not just disclose what a sponsor happens to know. That post treated the preclinical data as already in hand. 21 CFR Part 58 governs where a meaningful share of that data has to come from in the first place — and it doesn't certify a laboratory once and let every study that follows borrow the label. Good Laboratory Practice attaches to the individual nonclinical study, through a study director and an independent quality assurance unit who each put their own finding into that study's own final report, and a device file that cites “our lab is GLP” instead of pointing to those two findings has cited the wrong thing.

What counts as a nonclinical laboratory study, and what doesn't

Part 58 doesn't reach every test a device program runs before it reaches clinical data. The regulation's own definition of a nonclinical laboratory study covers in vivo or in vitro experiments in which a test article is studied prospectively, under laboratory conditions, to determine its safety or the health effects it produces — work intended to support, or that actually supports, an application FDA will review. It carves out what sits on either side of that boundary by its own terms: basic exploratory work done to see whether a test article has any potential utility at all, or to determine its physical or chemical characteristics, isn't a nonclinical laboratory study under the rule, and neither is a study that actually uses human subjects, which sits under clinical regulations entirely. A device program that runs every bench and animal test as if GLP applied uniformly is imposing a burden the regulation itself doesn't extend to exploratory work; a program that assumes GLP never touches bench testing at all is just as likely to be wrong about the specific safety studies that do fall inside the line.

The finding belongs to two named roles, not the building

Where Part 58 does apply, its accountability doesn't run through a facility's own certificate. 21 CFR 58.33 makes the study director personally responsible for the overall technical conduct of the study and for its interpretation, analysis, and reporting. 58.35 requires a quality assurance unit, functionally and organizationally separate from the people actually running the study, to inspect the work at intervals adequate to assure the study's integrity and to report its findings, in writing, directly to management and the study director. Neither role is a formality layered on top of the real work — the QAU's independence is the entire mechanism, and a lab that lets the same staff who ran the study sign off on its own compliance has broken the structure Part 58 is actually built around, regardless of what the facility calls itself elsewhere.

The protocol commits the study before the data exists

58.120 requires a written protocol before a nonclinical laboratory study begins, naming the objectives, the test and control articles, the test system, the dosage and route of administration, the type and frequency of tests, and the statistical methods that will be used to evaluate the results. Amendments have to be documented and justified with the same discipline. A study can't retroactively acquire a GLP-compliant protocol once results look favorable enough to submit — the record has to show the plan existed, in that form, before the work started, and that any departure from it was itself a documented decision rather than an undocumented convenience.

The final report has to carry a statement, not just numbers

58.185 sets what a study's final report has to include, and one requirement does the work most device files skip past: the report has to carry the quality assurance unit's own statement of the extent to which the study complied with Part 58 — not a blanket assertion that the lab is generally GLP-certified, but a specific finding tied to that study's own protocol, dates, and conduct. The study director signs and dates the completed report. A device submission that attaches a summary of results without that underlying statement has handed over data without the one document Part 58 actually built the reporting requirement around.

Noncompliance has a named consequence, not just a caveat

FDA can disqualify a testing facility under 58.202 through 58.219 where it finds noncompliance serious enough to affect the validity of the facility's studies, and data from a disqualified facility's studies can be excluded from FDA's own review entirely, not just discounted. That's the leverage the compliance statement is actually protecting: this blog has already covered how an investigator's brochure has to turn preclinical evidence into a case for human exposure, and a case built on a study whose own compliance statement doesn't hold up isn't a case at all — it's data FDA has grounds to set aside before the argument built on it is even read.

Where this meets the file

A nonclinical study file needs to carry the GLP applicability call for each individual study — safety-directed or exploratory, in scope or out — separately from the protocol, the study director's report, and the QAU's own compliance statement, rather than one blanket line asserting the performing lab is GLP-accredited. A GLP study-tracking worksheet built around that structure, alongside the biological evaluation plan that decides which biocompatibility endpoints a device's nonclinical testing actually has to cover, is previewed in the launch catalog. If your program tracks GLP applicability differently, the shelf takes that correction directly.