Compliance in the GxP context means regulatory compliance: the demonstrable adherence to applicable laws, regulatory requirements, approved documents, protocols and quality-relevant procedures. It is not a single work step, but a state that is continuously established and reviewed through appropriate processes, responsibilities and evidence.
Regulatory compliance in the GxP context
Which requirements apply depends on the activity and product lifecycle. GMP applies in particular to manufacturing and quality control, GCP to the planning and conduct of clinical trials, GLP to nonclinical safety studies, GDP to distribution and GVP to pharmacovigilance. Compliance requires not only knowledge of these sets of rules, but also their implementation in binding workflows, training, documentation and effective oversight.
In clinical trials, regulatory compliance means, for example, adhering to the approved protocol, informed consent requirements, GCP and the applicable regulatory requirements. ICH E6(R3) requires trial processes to comply with the protocol, related documents, regulatory requirements and ethical standards. Regulation (EU) No 536/2014 requires clinical trials to be conducted in accordance with the principles of good clinical practice.
Evidence, oversight and responsibility
Compliance becomes visible through a robust documentation chain. SOPs translate requirements into procedures; qualification and training records demonstrate competence; protocols, records and audit trails enable the reconstruction of decisions and activities. Monitoring, quality controls, audits and inspections examine different sections of this chain. However, passing an inspection is not a lasting guarantee of compliance if processes or risks change.
Tasks may be transferred to service providers, but responsibility remains with the sponsor or manufacturer, as applicable, and with the respective responsible party. ICH E6(R3) requires clear agreements on roles, activities and responsibilities, as well as appropriate oversight of delegated work. A quality management system provides the structure in which deviations are identified, assessed and addressed through CAPA. It does not replace substantive compliance with the rules.
Distinction from adherence and from roles
Outside the GxP context, compliance has a second, commonly used medical meaning: it may refer to adherence, that is, the extent to which a patient follows an agreed treatment. This adherence concerns behavior in everyday therapy. The term compliance as described here, by contrast, refers to the regulatory compliance of organizations, processes, systems and trial activities.
Compliance is also not the name of a specific function or person. A person responsible for compliance with regulatory requirements may perform defined tasks to ensure conformity. The term itself, however, refers to the achieved or intended state of adherence to the rules. Likewise, GxP is not this state, but the family of quality frameworks against which compliance is measured.
Noncompliance can impair the rights and safety of participants, data reliability or product quality. Its significance is assessed on a risk-based basis. In the case of critical problems, formal additions or an isolated correction are often insufficient. Root cause analysis, appropriate corrective and preventive actions, and an effectiveness check are required so that compliance can be restored and stabilized.
An effective compliance approach is therefore preventive: requirements are incorporated at an early stage into trial planning, supplier oversight, system selection and process design. ICH Q9 makes clear that quality risk management does not remove the regulatory obligation to comply. Risk-based approaches determine the appropriate extent of control and documentation, not the applicability of the requirements.
Compliance requires a current assessment of applicable requirements. New or amended requirements must be incorporated into documents, systems and qualifications before they affect operational activities. This includes a traceable assessment of the change, clear responsibility for implementation and a review of whether the controls introduced are effective. Where requirements conflict or are unclear, a reasoned professional decision is required. Compliance therefore does not mean mechanically checking off texts, but implementing the requirement correctly, promptly and demonstrably in the specific process. The quality of records is particularly important because they provide auditors and authorities with evidence of what was actually done.
In compliance evidence, the applicable requirement, its implementation in the procedure, responsibilities and evidence of actual adherence must be clearly linked. In the event of regulatory changes, the implementation assessment and controlled introduction document that processes, training and systems continue to meet the applicable requirements.
Relevance for clinical trials
In day-to-day trial operations, compliance is evident at many interfaces: correct informed consent, qualified trial sites, protocol-compliant data collection, timely safety processes and controlled systems. Audits and inspections assess not only individual documents, but also whether the underlying processes function reliably. Particularly high-risk areas include unclear delegations, delayed escalations and evidence that does not reflect the actual course of events.
Full-service CROs such as Mediconomics support the implementation of GCP requirements through training and documentation concepts, monitoring, data management, pharmacovigilance, audit support and CAPA management. In coordination with the sponsor, they can clarify responsibilities at interfaces and track quality-relevant risks throughout the trial lifecycle.
Frequently Asked Questions (FAQ)
Does compliance always mean adherence to treatment?
No. In healthcare, it may mean adherence to treatment. In the GxP context, compliance refers to the regulatory compliance of organizations, processes and activities.
Is compliance the same as GxP?
No. GxP refers to the family of quality frameworks. Compliance describes adherence to the applicable rules and requirements in each case.
Can compliance be delegated to a CRO?
Activities may be delegated. The responsible party must clearly define roles and appropriately oversee the delegated activities.
Regulatory references
- Regulation (EU) No 536/2014 – establishes the principles of good clinical practice for clinical trials.
- ICH E6(R3) Good Clinical Practice – specifies requirements for quality management, delegation and compliance of trials.
- ICH Q9 Quality Risk Management – explains the risk-based approach without removing regulatory obligations.