# 21 CFR Part 58 (GLP): Final Reports, Archives and Retention

> What 21 CFR Part 58 GLP requires of nonclinical studies: the study director, final report contents, archives and how long records are kept. Checklist CSV.

Canonical: https://origindatapartners.com/guides/21-cfr-part-58-glp
By: Origin Data Partners
Status: Published
Published: 2026-11-13
Updated: 2026-11-14
Sources checked: 2026-11-13

## Quick answer

21 CFR Part 58 is the FDA good laboratory practice (GLP) regulation for nonclinical laboratory studies that support applications for FDA-regulated products. It requires a study director, a quality assurance unit, a final report with 14 listed items, archives for raw data and specimens, and record retention for the shortest of three periods in 58.195(b): 2 years after FDA approval, 5 years after submission, or 2 years after the study ends if it is never submitted.

## Key points

- Part 58 covers nonclinical safety studies supporting FDA applications, not basic exploratory research.
- The study director is the single point of study control and signs the final report.
- The final report must include 14 listed items, from the facility name to the QA statement.
- If a testing facility goes out of business, its study records go to the sponsor's archives.

## What is 21 CFR Part 58?

Part 58 "prescribes good laboratory practices for conducting nonclinical laboratory studies that support or are intended to support applications for research or marketing permits for products regulated by the Food and Drug Administration" ([21 CFR 58.1](https://www.law.cornell.edu/cfr/text/21/58.1)). A nonclinical laboratory study is defined as "in vivo or in vitro experiments in which test articles are studied prospectively in test systems under laboratory conditions to determine their safety", and the definition excludes "basic exploratory studies carried out to determine whether a test article has any potential utility" ([21 CFR 58.3](https://www.law.cornell.edu/cfr/text/21/58.3)).


## What does the study director do under GLP?

Each study has one. The study director "has overall responsibility for the technical conduct of the study, as well as for the interpretation, analysis, documentation and reporting of results, and represents the single point of study control" ([21 CFR 58.33](https://www.law.cornell.edu/cfr/text/21/58.33)). The duties include making sure the protocol is followed, data are accurately recorded and verified, unforeseen circumstances are documented, and all raw data, documentation, protocols, specimens and final reports go to the archives during or at the close of the study.


## What must a GLP final report include?

Section 58.185(a) lists what the final report must include, "but not necessarily be limited to" ([21 CFR 58.185](https://www.law.cornell.edu/cfr/text/21/58.185)). Paraphrased:

| Item | Content |
| --- | --- |
| (1) | Facility name and address; study start and completion dates |
| (2) | Objectives and procedures from the approved protocol, with any changes |
| (3) | Statistical methods |
| (4) | Test and control articles: name, CAS or code number, strength, purity, composition |
| (5) | Stability of the test and control articles under the conditions of administration |
| (6) | Methods used |
| (7) | Test system, including animal numbers, sex, weight range, source, species, strain, age and identification where applicable |
| (8) | Dosage, regimen, route and duration |
| (9) | All circumstances that may have affected data quality or integrity |
| (10) | Study director, other scientists and all supervisory personnel |
| (11) | Transformations, calculations or operations on the data; summary, analysis and conclusions |
| (12) | Signed and dated reports of each individual scientist or professional |
| (13) | Where specimens, raw data and the final report are stored |
| (14) | The quality assurance unit's signed statement |

The study director signs and dates the report (58.185(b)). Corrections or additions are made only by amendment that identifies what changed and why, signed and dated (58.185(c)).


## How must GLP raw data and specimens be archived?

"All raw data, documentation, protocols, final reports, and specimens" from the study must be retained, apart from some wet specimens, and there must be "archives for orderly storage and expedient retrieval" ([21 CFR 58.190](https://www.law.cornell.edu/cfr/text/21/58.190)). An individual must be named as responsible for the archives, only authorized personnel may enter, and material must be indexed. A testing facility may use commercial archives.

Raw data is broad: "any laboratory worksheets, records, memoranda, notes, or exact copies thereof, that are the result of original observations and activities of a nonclinical laboratory study", and it may include "computer printouts, magnetic media, including dictated observations, and recorded data from automated instruments" ([21 CFR 58.3(k)](https://www.law.cornell.edu/cfr/text/21/58.3)). Electronic raw data in an ELN or LIMS is therefore archive material, and Part 11 governs how it is kept.


## How long must GLP records be kept?

Under 58.195(b), for whichever of these periods is shortest ([21 CFR 58.195](https://www.law.cornell.edu/cfr/text/21/58.195)):

- At least 2 years after FDA approves the application the study supported (not for IND or IDE studies).
- At least 5 years after the study results are submitted to FDA in support of an application.
- Otherwise, for example when the study is never submitted, at least 2 years after the study is completed, terminated or discontinued.
- If a facility conducting nonclinical testing goes out of business, its raw data, documentation and other required material "shall be transferred to the archives of the sponsor of the study", and FDA must be notified in writing (58.195(h)).

These are GLP minimums; other FDA rules, sponsor contracts and state law can require longer. Section 58.195(a) says these requirements do not supersede retention rules in other FDA regulations.


## GLP final report checklist, with a worked example

The [GLP final report checklist (CSV)](https://origindatapartners.com/downloads/glp-final-report-checklist.csv) lists each 58.185 item with a column for where it appears in your report. The example is invented: QA mapping a 14-day oral toxicity study report in rats before the study director signs.

| Item | Where it appears (fictional) | QA note |
| --- | --- | --- |
| 58.185(a)(2) | Section 2, Protocol and amendments 1 and 2 | Amendment 2 dates match the protocol file |
| 58.185(a)(5) | Appendix 4, Dose formulation analysis | Stability covers the full dosing period |
| 58.185(a)(9) | Section 9, Deviations | One temperature excursion described with its assessment |
| 58.185(a)(11) | Section 7 and Appendix 6, Statistics | Software name and version listed |
| 58.185(a)(13) | Section 11, Archive | Archive location and index number given |
| 58.185(a)(14) | QA statement page | Inspection dates listed and signed |


## Common GLP record mistakes

- Raw data left on instrument PCs or personal drives instead of the indexed archive.
- Final reports corrected by editing the file rather than by a signed amendment.
- No archive reference for raw data or specimens kept at another site.
- Deviations described in emails but not in the report under 58.185(a)(9).
- Destroying records on the shortest period without checking sponsor contracts and other FDA rules.
- No plan for the archive if the facility closes or is sold.


## Your study archive is also a data asset

A GLP archive holds complete, reviewed studies: protocol, raw data, deviations, statistics and conclusions, each signed. Most of those studies were run for sponsors, who usually control them; a lab's own method development and validation work is often its own.

AI developers working on biology and chemistry ask for experiments like these with their context and their failures. Sponsor-owned studies, partner-restricted projects and identifiable human-subject data stay out unless the agreements and consents allow them; [licensing R&D lab notebooks](https://origindatapartners.com/guides/license-rd-experiment-records-ai) covers the general case.

If your company keeps years of lab notebooks and assay results, the [guide for biotechs, CROs and contract labs](https://origindatapartners.com/guides/biotech-cro-lab-data) explains what AI developers ask for and who signs. To see what yours could be worth, [describe them in six questions](https://origindatapartners.com/check-fit?sector=biotech); no files or system access needed.


## Questions and answers

### What is 21 CFR Part 58?

The FDA regulation on good laboratory practice (GLP) for nonclinical laboratory studies that support applications for research or marketing permits for FDA-regulated products, such as drugs, biologics, devices and food additives.

### What are the requirements for a GLP final report?

Section 58.185(a) lists 14 items, including the facility, dates, protocol and changes, statistics, test articles and their stability, methods, test system, dosing, circumstances affecting the data, personnel, data analysis and conclusions, individual reports, storage locations and the QA statement. The study director signs it.

### Who signs a GLP final report?

The study director signs and dates the final report. The quality assurance unit prepares and signs its own statement, which is included in the report, and individual scientists' reports are signed and dated.

### How long must GLP records be retained?

For the shortest of: 2 years after FDA approves the supported application, 5 years after the results are submitted to FDA, or, if not submitted, 2 years after the study is completed, terminated or discontinued. Other rules and contracts may require longer.

### What happens to GLP records if a lab closes?

Under 58.195(h), if a facility conducting nonclinical testing goes out of business, its raw data, documentation and other required material are transferred to the archives of each study's sponsor, and FDA is notified in writing.

### Do GLP rules apply to early discovery assays?

No. The definition of a nonclinical laboratory study excludes basic exploratory studies that test whether an article has any potential utility or determine its physical or chemical characteristics. GLP applies to safety studies supporting FDA applications.

### What counts as raw data under GLP?

Original worksheets, records, notes and exact copies that are needed to reconstruct and evaluate the study report, including computer printouts, magnetic media, dictated observations and recorded data from automated instruments.

### What is the difference between GLP and GMP?

GLP (21 CFR Part 58) covers how nonclinical safety studies are run and recorded. GMP covers how products are manufactured and controlled. A contract lab may work under one, both or neither, depending on the study.

### Can a non-GLP study be submitted to FDA?

An IND can include one, but it has to be explained. For an IND, 21 CFR 312.23 asks, for each nonclinical laboratory study subject to Part 58, for a statement that it was conducted under GLP or, if not, "a brief statement of the reason for the noncompliance". Which studies Part 58 covers in the first place is set by its scope in 21 CFR 58.1, described above.

## Sources

- [21 CFR 58.1: scope of good laboratory practice for nonclinical laboratory studies](https://www.law.cornell.edu/cfr/text/21/58.1)
- [21 CFR 58.3: definitions (nonclinical laboratory study, sponsor, raw data)](https://www.law.cornell.edu/cfr/text/21/58.3)
- [21 CFR 58.33: study director](https://www.law.cornell.edu/cfr/text/21/58.33)
- [21 CFR 58.185: reporting of nonclinical laboratory study results](https://www.law.cornell.edu/cfr/text/21/58.185)
- [21 CFR 58.190: storage and retrieval of records and data](https://www.law.cornell.edu/cfr/text/21/58.190)
- [21 CFR 58.195: retention of records](https://www.law.cornell.edu/cfr/text/21/58.195)
- [21 CFR 312.23: IND content and format](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312/subpart-B/section-312.23)

## Related reading

- [Assay Data for AI: What Biotechs, CROs and Labs Can Offer](https://origindatapartners.com/guides/biotech-cro-lab-data)
- [21 CFR Part 11: Requirements and a Compliance Checklist](https://origindatapartners.com/guides/21-cfr-part-11-checklist)
- [IC50: What It Is, How to Calculate It, and IC50 vs EC50](https://origindatapartners.com/guides/ic50-calculation)
- [Licensing R&D lab notebooks and experiment records to AI](https://origindatapartners.com/guides/license-rd-experiment-records-ai)
- [Cancel Google Workspace or delete Slack? Export data first](https://origindatapartners.com/guides/export-company-records-before-closing)
- [/glossary/good-laboratory-practice](https://origindatapartners.com/glossary/good-laboratory-practice)