by Jane Arce Head of Quality & Compliance | Senior GCP & Clinical Quality Expert and Henrik Nakskov CEO | Head of Clinical Information Management
“We are too early for a GxP system.”
It is a sentence many early-stage biotech companies say with good reason. The team is small. The science is still evolving. Capital is limited. Internal processes need to remain flexible. A shared drive, spreadsheets, CRO portals and email approvals can feel sufficient for the current stage.
The problem is that regulatory evidence does not begin at clinical stage.
By the time a company prepares its first Investigational New Drug (IND) submission in the US or Clinical Trial Application (CTA) in Europe, much of the evidence that regulators will rely on has already been created. Non-clinical toxicology studies may be complete. API batches may already have been manufactured. Stability samples may be running. Analytical methods may have changed. CROs and CDMOs may have generated protocols, deviations, reports, raw data and batch records.
The submission may happen later. But the regulatory record is already being built.
The risk: late structure cannot always repair early gaps
One of the clearest examples is SEND, the Standard for Exchange of Nonclinical Data.
SEND is often misunderstood as a submission-formatting issue. It is not. For qualifying FDA studies, the requirement is linked to the study start date, not simply the submission date. If the study was not planned with the right data structure, metadata and traceability from the beginning, late conversion may become complex, expensive or, in the worst case, insufficient.
Europe does not apply SEND in the same way. But the underlying expectation is similar: non-clinical evidence must be complete, traceable, reviewable and usable when a CTA is submitted through the Clinical Trials Information System (CTIS). If study reports, source-data traceability, vendor oversight and the non-clinical rationale are fragmented, the sponsor may struggle to respond within assessment timelines.
The same issue appears in Good Laboratory Practice (GLP). A toxicology study is not only the final report. It is the quality system behind the report: approved protocols, documented deviations, QA review, training records, raw data integrity and controlled archives.
Increasingly, this evidence is generated electronically, making controls such as audit trails, version management and electronic approvals relevant from the earliest stages.
Outsourcing the study to a CRO does not outsource sponsor accountability. The CRO may operate under its own GLP framework, but the sponsor still needs to demonstrate how the CRO was selected, overseen and how the resulting evidence was transferred into a sponsor-controlled record.
Even when activities are outsourced, regulators ultimately hold the sponsor responsible for ensuring the integrity, oversight and traceability of the evidence submitted
CMC starts earlier than many teams expect
Chemistry, Manufacturing and Controls (CMC) documentation is another area where “we will fix it later” can become risky.
The CMC section of an IND, and the quality information in the Investigational Medicinal Product Dossier (IMPD) for a European CTA, are not created at submission. They are built from development history.
That history starts early: method development, batch records, process parameter studies, analytical qualification, stability protocols, certificates of analysis, supplier qualification and manufacturing changes.
A common weak point is change control. Drug substance and drug product processes often evolve significantly between early development batches, toxicology material and clinical trial material. Regulators and assessors may need to understand whether the material used in non-clinical studies is representative of, or comparable to, the material intended for clinical use.
The same pattern extends beyond non-clinical studies. It is equally visible in CMC development, where evidence accumulates long before regulatory submission
Without controlled change history, that comparability story becomes difficult to reconstruct.
Regulators evaluate the lifecycle of evidence—not just the final submission.
The insight: early GxP is not bureaucracy – it is evidence usability
The point is not to impose an enterprise-scale quality system on a small biotech.
It is to protect the future usability of critical evidence.
A proportionate GxP foundation keeps records trustworthy, traceable and retrievable, with the basic controls needed to defend them: audit trails, role-based access, version control, e-signatures and controlled approvals.
This matters under FDA 21 CFR Part 11. It also matters in Europe under EU GMP Annex 11 and broader data integrity expectations.
A spreadsheet may be convenient for stability data. But can changes be traced?
An email approval may feel efficient. But can the approval history be defended?
A CRO PDF may be useful. But is the underlying metadata, source traceability and handover responsibility clear?
A shared drive may be simple. But who had access, which version was current and what changed over time?
These are not theoretical compliance questions. They are development-readiness questions.
They also matter before formal submissions. Pre-IND meetings, INTERACT meetings, EMA scientific advice and national scientific advice all depend on the quality of the briefing package. A sponsor cannot ask meaningful regulatory questions if it cannot retrieve, explain and defend the evidence behind its assumptions.
Practical questions for early-stage teams
Before deciding that it is “too early” for GxP, it may be more useful to ask:
- Are our next toxicology studies being planned with the required submission data standards, metadata and traceability in mind?
- Do we have sponsor-controlled copies of critical CRO/CDMO deliverables, including protocols, deviations, amendments, reports, QA documentation and vendor handovers?
- Can we show how material used in non-clinical studies relates to the material intended for clinical use?
- Are our CMC records controlled from early process development through clinical batch manufacturing?
- If a regulator, investor or partner asked tomorrow how our evidence and electronic records are controlled, could we retrieve and defend the supporting documentation without reconstruction?
The cost question
Late remediation may mean data conversion, dossier reconstruction, system validation, vendor reassessment – or even repeating studies!
For a small biotech, the cost is not only the remediation work. It is the lost time, delayed submissions, slower financing, weakened partner confidence and avoidable pressure on already lean teams.
A GxP system is not something that begins when the first patient is enrolled.
It is the foundation on which the clinical program stands.
For a deeper regulatory view, we have published the full article here: Why Your GxP System Should Start Before Your First Clinical Trial.” It includes more detail on SEND, GLP, CMC, CTIS, scientific advice, electronic record controls and the remediation risks that are often underestimated.