What Is GxP Compliance in Pharma Logistics? A Complete Guide

TL;DR: The GxP gap in pharma cold chain shipping is not recording temperature: it is acting on it while the shipment is still moving. Under European Union (EU) Good Distribution Practice (GDP), the supplying wholesale distributor stays responsible for temperature conditions in transit, and accountability does not transfer to the carrier by default. Passive temperature loggers can record continuously, but they are read only at delivery, so nobody can act during transit and the record has no location context. Real-time trackers flag an excursion while there is still time to act.

GxP ("Good x Practice") is the umbrella term for quality guidelines that govern how you develop, manufacture, test, store, and distribute pharmaceutical products. The "x" represents specific disciplines: Good Manufacturing Practice (GMP), Good Distribution Practice (GDP), Good Laboratory Practice (GLP), Good Clinical Practice (GCP), and others. For shipping and storage, the practical question is: can you prove what happened at every point between departure and delivery?

A passive temperature logger shows you what went wrong only after the load has already arrived, and that data gap is industry-wide. In Tive's Beyond Visibility survey of 300+ global pharma leaders, digitizing and sharing trustworthy data across systems ranked among the top supply chain challenges. Trustworthy, traceable records are also what GxP audits examine.

Why GxP Standards Matter for Cold Chain Quality

For shipping, GxP matters because pharmaceutical products can degrade invisibly. A biologic exposed to a temperature excursion can look identical to one that stayed in range. Documented, continuous condition data is the main evidence you have of hidden degradation during shipping.

GxP Standards for Pharma Shipping

Three practices that commonly affect shipping and storage:

The FDA, European Medicines Agency (EMA), and many national authorities incorporate GxP principles into their regulations. Requirements vary by jurisdiction, but the expectation is consistent: documented control across the entire product lifecycle.

Core GxP Compliance Requirements

Every GxP-compliant cold chain program needs four elements:

1. Validated monitoring systems: Equipment and software that perform their intended function consistently, with documented qualification.
2. Continuous condition records: Temperature and humidity data captured throughout storage and transport, not just at endpoints.
3. Unbroken audit trails: Computer-generated, time-stamped records showing who did what and when.
4. Deviation management workflows: Documented investigation and corrective action when conditions fall outside specification.

These requirements apply whether you operate your own fleet or work entirely through third-party carriers. Accountability does not transfer to the carrier by default. Under EU GDP, the supplying wholesale distributor remains responsible, so confirm who holds responsibility in your quality agreements.

Reducing Costly Rejected Shipments

Catching a temperature excursion during transit means you can reroute, notify the customer, or potentially salvage the load. Discovering it at delivery means filing a claim on a loss that already happened.

E.T.H. Cargo, a pharmaceutical third-party logistics (3PL) provider in Puerto Rico, runs Tive Solo 5G global cellular, WiFi, and GPS trackers on 100% of its 200+ annual pharma shipments. Live tracker data showing −19.67°C, still in range on a shipment past its validated five-day transit window, disproved a damage claim. The same monitoring confirmed a cooling failure that a ground handler had denied.

That is the difference between documentation that reconstructs what happened and data that proves it.

Compliance Risks of Passive Logging

For high-value, temperature-sensitive shipments in pharma and life sciences, the timing gap is critical: excursions are typically discovered only at delivery, when the intervention window has closed, per Tive's analysis of logger limitations.

A passive logger read once at delivery gives your organization no way to monitor or respond during transit, and its report shows no location. Carrier handoffs are where passive logger programs most commonly produce compliance gaps, per Tive's comparison of real-time and passive monitoring.

Navigating Global Pharma Shipping Regulations

Different jurisdictions express GxP requirements through different frameworks, but they converge on the same expectations: validated systems, controlled access, complete audit trails, and documented data integrity.

Ensuring FDA 21 CFR Part 11 Compliance

FDA 21 CFR Part 11 sets the conditions under which the FDA considers electronic records and signatures trustworthy and equivalent to paper. Four requirements are central to monitoring systems:

1. System validation: The software must perform its intended function consistently, with documented evidence.
2. Access controls: System access is limited to authorized individuals, and each user needs unique credentials.
3. Audit trails: Secure, computer-generated, time-stamped records of operator actions on electronic records, detailed in the audit trail section below.
4. Signature-record linking: Electronic signatures bound to individuals and the specific records they signed.

A data logger alone cannot satisfy Part 11. The system surrounding the logger must also meet validation, access control, and audit trail requirements.

EU Annex 11 Requirements Explained

EU GMP Annex 11 governs how computerized systems are validated, operated, and controlled in regulated pharmaceutical environments. The scope covers computerized systems used as part of GMP-regulated activities. A revised Annex 11 completed public consultation in October 2025. The 2011 version applies until the revision is adopted.

Four Annex 11 requirements matter most for monitoring systems:

1. System validation: Computerized systems must be validated.
2. Audit trails: System-generated audit trails of GMP-relevant changes and deletions, built in where a risk assessment calls for them.
3. Access controls: Controls that limit system use to authorized people.
4. Data integrity: Built-in checks for correct and secure data entry and processing, and protection of stored data against damage.

Annex 11 overlaps heavily with FDA 21 CFR Part 11 on audit trails and electronic signatures. The two diverge on supplier oversight, system inventory, periodic evaluation, and business continuity, all of which Annex 11 names explicitly and Part 11 does not.

If you operate under both regimes, build a control set that satisfies whichever requirement is stricter on each point. Do not assume validation against one framework covers the other.

Ensuring GDP Integrity During Transport

EU GDP guidelines (2013/C 343/01) hold the supplying wholesale distributor responsible for protecting medicinal products against breakage, adulteration, and theft, and for ensuring temperature conditions are maintained within acceptable limits during transport.

GDP requires you to store and transport temperature-sensitive products within defined ranges at all times, with monitoring that verifies compliance. EU GDP sections 9.1 and 9.2 expect you to be able to demonstrate that medicines were not exposed to conditions that may compromise their quality, and to have a procedure for investigating and handling temperature excursions. Common practice for meeting that expectation is to keep a continuous temperature record of the load from loading to delivery, along with chain-of-custody documents that show each carrier, every handover, and the signed receipt at the consignee.

When a shipment transfers from air freight to ground handler to refrigerated last-mile carrier, each handover is a point where your records must stay continuous, and custody must stay documented. With real-time Tive data, LOT Cargo caught a pharma shipment misrouted to the wrong temperature room within 1 to 2 hours, not at delivery.

Validating Records for Regulatory Inspections

Auditors do not stop at asking whether you have records. They ask whether your records prove what you claim they prove. The difference comes down to audit trail integrity, chain of custody continuity, and data meeting ALCOA+ standards.

Audit Trail Requirements Under Part 11 and Annex 11

Under FDA 21 CFR Part 11 §11.10(e), an audit trail is a secure, computer-generated, time-stamped record that independently captures operator entries and actions that create, modify, or delete electronic records. Changes must not obscure previously recorded information, and the audit trail must be retained at least as long as the underlying records and be available for FDA review and copying. Annex 11 §9 asks for system-generated audit trails where a risk assessment calls for them.

Passive loggers record at set intervals, and validated logger-plus-software systems are sold as Part 11 compliant. The limit is timing and context. Passive loggers are read once at delivery. By then, the intervention window for a temperature excursion has already closed, and the record shows no location. Before relying on any logger, confirm that installation, operational, and performance qualification (IQ/OQ/PQ) documentation exists for the device and its software.

Chain of Custody for GDP Compliance

Chain of custody documentation should show continuous, unbroken custody from origin to delivery. Chapter 4 of the EU GDP guidelines calls for documentation retention for the period set by national legislation and for at least five years. Records should identify every handover point and who held custody at each stage.

Carrier-reported condition data puts you in the position of trusting the party you remain accountable for. First-party data from trackers you deploy gives you a condition record that does not rely on the carrier's own reporting.

Meeting ALCOA+ Records Requirements

ALCOA+ stands for Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available. These nine principles are a widely used data integrity framework for GxP environments, referenced in guidance from the World Health Organization (WHO), the Pharmaceutical Inspection Co-operation Scheme (PIC/S), and the Medicines and Healthcare products Regulatory Agency (MHRA). The MHRA GXP Data Integrity Guidance and Definitions (Revision 1, March 2018) uses ALCOA and notes that the "+" attributes were added to emphasize the requirements.

For temperature records:

• Attributable: Each reading traces to a specific person or system and to a calibrated device
• Contemporaneous: Data is recorded at the time of measurement, not reconstructed later
• Original: Records preserve the primary source without transcription
• Complete: All data is captured, including out-of-specification results

A downloaded report showing a two-hour temperature spike somewhere during a 96-hour journey does not tell a quality assurance (QA) team whether the excursion happened at the port of origin, during ocean transit, or during last-mile delivery. Without location data, the excursion can't be tied to a place or custodian, which slows root cause analysis.

How Tive Supports Part 11 and Annex 11 Programs

Solo Pro is a real-time visibility solution for pharmaceutical and life sciences shipments. It is GxP compliant: GMP, built to GAMP 5 (the Good Automated Manufacturing Practice guide). Tive's regulatory credentials include FDA 21 CFR Part 11 and EU Annex 11 compliance. For data security, Tive's credentials include System and Organization Controls (SOC) 2 Type 2 and International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001 certification. Every tracker ships with a 3-Point National Institute of Standards and Technology (NIST) traceable Certificate of Calibration.

For your own validation program, confirm with Tive how these credentials apply to your specific use case and documentation requirements.

Ensuring MKT Accuracy for GxP Shipping Logs

Mean kinetic temperature (MKT) is a standard way to evaluate cumulative thermal exposure in stability protocols and excursion assessments. Getting it right requires accurate measurement, correct calculation, and the ability to act when MKT approaches specification limits.

Calculating Mean Kinetic Temperature

Per United States Pharmacopeia (USP) <1079.2>, MKT is the single calculated temperature at which total degradation over a period equals the sum of individual degradations at various temperatures. It weights higher temperatures more heavily because degradation accelerates exponentially with temperature. The formula uses the Arrhenius equation with a default activation energy of 83.144 kJ/mol unless product-specific data supports a different value. Peer-reviewed research uses the same default when stability data is unavailable. For the full calculation, see Tive's mean kinetic temperature guide. MKT is widely used to evaluate storage and in-transit excursions, so confirm how your regulator and product stability data apply it.

Tracking Exposure for GxP Compliance

Cumulative exposure tracking means knowing not just whether a threshold was crossed, but how much total thermal burden the product has absorbed. This matters for products with time-out-of-refrigeration limits or cumulative exposure specifications.

Solo Pro is the only Tive tracker with a built-in ePaper display showing temperature, alarm status, and MKT for instant accept-or-reject decisions at the dock. The device also supports single-excursion, cumulative-exposure, and MKT alerting. For ultra-low temperature loads, the cryogenic probe reads to −200°C and the dry-ice probe to −100°C. Confirm calibration certificate details for each probe with Tive.

GxP Standards for Deviations and CAPA

Deviation management under GxP is not about preventing every excursion. It is about detecting, documenting, investigating, and correcting them in a way that satisfies auditors and prevents recurrence.

Defining Thresholds for Temperature Excursions

EU GDP section 9.2 says that if a deviation such as a temperature excursion or product damage occurs during transportation, it should be reported to the distributor and recipient. It also calls for a procedure for investigating and handling temperature excursions. International Council for Harmonisation (ICH) Q10 calls for deviations to feed the Corrective and Preventive Actions (CAPA) element of your pharmaceutical quality system, with investigation and root cause analysis commensurate with risk, and with trending and risk-based, verified corrective and preventive actions.

Your threshold definitions should specify alert thresholds (the temperature range that triggers notification), excursion definition (how long out of range constitutes a reportable deviation), cumulative limits (total allowable time-out-of-range across the shipment), and MKT limits (maximum acceptable mean kinetic temperature for the product). These thresholds belong in your standard operating procedures (SOPs), and should match your product stability data.

What a Complete Deviation Record Includes

A complete deviation record includes: what happened (time, duration, and magnitude of the excursion), where it happened (location at the time), when it was detected (timestamp of the first alert), who was notified (names and timestamps), what action was taken (intervention steps with timestamps), root cause (investigation findings and contributing factors), and CAPA (corrective and preventive actions implemented).

Linking Deviations to Root Cause

For temperature excursions, root cause analysis requires knowing where and when the excursion occurred. A passive logger report showing a spike somewhere in transit may not support this without location data. A continuous record with location data can.

Immediate Response to Temperature Excursions

A temperature alert at hour 12 of a 72-hour shipment can leave up to 60 hours to intervene. The same reading discovered at delivery leaves none.

Biocair, a pharmaceutical and therapeutics logistics provider, uses Tive to protect its pharmaceutical and therapeutic shipments. Diagnexia uses Tive to monitor roughly 90% of its shipments of irreplaceable tissue samples in the United Kingdom (UK), where degraded samples cannot be reshipped.

Tive's multi-network trackers transmit on preconfigured schedules independent of carrier reporting, so the condition data you see reflects what is happening to the cargo right now. Patented bi-directional connectivity lets you adjust tracker settings while shipments are in transit. Tive's cold chain monitoring covers continuous in-transit temperature and humidity monitoring with proactive excursion alerts.

Steps for Effective Incident Reporting

NASH, which ships specialty medications to patients' homes, uses Tive on every shipment. NASH reships right away after an excursion and avoids unnecessary reships when carrier data lags.

A typical incident reporting workflow:

1. Detection and reporting: Automated alert when a threshold is crossed, with the deviation reported to designated personnel through the notification channels your monitoring system supports
2. Containment: Immediate action to limit product impact, such as rerouting, expediting, or preparing a replacement shipment
3. Documentation: Record the event, timestamps, and actions taken in the deviation record
4. Assessment: Review current conditions, location, remaining transit time, and product impact
5. Investigation: Root cause analysis using the complete condition history
6. CAPA: Implement corrective and preventive actions where the risk assessment requires them
7. Review and close: Verify effectiveness and trend results across deviations

GxP Compliance Checklist for Cold Chain Operations

Use this checklist to evaluate your current program against GxP expectations for cold chain shipping and storage.

GxP Protocols for Cold Chain Equipment

Verify that your monitoring equipment meets these qualification and calibration standards:

• Temperature monitoring devices are validated and calibrated, with certificates traceable to NIST or equivalent
• Monitoring intervals are defined in SOPs and match product stability requirements
• Equipment qualification (IQ/OQ/PQ) documentation is complete and current
• Alarm thresholds are defined per product and documented in validation protocols
• Backup monitoring or contingency procedures exist for equipment failure

Developing Audit-Ready SOP Frameworks

Your SOPs should document these operational controls:

• Define who is responsible for monitoring at each stage of transit
• Specify response procedures for temperature excursions, including escalation paths
• Require documented deviation records for all excursions, with investigation and CAPA based on risk assessment
• Address carrier and 3PL qualification and ongoing performance monitoring
• Ensure that SOPs are reviewed and updated on a defined schedule

Capturing Audit-Ready Transit Records

Confirm your records meet these documentation standards:

• Temperature records are continuous from loading through delivery, with no gaps at handoffs
• Records include device identity, calibration status, and logging interval
• Chain-of-custody documentation identifies every handover point and custodian
• Records are retained for the period set by national legislation and for at least five years
• Audit trails are computer-generated, time-stamped, and tamper-evident

Maintaining Audit-Ready Shipment Logs

Validate that your electronic records systems satisfy regulatory expectations:

• Electronic records meet FDA 21 CFR Part 11 requirements for validation, access control, and audit trails
• Records meet EU Annex 11 requirements for data integrity and computerized system validation
• Data integrity follows ALCOA+ principles: Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available
• Records are available for regulatory review and copying without manual reconstruction

Vendor Qualification for GDP

Ensure that your carrier and 3PL relationships include these controls:

• Carriers and 3PLs are qualified before first use, with documented audits
• Contracts specify temperature control responsibilities and liability
• Carrier performance is monitored and trended over time
• Subcontractors are approved and held to the same standards as primary carriers
• Temperature monitoring is independent of carrier-reported data where product value justifies it

If your program cannot check off most of the items above, the gap between your current monitoring approach and what auditors expect may be wider than you think. Talk to Tive's team to start monitoring your highest-risk shipment lanes.

FAQs

What Does GxP Stand for in Pharma?

GxP stands for "Good x Practice," where the "x" represents different disciplines: Manufacturing (GMP), Distribution (GDP), Laboratory (GLP), Clinical (GCP), and others. It is the umbrella term for quality guidelines that govern how pharmaceutical products are developed, manufactured, tested, stored, and distributed.

Is Real-Time Monitoring Required for GxP Compliance?

No major GxP framework explicitly mandates real-time monitoring, but auditors expect continuous condition records throughout transport. EU GDP section 9.1 says it should be possible to demonstrate that medicines have not been exposed to conditions that may compromise their quality.

How Long Must GxP Records Be Retained?

EU GDP Chapter 4 calls for documentation retention for the period set by national legislation and for at least five years. FDA 21 CFR Part 11 requires audit trails to be retained at least as long as the underlying electronic records they document.

What is the Difference Between GMP and GDP?

GMP (Good Manufacturing Practice) governs production, testing, and quality assurance of pharmaceutical products. GDP (Good Distribution Practice) governs storage, transport, and supply chain handling after manufacturing and before the product reaches the end user.

Can Passive Loggers Meet GxP Audit Trail Requirements?

Yes, in some cases. Passive loggers record at set intervals, and validated logger-plus-software systems are sold as Part 11 compliant. Their limit is that they are read once at delivery, so the logger can't send an alert in transit, nobody can see where an excursion happened, and nobody can intervene before the window closes. For high-value or high-risk shipments, that leaves you without in-transit data to act on.

Key Terms Glossary

ALCOA+: Data integrity principles standing for Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available. A widely used framework for evaluating whether regulated data can be trusted during inspections.

Audit Trail: A secure, computer-generated, time-stamped record of operator entries and actions that create, modify, or delete electronic records, required by FDA 21 CFR Part 11 and addressed in EU Annex 11.

CAPA: Corrective and Preventive Action. The documented process for investigating deviations, identifying root causes, and implementing changes to prevent recurrence.

Chain of Custody: Documented evidence showing who held custody of a product at every point from origin to delivery, including all handovers and transit storage.

Deviation: Any departure from approved instructions or established standards. EU GDP section 9.2 says deviations such as temperature excursions or product damage during transportation should be reported to the distributor and recipient, with a procedure in place for investigating and handling temperature excursions.

EU Annex 11: The EU GMP guideline governing computerized systems in GMP environments, covering validation, audit trails, access control, and data integrity.

FDA 21 CFR Part 11: The U.S. regulation establishing when electronic records and signatures are considered trustworthy and equivalent to paper documentation.

GDP: Good Distribution Practice. Quality guidelines governing storage, transport, and supply chain handling of pharmaceutical products.

GMP: Good Manufacturing Practice. Quality guidelines governing production, testing, and quality assurance of pharmaceutical products.

GxP: Umbrella term for "Good x Practice" quality guidelines, where x represents Manufacturing, Distribution, Laboratory, Clinical, and other disciplines.

MKT (Mean Kinetic Temperature): A calculated temperature representing cumulative thermal exposure, weighted by the Arrhenius equation to evaluate product stability.