gxp data archiving · gxp archive requirements
GxP Data Archiving: Dynamic Records & Readability Matrix
October 27, 2026
28 min read
GxP data archiving guide for 2026: compares native retention, controlled viewers, dynamic archives and certified copies by record class, with a restoration protocol and eight verification measures.
- 01Choose preservation by record class. The preserved representation must remain authentic, complete, intelligible, retrievable and reconstructable after the source system is retired.
- 02Recovery backups do not replace long-term archiving. Preserve metadata, audit trails, signatures and the dependencies needed to understand and reconstruct each record.
- 03Keep dynamic behaviour where later reprocessing or interrogation is needed. A static image preserves appearance, but does not preserve the behaviour of a dynamic record.
- 04No preservation mode dominates: native retention, controlled viewers, dynamic migration and certified static copies each carry different dependencies and residual risks.
- 05Set retention periods and verification targets against the governing rule and local risk assessment. Confirm readability over time and document legal and quality approval before decommissioning or destruction.
Executive Summary
GxP data archiving is best treated as a record-class decision, not a storage purchase. The question for each class of record is whether, after the source system is retired, the preserved representation is still authentic, complete, intelligible, retrievable and reconstructable. The UK Medicines and Healthcare products Regulatory Agency (MHRA) defines the data lifecycle as running through retention, archive/retrieval and destruction ([1]), and both MHRA and the OECD (Organisation for Economic Co-operation and Development) state that backups kept for recovery do not replace long-term retention of data and metadata ([2]) ([3]).
The regulator texts reviewed here converge on four expectations. Metadata are part of the record ([4]). Electronic archives should maintain audit trails and metadata and keep records readable over the long term ([5]). Data that must be dynamic stay dynamic ([6]), so a static render is not a safe default: the European Medicines Agency (EMA) says static formats of dynamic data are not adequate when a clinical database is decommissioned ([7]). Migration to a new format must be validated and documented ([8]).
Retention periods differ by rule and by date, so this report uses none as a default. UK trial master file documents are kept at least 25 years ([9]) for applications on or after 28 April 2026, while earlier trials keep the previous five-year period for those documents ([10]). US batch records under 21 CFR 211.180 run at least one year after batch expiry ([11]), and investigational new drug sponsor records run two years after marketing application approval ([12]). A consultation on a revised EU Annex 11 closed on 7 October 2025 ([13]), and the Volume 4 catalogue still listed Annex 11 as the January 2011 revision when checked on 27 October 2026 ([14]). The draft is therefore not a requirement.
The report supplies four preservation modes (native retention, controlled viewer, migration to a dynamic archive, certified static copy), a ten-row record-class matrix, eight calculable verification measures and a restoration protocol. It does not rank products, set universal thresholds or give legal advice. Destruction needs documented quality and legal approval, and MHRA states that documents must not be destroyed before the end of the retention period ([15]).
Minimum UK trial master file retention for applications on or after 28 April 2026, from the day after trial conclusion
UK advanced therapy traceability retention after product expiry, or longer if authorised
Minimum US batch record retention after batch expiry under 21 CFR 211.180
Introduction and Background
This report is written for clinical, laboratory, manufacturing and quality-system owners, records managers, archivists and validation teams who must decide, for each legacy system, whether to keep it running, preserve a validated render, migrate dynamic data to an archive, or maintain a controlled viewer for the whole retention period. No vendor or product appears as an option in any comparison here; the analysis is a reading of regulator and standards texts, not a product evaluation.
Three terms are often conflated:
- Backup is a copy of current, editable data, metadata and system configuration kept for recovery ([16]) ([17]).
- Archive is a designated secure area or facility, which can be a computerised system, for long-term retention ([18]) ([19]), and it must be protected so records cannot be altered or deleted without detection ([20]).
- Long-term digital preservation is a wider discipline. The Open Archival Information System (OAIS) reference model defines it as keeping information independently understandable by a Designated Community, with evidence supporting its authenticity ([21]), and it defines "long term" not as a number of years but as a period long enough for changing technology to matter ([22]).
Terminology is not uniform across regulators. The US Food and Drug Administration (FDA) uses "backup" in 21 CFR 211.68(b) to mean a true copy of the original record ([23]) and says that usage is consistent with "archive" ([24]). A project that borrows another jurisdiction's vocabulary without checking this can pass an inspection checklist on paper while lacking an archive in the MHRA or OECD sense.
The status of sources matters. Requirements here are those of a cited regulation or guidance. The revised Annex 11 and Chapter 4 texts, prepared with the Pharmaceutical Inspection Co-operation Scheme (PIC/S), are consultation drafts whose response period has ended ([13]). The Clinical Data Interchange Standards Consortium (CDISC) Operational Data Model (ODM) is described by its publisher as a format for exchanging and archiving clinical research data ([25]), which is not the same as an archiving mandate. Matrix choices, test designs and owners are editorial implementation choices and are labelled as such. Governing domain, jurisdiction and predicate rule must be confirmed by the reader's legal and quality functions before any decision is acted on.
Record Inventory, Classification and Dependencies
Inventory and the predicate retention rule
An archive decision starts from an inventory. The EMA guideline on computerised systems in clinical trials calls for an inventory of all essential data and documents with their retention periods ([26]), and the ICH E6(R3) guideline (International Council for Harmonisation, Good Clinical Practice) asks sponsors and investigators to record where essential records are located ([27]). For GMP records, EU Chapter 4 requires regulated users to define which data are raw data ([28]).
In the US, the predicate rule decides what must be kept. FDA's 2003 scope guidance says records not required to be retained under predicate rules are not within Part 11 merely because they are held electronically ([29]), and it suggests basing record-maintenance decisions on predicate rule requirements and a documented risk assessment ([30]). Part 11 defines an electronic record to include information that is archived ([31]), so archiving is within the definition, not outside it.
Static, dynamic and hybrid records
MHRA defines a static record as fixed, with little or no interaction with content ([32]), and a dynamic record as one that allows an interactive relationship between user and content ([33]). FDA's data integrity guidance gives the same distinction ([34]), and the OECD says information captured in a dynamic state should remain available in that state ([35]). FDA states that a fixed printout of a reprocessable record would not satisfy requirements to retain original records or true copies ([36]).
Hybrid records combine paper and electronic parts. MHRA requires references between the physical and electronic parts to be maintained for the whole retention period ([37]), which makes the link itself a record that needs a preservation owner.
Dependency classes
A raw data file is rarely intelligible alone. The sources reviewed support the following dependency classes, which drive the matrix in the Feature Comparison section:
- Metadata. FDA defines metadata as the contextual information required to understand data ([38]) and expects the relationships between data and metadata to be preserved securely and traceably ([39]).
- Audit trails. An audit trail allows reconstruction of the course of events relating to the creation, modification or deletion of a record ([40]). Part 11 requires audit trail documentation to be retained at least as long as the subject records ([41]), and the EMA says data, contextual information and audit trail should not be separated in migration ([42]).
- Signatures. Signed records must show the signer, date and time, and meaning ([43]), and signatures must be linked to their records so they cannot be excised ([44]). Annex 11 expects permanent linkage ([45]).
- Methods, configurations and validation evidence. The OECD GLP Principles list validation documentation for computerised systems among archived materials ([46]). Where methods and code lists are not named in a source, their inclusion in this report is an editorial inference from the "complete information package" principle ([47]).
- Attachments, links and relationships. The EMA expects archived data to be retrievable as usable datasets with their metadata ([48]).
- Rendering dependencies. The WHO notes electronic data are normally legible only through the original software application ([49]), and the Library of Congress lists external dependencies among its format sustainability factors ([50]).
Preservation Mode 1: Retain the Native System
Capabilities
The native system keeps the dynamic record, its metadata and audit trail in the environment that created them. MHRA allows data to be retained either in the original system, subject to suitable controls, or in an appropriate archive ([51]). Archive arrangements must permit recovery and readability of data and metadata throughout the retention period ([52]).
Adoption and regulatory position
No adoption data are available in the sources reviewed, and none are inferred. For legacy systems, MHRA says the ability to review data should be periodically verified ([53]). For unsupported software, MHRA, the OECD and PIC/S all point to maintaining the software for data accessibility ([54]) ([55]) ([56]), with a virtual environment given as one route.
Strengths and limitations
The strength is fidelity: nothing is converted. The limitations are operational. The EMA expects contracts so that vendor documentation stays accessible even if the vendor stops supporting the system or ceases activity ([57]). Annex 11 requires periodic evaluation to confirm a system remains valid ([58]), so a retained system carries ongoing validation, security and infrastructure duties. PIC/S adds that after software installation or update, users should ensure existing and archived data can still be read, converting archived data where necessary ([59]). The OECD requires records of a system that cannot be maintained to be archived under a documented strategy before decommissioning ([60]). Keeping a system is therefore a commitment to fund its lifecycle for the full retention period: patching, hardware refresh, access control and periodic review all continue. No source reviewed quantifies that cost, and no figures are offered here. Native retention suits record classes with high reprocessing value and a retention period short enough that vendor support is realistic; for longer periods it is best treated as a bridge to another mode.
Preservation Mode 2: Controlled Viewer or Validated Render
Capabilities
A controlled viewer is a validated tool that opens preserved data read-only, either through emulation of the original software or through a purpose-built reader. The EMA lists using a new system to emulate the old software as one way to keep archived data accessible ([61]), and its computerised systems guideline says data should be archived in a read-only state ([62]). The OECD says software should be retained in the archive if needed to read or reconstruct data ([63]).
Adoption and regulatory position
FDA states that true copies of dynamic records may be kept in the original format or one that preserves content and meaning, provided a suitable reader and copying equipment are readily available ([64]). For inspections, the MHRA says sponsors must provide the equipment and software needed to access electronic trial master file records ([65]).
Strengths and limitations
A viewer can lower the cost of keeping a full system alive, but it adds its own dependency. The Library of Congress notes that encryption is incompatible with format transparency ([66]), and a viewer that depends on an unsupported runtime merely relocates the technology-change problem. Validation scope is also open: no source reviewed prescribes viewer test content, so the render-equivalence sampling later in this report is an editorial design. A viewer used for dynamic reprocessing must demonstrate that reprocessing is possible, because a read-only display of a result is functionally a static view. Part 11 also requires the ability to generate accurate and complete copies in human readable and electronic form ([67]), so a viewer needs an export path as well as a display. Where an external party operates the viewer or archive, PIC/S expects the provider to be assessed and responsibilities recorded in a quality technical agreement ([68]).
“A scanned or rendered image therefore preserves appearance, not behaviour.
Preservation Mode 3: Migrate to a Dynamic Archive
Capabilities
Migration moves stored data from one durable storage location to another, possibly changing format but not content or meaning ([69]). Annex 11 requires migration validation to check that data are not altered in value or meaning ([70]). The EMA says validating a data migration should have no less focus than validating the system itself ([71]), and ICH E6(R3) requires migration to be documented for traceability ([72]).
Adoption and regulatory position
For clinical trials, the EMA expects a dated, certified copy of a decommissioned database to be archived ([73]). Draft Annex 11 (not in force) would expect integrity checks, for example by checksum, before any data are deleted after a move ([74]). OECD Advisory Document No. 17 says conversion to a different format, for example a proprietary format to PDF, should be treated as data migration ([75]), and that electronic archiving is an independent procedure needing its own validation ([76]). CDISC ODM carries clinical data with metadata, administrative data, reference data and audit information ([77]), which makes it a candidate exchange representation, not a mandated one.
Strengths and limitations
Migration can decouple records from vendor software. The OECD, however, warns that the difficulty of migrating data is often underestimated ([78]). MHRA accepts that preserving accessibility may require migration to a format that loses some attributes or dynamic functionality, and expects the choice to be risk assessed ([79]). The Digital Preservation Coalition (DPC) cites an aerospace example where migrating older design files required extensive validation ([80]). The EMA allows a certified copy in a different file format only when the equivalent dynamic nature, including metadata, is retained ([81]). No public benchmarks of conversion fidelity for GxP formats were found.
Preservation Mode 4: Certified Static Copy
Capabilities
A certified copy is verified to contain the same information, including context, content and structure, as the original. MHRA's true-copy definition allows verification by dated signature or by a validated generation process ([82]), and ICH E6(R3) adds that the verified information includes relevant metadata where applicable ([83]). FDA's 2024 clinical investigations guidance says a copy retained in place of an original should be a certified copy that includes the date and time of copying ([84]), and that an original can be discarded after a certified copy is created ([85]).
Adoption and regulatory position
Static copies are well accepted for records that are static by nature. 21 CFR 211.180 allows records to be retained as originals or as true copies ([86]), and FDA states it does not object to archiving required records in standard electronic file formats or non-electronic media where predicate rule requirements are met ([87]). The limit is dynamic data. A copy may be in a different electronic format but must retain the metadata and audit trail needed to preserve full meaning ([88]).
Strengths and limitations
PDF/A is a constrained form of PDF intended to be suitable for long-term preservation of page-oriented documents ([89]). The Library of Congress also says PDF/A does not permit encryption ([90]), that rendering support is not guaranteed ([91]), and that logical structure appears only if the creating process adds it ([92]). No source reviewed states that PDF/A preserves audit trails, signatures or reprocessing capability. A scanned or rendered image therefore preserves appearance, not behaviour. The EMA states that a conversion failing the certified-copy criteria cannot replace the original ([93]).
Feature Comparison
- Dynamic records allow an interactive relationship between user and content.
- A viewer used for dynamic reprocessing must demonstrate that reprocessing is possible.
- Migration must retain equivalent dynamic nature, including metadata.
- Static records are fixed, with little or no interaction with content.
- A certified copy contains the same information, including context, content and structure.
- Static copies are well accepted for records that are static by nature.
The table shows no mode dominating. The decision turns on whether later reprocessing, query or audit-trail interrogation is a realistic need for the record class.
Table 1 below compares the four modes on the dimensions the cited sources raise. The cells summarise points cited in the mode sections above; the final column is an editorial residual-risk judgement.
| Mode | Dynamic behaviour | Metadata and audit trail | Technology dependency | Source support | Editorial residual risk |
|---|---|---|---|---|---|
| Native system retention | Preserved where the system is maintained ([6]) | Remain in place; the system must be kept valid | Vendor and platform support; restoration to validated state | Retention in the original system is permitted with suitable controls | Support ends before retention does |
| Controlled viewer | Depends on emulation or reader; read-only access | Must be displayed and linked to the data | Viewer or emulator lifecycle | Reader must be readily available ([64]) | Display without reprocessing |
| Migration to dynamic archive | Must be shown retained, not assumed | Migrated together | Archive platform and schema | Validation no less rigorous than for the system | Silent loss of attributes |
| Certified static copy | Not retained for dynamic records | Only if included in the copy | Low (open, documented format) | Accepted as true copy when criteria are met ([86]) | Wrong choice for reprocessable data ([94]) |
The table shows no mode dominating. The decision turns on whether later reprocessing, query or audit-trail interrogation is a realistic need for the record class, which is why a record-class matrix follows.
Table 2 is the reference asset: a record-class, dependency, preservation-mode, risk, test, retention-driver and owner matrix. Dependency citations show the source basis; the "candidate mode", "test" and "owner" columns are editorial implementation choices, not requirements, and must be adapted to the governing predicate rule.
| Record class | Dependencies | Candidate mode (editorial) | Principal risk | Verification test (editorial) | Retention driver | Owner (editorial) |
|---|---|---|---|---|---|---|
| Raw data (dynamic) | Metadata, method, software to reprocess ([6]) | Native retention or dynamic archive | Static copy cannot be reprocessed ([36]) | Reprocess a sample and compare results | Predicate rule or trial regulation | Data owner with QA |
| Raw data (static) | Identity and date metadata | Certified static copy | Appearance loss, format obsolescence | Fixity and render check | Predicate rule | Records manager |
| Metadata | Link to parent record ([39]) | Archived with parent | Orphaned context | Dependency-coverage count | Same as parent | Data owner |
| Audit trails | Parent record, time base ([41]) | Dynamic archive; searchable export where practical ([95]) | Separation from data | Reconstruct a sample edit history | At least as long as parent | System owner |
| Electronic signatures | Signer, time, meaning, link ([43]) | Native, or archive that preserves manifestation | Link lost on conversion ([44]) | Verify manifestation on sample | Same as signed record | QA |
| Methods and processing parameters | Version, audit trail | Archived with each result | Wrong method version | Re-trace a result to method version | Same as results | Lab or process owner |
| System configurations | Validated state | Archived with validation evidence ([46]) | Cannot restore state | Document-level completeness check | Life of dependent records | Validation lead |
| Attachments and links | Parent-child references | Archive with reference map | Broken references | Link and attachment integrity rate | Same as parent | Records manager |
| Code lists and reference data | Version effective at the time ([77]) | Archived as versioned reference data | Terms reinterpreted | Version-resolution check | Same as coded data | Data standards owner |
| Rendering dependencies | Viewer, fonts, runtime ([50]) | Controlled viewer inventory | End of vendor support | Approaching-end-of-support count | Life of rendered records | IT with QA |
The matrix is a decision aid, not a standard. Teams that disagree with a candidate mode should record the rationale. Where two modes are combined, for example a dynamic archive plus certified static copies for human reading, the dependency column should show which copy is the system of record.
Performance and Benchmarks
No public benchmark of GxP archive restoration time, render equivalence or reconstruction success was found, and none is implied. What exists is a set of regulator expectations to test and a set of measures a team can compute. Targets are set by local risk assessment; the OECD, for instance, expects the periodicity of evaluating archived signed records to be justified by management ([96]).
Authenticity and fixity
OAIS defines Fixity Information as documenting the mechanisms that ensure content has not been altered in an undocumented manner ([97]), and the DPC defines fixity as assurance that a file has remained unchanged ([98]). The DPC suggests, as a general guideline, checks every six months for hard-drive based systems ([99]), while noting that MD5 suffices for accidental damage but not where malicious alteration matters ([100]). Checksum algorithms have a lifecycle: NIST announced a transition away from SHA-1 for applying cryptographic protection ([101]), and recorded that SHA-1 may still be needed to handle information protected earlier ([102]). Fixity alone does not prove authenticity; the OECD also expects records moved into an archive to be locked against undetected alteration or deletion ([103]).
Encryption and key longevity
NIST defines a key archive as a repository of keys and associated information ([104]), says some keys may need to be archived beyond their usage period ([105]), and requires archived key information to be stored separately from operational data ([106]). For signed records, the verification period can outlast the signing period ([107]). An encrypted archive is only as durable as its key archive, a point the regulator texts reviewed do not address directly.
Eight verification measures (editorial calculations)
- Inventory coverage = records classified with a retention rule and owner / records identified.
- Dependency coverage = records whose required metadata, audit trail, signature manifestation, method and configuration are verified present / records requiring them.
- Fixity-check success = files whose recomputed digest matches the stored digest / files checked.
- Link and attachment integrity = references that resolve to the intended target / references checked.
- Render equivalence exceptions = sampled records with a defined attribute differing from source / records sampled.
- Retrieval success and elapsed time = successful retrievals / requested, with median and maximum elapsed time against a locally set target.
- Reconstruction success = test scenarios an independent reviewer rebuilt from the archive alone / scenarios attempted.
- End-of-support exposure = formats and viewers whose vendor support ends within the review horizon / formats and viewers inventoried.
(Hypothetical Example) If 400 records are sampled and 8 show a differing signature manifestation, render equivalence exceptions are 2.0 percent. The figure has no meaning until the team has defined the attributes compared and the acceptable response, which this report does not set.
Archive restoration protocol (editorial, built from cited expectations)
- Select a risk-weighted sample across record classes, including at least one record that depends on each dependency class.
- Retrieve from the archive, not from the source, and record elapsed time. Annex 11 expects the ability to retrieve data to be ensured and tested when systems change ([108]).
- Check fixity and accessibility, readability and integrity, as Annex 11 clause 17 expects ([109]).
- Compare the rendered record with the source or certified copy on pre-defined attributes.
- Reconstruct one event history using audit trail, signature and method, by a reviewer who did not operate the system.
- Record results and deviations; the EMA expects periodic test retrieval or restores to confirm availability and integrity ([110]), and the OECD expects stored data to be verified for restorability, accessibility, readability and accuracy ([111]).
- Repeat after any major platform change. A clinical data management trade-association chapter recommends testing archived records after every major upgrade of the active system ([112]); that source is an industry association text, not a regulator.
Select a risk-weighted sample across record classes, including a record that depends on each dependency class.
Retrieve from the archive and record elapsed time.
Check fixity, accessibility, readability and integrity.
Compare the rendered record with the source or certified copy on pre-defined attributes.
Use audit trail, signature and method, with a reviewer who did not operate the system.
Record the restoration results and deviations. Repeat after any major platform change.
Targets are set by local risk assessment.
“The matrix is a decision aid, not a standard. Teams that disagree with a candidate mode should record the rationale.
Data Analysis and Evidence
Table 3 lists examples of retention periods stated in the sources, to show variation. It is not a retention schedule and must not be used as one; each entry carries its own conditions.
| Source and rule | Stated period | Trigger or condition |
|---|---|---|
| UK clinical trial TMF (from 28 April 2026) | At least 25 years ([9]) | From the day after the trial concludes; transitional trials keep 5 years for TMF documents ([10]) |
| EU Clinical Trials Regulation Article 58 (wording checked against a UK-hosted retained copy; confirm against the current EUR-Lex text, CELEX 32014R0536) | At least 25 years ([113]) | After trial end; subject medical files follow national law ([114]) |
| UK advanced therapy traceability | 30 years ([115]) | After product expiry, or longer if authorised |
| 21 CFR 211.180 | At least 1 year ([11]) | After batch expiry |
| EU GMP Chapter 4 | 1 year after expiry or 5 years after certification ([116]) | Whichever is longer |
| 21 CFR 58.195 (GLP) | At least 5 years ([117]) | After results submitted to FDA; shortest applicable period shown |
| 21 CFR 312.57 (IND sponsor) | 2 years ([12]) | After marketing application approval |
| 21 CFR 314.80(j) | 10 years ([118]) | Postmarketing adverse drug experience records |
The spread, from two years to thirty, is the reason a single enterprise default is unsafe. The UK entry also shows that a change in law can create different periods for different trials within one organisation, and that the controlling date may be an application date, not a study date.
Quantitative evidence about storage reliability is sparse and dated. A peer-reviewed analysis of 1.53 million production disk drives found more than 400,000 checksum mismatches ([119]), with 3855 disks developing mismatches overall ([120]); the authors report that silent corruption could lead to data loss more often than latent sector errors ([121]). The study was presented in 2008 ([119]) and describes one vendor's population, so it supports the existence of silent corruption, not a rate for current systems. The DPC notes that media and systems typically last three to five years, requiring storage migration ([122]), and the DPC fixity interval is a general archival guideline, not a GxP requirement ([99]).
Regulatory text versions need date stamps. This report reads the MHRA clinical trial archiving page, which states its amendments come into force on 28 April 2026 ([123]); the UK amending regulations, in force from the same date ([124]); the January 2011 text of Annex 11 ([14]); and the ICH E6(R3) Step 4 text of January 2025. Section numbers refer to those versions and should be rechecked before citation.
Access, Periodic Review and Decommissioning
Access, security and retrieval
Access to archives is restricted in each domain reviewed. MHRA restricts trial archive access to appointed individuals and auditors or inspectors ([125]); the OECD Principles restrict it to personnel authorised by management ([126]). The EMA requires continued timely inspector access to data after a system is decommissioned ([127]). No source reviewed sets a retrieval time target, so retrieval service levels must be set locally. Legal hold is a legal process outside the regulator texts reviewed here; a hold should suspend the destruction step defined below.
Periodic technology and media review
PIC/S flags the risk that access and readability of archived data may be lost through software updates or superseded equipment ([128]), and expects the restore procedure to be regularly tested ([129]). The DPC warns that failing to run technology watch risks loss of access and higher costs ([130]). The UK National Archives advises profiling file formats to manage risk ([131]). The end-of-support exposure measure above operationalises this.
Decommissioning, destruction approval and the evidence pack
MHRA requires that, if a system cannot be maintained, records be archived under a documented strategy before decommissioning ([132]). FDA's 2024 guidance expects metadata to be obtained, retained and linkable to each data element when systems are decommissioned ([133]). Draft Chapter 4 would add a documented process for disposal of records ([134]), and ICH E6(R3) allows trial data and metadata to be destroyed only when no longer required by applicable regulatory requirements ([135]).
An evidence pack for sign-off might contain the following (editorial):
- Inventory: the record inventory and the retention rule for each class.
- Dependency map: metadata, audit trail, signature, method and configuration links per class.
- Validation report: the migration or certification validation, including the migration plan ([136]).
- Fixity manifests: digests recorded before and after any move.
- Restoration results: the protocol outcomes and any deviations.
- Contract terms: provisions covering readability and access for the retention period.
- Approvals: the legal and quality approval record, and any legal-hold check.
Where an external provider holds the archive, the sponsor retains responsibility for confidentiality and retrieval ([137]), and the agreement should cover the provider going out of business.
Implications and Future Directions
Three implications follow. First, the unit of decision is the record class, not the system: a single legacy platform may justify a dynamic archive for raw data, a certified static copy for reports and a controlled viewer for audit trails. Second, the regulatory text is moving toward explicit archive controls. The consultation draft of Annex 11 includes a dedicated archiving section requiring audit trails to be protected from deletion and change ([138]) and addresses long-term archiving on media with limited durability ([139]). These remain drafts and should be tracked, not applied.
Third, the ICH E6(R3) guideline requires archiving that allows retrieval and reading and protects against unauthorised alteration ([140]), which regional authorities implement in their own texts.
Outside the GxP texts, the National Digital Stewardship Alliance (NDSA) Levels of Digital Preservation reached version 2.1 in March 2026 ([141]); the earlier matrix expected fixity of content to be checked at fixed intervals ([142]). Teams may map their own controls to such a framework, as an editorial choice, without treating it as a GxP requirement.
A practical monitoring list is:
- Changes to the governing retention rule.
- Changes to the regulator catalogue entry for the relevant annex or guideline.
- Vendor end-of-support notices for every viewer and format in the inventory.
- The algorithm status of any checksum or encryption method used.
The practical bottleneck is likely the inventory and dependency work that precedes any tooling choice; this is the author's opinion, not evidence. Teams structuring a record-class inventory can start from the regulator texts cited above. Nothing in this report is legal advice; retention periods, acceptable representations and destruction approval depend on jurisdiction and predicate rule and need review by qualified legal and quality professionals.
Frequently Asked Questions (FAQs)
What are the main GxP archive requirements? Across the sources: archives protect records from undetected alteration ([103]), keep them retrievable and readable ([143]), restrict access ([126]), and name a responsible individual, as 21 CFR 58.190 does for GLP ([144]).
How should dynamic records be archived under GxP? Keep dynamic data in a form that retains interactivity where that is critical ([6]); FDA says a printout of a dynamic record does not preserve the dynamic format ([94]).
Is metadata retention required for data integrity? The EMA treats data without metadata as meaningless ([145]), and FDA expects copies provided at inspection to include metadata and audit trail information ([146]).
How is long-term readability ensured? By periodic accessibility checks irrespective of format ([147]) and a documented migration or emulation plan.
What does 21 CFR Part 11 say about archiving? It requires protection of records for accurate and ready retrieval throughout the retention period ([148]) and the ability to generate accurate and complete copies ([67]); a trade-association chapter notes Part 11 itself sets no specific retention periods ([149]).
How does ALCOA+ apply to archives? MHRA's attributes include data being complete, consistent, enduring and available ([150]), and "available" means readily available for review or inspection.
How should a validated archive migration be handled? Validate and document it ([72]) ([151]), keep data, context and audit trail together ([42]), and verify with checksums where appropriate.
What are GxP data retention and archiving best practices? Define retention periods in an authorised procedure ([152]), inventory the records ([26]), keep multiple independent copies in different geographic locations ([153]), and verify restorability periodically ([111]). These are practices drawn from the cited texts, not a prescribed sequence.
How do archive solutions compare? This report compares preservation modes, not products. The ISPE guide references retention, archiving and migration in an appendix ([154]); no product rankings are offered.
Conclusion
Archiving regulated records is a series of record-class decisions made against four tests: whether the preserved representation stays authentic, complete, intelligible and reconstructable after technology changes. The regulator texts reviewed agree on the direction: metadata and audit trails travel with the record, dynamic data are not reduced to static images without justification, migration is validated, archives are read-only and access-controlled, and readability is verified over time rather than assumed.
They differ on retention periods, terminology and acceptable representations, and parts of the most detailed EU archiving language remain consultation drafts. For that reason this report offers a matrix and a protocol, not a standard answer. The measures defined here (inventory coverage, dependency coverage, fixity success, link integrity, render equivalence exceptions, retrieval success, reconstruction success and end-of-support exposure) give a team evidence for its own thresholds. No benchmark values are claimed, and none should be borrowed from this report.
Before any source system is switched off or any record destroyed, the governing domain, jurisdiction, predicate rule and retention period should be confirmed, the evidence pack assembled, and legal and quality approval documented. Regulatory and standards statements here are dated as of 27 October 2026 and should be rechecked against the current regulator catalogue before reuse.
About IntuitionLabs
Build practical AI for pharma and biotech with IntuitionLabs. We help life-science teams turn complex information and workflows into useful software, governed knowledge systems and AI tools.
IntuitionLabs is an AI consulting, custom software development and data engineering firm serving pharmaceutical, biotechnology, medical-device and other life-science organizations. We work with clinical, regulatory, medical-affairs, commercial, quality and IT teams to connect technology decisions with the work people need to accomplish.
AI consulting and adoption
Our AI enablement services cover readiness assessments, use-case selection, governance and policies, team workshops, adoption measurement and ongoing advisory support. We help organizations structure the information layer behind AI: source material, context, permissions and maintained knowledge that make generated answers useful and reviewable. Private LLM inference and hosted AI options support teams evaluating how to operate AI with appropriate control over their data and infrastructure.
Software, data and life-science workflows
IntuitionLabs develops custom software for pharma and biotech, integrates enterprise systems, and builds data engineering and business intelligence solutions. Areas of focus include AI agents, regulatory research, medical writing, medical affairs, CMC information, competitive intelligence and clinical-document workflows. Our eTMF intelligence work includes cross-system reconciliation and inspection-readiness support.
Enterprise platforms and regulated delivery
We provide Veeva services, application support, managed services, integrations and custom applications, alongside enterprise content work involving platforms such as Egnyte. For regulated workflows, our services include GxP enablement, computer-system validation and software development addressing 21 CFR Part 11 requirements. The applicable controls, validation responsibilities and acceptance criteria are defined for each engagement.
Work with IntuitionLabs
Explore AI enablement, pharma and biotech software development, data engineering and BI, and Veeva services. Contact IntuitionLabs to discuss your workflow, information sources and implementation needs.
IntuitionLabs publishes educational research to help life-science teams make informed technology decisions. Coverage of a product or organization does not imply a client relationship, endorsement or partnership.
Sources / 154
Need Expert Guidance on This Topic?
Let's discuss how IntuitionLabs can help you navigate the challenges covered in this article.
I'm Adrien Laurent, Founder & CEO of IntuitionLabs. With 25+ years of experience in enterprise software development, I specialize in creating custom AI solutions for the pharmaceutical and life science industries.
The information contained in this document is provided for educational and informational purposes only. We make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability of the information contained herein. Any reliance you place on such information is strictly at your own risk. In no event will IntuitionLabs.ai or its representatives be liable for any loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from the use of information presented in this document. This document may contain content generated with the assistance of artificial intelligence technologies. AI-generated content may contain errors, omissions, or inaccuracies. Readers are advised to independently verify any critical information before acting upon it. All product names, logos, brands, trademarks, and registered trademarks mentioned in this document are the property of their respective owners. All company, product, and service names used in this document are for identification purposes only. Use of these names, logos, trademarks, and brands does not imply endorsement by the respective trademark holders. IntuitionLabs.ai is an AI software development company specializing in helping life-science companies implement and leverage artificial intelligence solutions. Founded in 2023 by Adrien Laurent and based in San Jose, California. This document does not constitute professional or legal advice. For specific guidance related to your business needs, please consult with appropriate qualified professionals.