The Lab Compliance Hub: Regulations, Standards & Common Risks

What compliance does a lab need? That depends on your industry, testing activities, sample types, customers, and applicable regulatory or accreditation programs. ISO/IEC 17025 addresses testing and calibration competence, ISO 9001 covers quality management, CLIA establishes requirements for many U.S. clinical laboratories, and HIPAA applies to certain organizations handling protected health information. FDA-regulated operations may also need to address GxP practices and 21 CFR Part 11.

Not every laboratory is subject to every requirement. This guide helps you identify where to start, understand the major frameworks that may apply, and find the relevant resources for your next step. It also covers seven common compliance issues that can create problems during audits and inspections.

Start With Your Lab Type: Which Compliance Requirements May Apply?

Before reviewing individual regulations, find the description that most closely matches your laboratory.

For every lab type, see Seven Common Compliance Issues.

A regulation, accreditation standard, certification, and software assurance approach are not interchangeable. Understanding those distinctions helps your lab identify the correct obligations.

Ready to review your processes? Download our free Regulatory Compliance Checklist.

How Do You Determine Which Lab Compliance Requirements Apply?

Start with the work your lab performs. A clinical laboratory testing patient specimens operates under different requirements than a manufacturing QC laboratory testing incoming materials. A third-party testing laboratory may pursue ISO 17025 accreditation, while a pharmaceutical QC laboratory may need to meet applicable GMP requirements.

Identify the samples you handle, how your results are used, and which regulators, customers, contracts, or accreditation programs govern that work. Then connect each requirement to the records your laboratory needs. These might include approved procedures, personnel competency records, equipment documentation, quality control results, electronic records, or corrective actions.

Finally, identify who is responsible for maintaining each process and its supporting evidence. A compliance program becomes easier to manage when your team knows which requirements apply, which procedures address them, and where the corresponding records are stored.

Quality Management and Accreditation Standards

ISO/IEC 17025: Competence in Testing and Calibration

ISO/IEC 17025:2017 is the international standard for the competence, impartiality, and consistent operation of testing and calibration laboratories. It addresses personnel, equipment, metrological traceability, methods, sample handling, technical records, reporting, and management system requirements. ISO 17025 accreditation is not universally mandatory. However, customers, contracts, regulators, or particular testing programs may require accreditation for a defined scope of work.

Your lab must also consider how computerized systems affect the validity of its results. Under Clause 7.11, laboratories have responsibilities for data and information management, including ensuring systems perform appropriately for their intended use.

Our ISO 17025 Comprehensive Guide provides a detailed explanation of the requirements.

Evaluating software? Read Best Lab Software for ISO 17025 to compare platforms and the capabilities that can support your accreditation efforts.

ISO 9001: Quality Management Systems

ISO 9001 establishes requirements for an organization's quality management system (QMS). It addresses leadership, responsibilities, documented information, process control, performance evaluation, and continual improvement. Unlike ISO 17025, ISO 9001 certification does not establish technical competence for a specific scope of laboratory testing.

Important 2026 update: ISO 9001:2026 was published September 16, 2026, replacing the 2015 edition. The revised standard places greater emphasis on leadership, quality culture, and ethical behavior, and separates risks from opportunities more clearly.

Organizations already certified to ISO 9001:2015 have until September 30, 2029, to transition. Existing certifications that have not transitioned will expire or be withdrawn according to the applicable transition arrangements.

For guidance on certification and maintaining your QMS, read our ISO 9001 Guide for Labs.

If you're determining whether your quality program needs a dedicated QMS, a LIMS, or both, see Which Lab Software Do You Actually Need?.

Clinical Laboratory Compliance Requirements

CLIA: Certification and Ongoing Quality Requirements

The Clinical Laboratory Improvement Amendments (CLIA) establish quality standards for U.S. laboratories testing human specimens for health assessment, diagnosis, prevention, or treatment. Certificate requirements depend on the type and complexity of testing performed. For laboratories performing moderate- or high-complexity testing, personnel competency assessment is an ongoing responsibility.

CLIA regulations (42 CFR 493.1413 and 493.1451) specify six competency assessment procedures. Assessments must be performed at least semiannually during the first year an individual tests patient specimens, then at least annually. This is different from documenting that someone attended training.

Our CLIA Certification Guide explains certificate types, quality requirements, and ongoing responsibilities.

Comparing clinical laboratory software? Read LIMS vs. LIS: Which Is Right for Your Lab? to understand how different systems support laboratory and patient-centered workflows.

HIPAA: Protecting Patient Information

The Health Insurance Portability and Accountability Act (HIPAA) establishes privacy and security requirements for covered entities and business associates. HIPAA does not automatically apply to every laboratory.

For laboratories subject to its requirements, protecting health information involves appropriate safeguards for access, storage, transmission, workforce practices, and other activities. Patient identifiers may appear in specimen labels, test orders, worklists, results, reports, and communications. Your laboratory must evaluate where protected health information is stored, who can access it, and how it moves between systems.

Our HIPAA Compliance Guide for Labs covers these considerations, including the role of laboratory software in protecting sensitive information.

FDA-Regulated Laboratory Requirements

GxP: GMP, GLP, and GCP

GxP is an umbrella term for different good-practice frameworks used in regulated environments. Good Manufacturing Practice (GMP) addresses applicable manufacturing and quality activities. Good Laboratory Practice (GLP) governs certain nonclinical laboratory studies. Good Clinical Practice (GCP) applies to regulated clinical research activities. 

A pharmaceutical manufacturing QC laboratory may need to maintain controlled testing procedures, deviation records, investigations, and quality documentation. A nonclinical safety laboratory operates under different study-specific requirements. Your lab needs to identify the framework governing its work rather than treating GxP as one uniform set of obligations.

Read our GxP Compliance Guide for the distinctions and associated laboratory practices.

For related industry context, see QA/QC Requirements for Biotech Companies.

FDA 21 CFR Part 11: Electronic Records and Signatures

FDA 21 CFR Part 11 addresses electronic records and electronic signatures in circumstances covered by FDA requirements. Its applicability depends partly on the underlying FDA recordkeeping or submission obligations, often called predicate rules.

For records and signatures within its scope, laboratories need appropriate controls addressing access, integrity, traceability, and electronic approval processes. A generic electronic signature feature does not automatically establish Part 11 compliance. Your team must evaluate how records are created, maintained, reviewed, and retained, along with the controls available in its software.

Read our FDA 21 CFR Part 11 Guide for the regulatory overview.

Evaluating LIMS software? See The Best LIMS for 21 CFR Part 11 Compliance for a vendor-focused comparison.

Software Validation: CSV and CSA

Computer System Validation (CSV) and Computer Software Assurance (CSA) are approaches used to establish confidence in computerized systems. CSV emphasizes documented verification that systems operate as intended. CSA uses risk-based reasoning to determine appropriate assurance activities based on how software is used and the consequences of failure.

The FDA's February 2026 CSA guidance specifically addresses software used in medical-device production or quality management systems. It is not a universal replacement for every laboratory's validation obligations. Regardless of approach, your team needs to understand the software's intended use, relevant risks, and evidence that critical functions operate correctly.

Our CSV vs. CSA Guide explains the differences.

For planning, see Elements of a Successful Computer Systems Validation Plan.

Seven Common Compliance Issues

Although regulations differ across laboratories, many operational problems share similar causes. The following seven issues are worth evaluating against your own procedures.

1. Outdated or Incomplete SOPs

A procedure may exist but no longer reflect how testing is performed. Perhaps an instrument was updated or a method changed without revising the associated SOP. Check that procedures have appropriate approvals, version identification, review status, and availability. Staff should know which procedure is current and where to find it.

2. Missing Competency Records

Training and competency assessment are related but different. A training record documents instruction. A competency assessment provides evidence that personnel can perform their assigned duties. Different laboratory standards establish different competency requirements. Make sure your records demonstrate the activities and assessments required by your applicable framework.

3. QC Failures Without Documented Follow-Up

A failed quality control result should lead to appropriate review. Your team needs to understand what occurred, what work was affected, whether corrective action was necessary, and who reviewed the outcome. Trend monitoring and proficiency testing may also apply. The important question is whether your lab can demonstrate how it identified and addressed the problem.

4. Equipment Calibration and Maintenance Gaps

Regular maintenance does not automatically establish the calibration evidence required for an instrument's intended use. Your team should understand applicable maintenance, calibration, and traceability requirements. When equipment falls outside acceptable conditions, evaluate whether previously generated results may have been affected.

5. Chain of Custody Breakdowns

Chain of custody helps document relevant activities involving a sample throughout its lifecycle. Gaps can arise when samples change hands without required documentation or when storage conditions and exceptions are not recorded.

Our Chain of Custody Implementation Guide explains how to establish the appropriate controls.

For software evaluation, see What Labs Should Look for in Chain of Custody Software.

6. Corrective Actions That Never Fully Close

Opening a corrective and preventive action (CAPA) record is only the beginning. Your team may also need to investigate the underlying cause, assign actions, document completion, and evaluate effectiveness. Repeated findings can indicate that previous actions did not adequately resolve the issue.

7. Data Integrity and Audit Trail Gaps

Laboratories need confidence that records accurately represent the work performed. That includes maintaining original information where required, identifying relevant changes, and retrieving records for review. Uncontrolled spreadsheets and disconnected systems may make those tasks more difficult. Appropriate procedures, access controls, and software functionality can help maintain data integrity.

What Other Controls Help Labs Maintain Compliance?

Some controls appear across multiple laboratory standards, even when the underlying requirements differ.

Data integrity: Ensure records remain trustworthy throughout their lifecycle. The ALCOA+ principles offer a framework for reviewing how information is created, maintained, and retrieved. Read our Data Integrity Guide.

Chain of custody: Document relevant sample activities, transfers, and responsibilities according to your lab's requirements.

Inspection readiness: Maintain supporting records during normal operations instead of collecting them only when an inspection approaches. Our Inspection Readiness Guide covers preparation, documentation, and common inspection considerations.

How Can a LIMS Support Laboratory Compliance?

A laboratory information management system (LIMS) helps laboratories organize samples, testing workflows, results, and associated records. A quality management system (QMS) supports related processes such as document control, training records, quality issues, and corrective actions. Depending on your laboratory's requirements, these capabilities may be managed through separate systems or an integrated platform.

QBench brings laboratory operations and quality management functionality together. According to QBench's Security & Compliance page, the platform is ISO 17025-compatible and HIPAA-compliant, supports CLIA certification, and offers controls designed to support FDA 21 CFR Part 11 requirements.

QBench also undergoes an annual SOC 2 Type II audit, which evaluates the service provider's controls rather than accrediting a customer's laboratory. Its integrated QMS connects laboratory operations with quality processes. For example, QBench's Advanced plan includes equipment management, CAPA management, document control with versions and approvals, and training sets. Foundation includes role-based permissions, History Entries, and report eSignature and approvals. The separately named Audit Trail capability appears in QBench's Enterprise plan.

These distinctions matter when evaluating software for specific compliance obligations. Your lab should confirm that the selected configuration provides the controls required for its intended use. A LIMS can help organize laboratory and quality records, but software alone does not make a laboratory compliant. Your team remains responsible for determining which requirements apply, implementing appropriate procedures, and verifying that its systems perform as intended.

Anresco Laboratories’ Vice President and COO, Zachary Eisenberg, says QBench gives the lab the “flexibility to keep up with the ever-changing requirements placed on us by regulatory bodies” and its customers. 

Want to see how these capabilities fit your laboratory? Schedule a QBench demo to discuss your workflows, quality management requirements, and the functionality available in each plan.

Download the Free Regulatory Compliance Checklist

Our free Regulatory Compliance Checklist provides inspection-readiness steps, laboratory metrics to review, and software evaluation guidance.

Use it with your QA/QC team to identify areas requiring attention and organize your preparation for your next audit or inspection.

Frequently Asked Questions About Lab Compliance

What compliance does a testing laboratory need?

It depends on the laboratory's activities, industry, customers, and applicable regulatory or accreditation programs. ISO 17025, ISO 9001, CLIA, HIPAA, and FDA requirements serve different purposes.

Is ISO 17025 required for every laboratory?

No. ISO 17025 accreditation is not universally mandatory. It may be required by customers, contracts, regulators, or particular testing programs.

What is the difference between ISO 17025 and ISO 9001?

ISO 17025 addresses laboratory competence for specified testing or calibration activities. ISO 9001 establishes organizational quality management requirements. ISO 17025 uses accreditation; ISO 9001 uses certification.

Who needs to comply with CLIA?

CLIA generally applies to U.S. laboratories performing covered testing of human specimens for diagnosis, prevention, treatment, or health assessment. Requirements depend on the tests performed.

Does HIPAA apply to every laboratory?

No. HIPAA obligations depend on whether the organization is a covered entity or business associate and the activities it performs.

What is the difference between CSV and CSA?

CSV emphasizes documented system verification. CSA uses a risk-based approach to establishing software confidence. Applicable requirements depend on the system's intended use and regulatory context.

Can a LIMS make a laboratory compliant?

No software purchase automatically establishes laboratory compliance. A LIMS can support records, traceability, and controlled processes, but your laboratory must establish procedures, train personnel, and verify systems for their intended use.