GxP training software: where a modern LMS fits in pharma

GxP training software delivers, tests and records the training GMP, GLP and GCP rules require. For pharma, CDMO and biotech teams that want engaging GMP onboarding, proctored qualification exams and verifiable certificates next to their validated eQMS, LMS Advisor is our top pick. Keep e-signed SOP records in document control, or pick a GxP specialist if one validated system must hold everything.

This guide is for training managers, QA heads and site leaders at small and mid-size drug manufacturers, CDMOs, 503B outsourcing facilities, contract labs and scaling biotechs, and for the IT and CSV leads who will assess whatever you buy. It covers what the rules say about training, which records fall under Part 11, a two-system setup, vendor questions and how the main options compare. LMS Advisor is our platform, and we have spent years building, fixing and migrating LMS platforms, so we will be specific about where it stops.

What do GxP rules actually require from training?

Less than vendor pages suggest, and more than a signature sheet proves. The rules ask for qualified people and records that show it, not hours, formats or software.

21 CFR 211.25: operations, CGMP and sufficient frequency

For finished drug manufacturing, 21 CFR 211.25(a) says training "shall be in the particular operations that the employee performs and in current good manufacturing practice" as it relates to that person's job, conducted by qualified individuals "on a continuing basis and with sufficient frequency to assure that employees remain familiar with CGMP requirements applicable to them."

There is no hour count and no annual cycle. Your SOP sets the frequency, and QA has to defend it. FDA's quality systems guidance for pharmaceutical CGMP fills in the expectation, calling continued training critical to keeping employees proficient and listing "Evaluation of effectiveness of training" and "Documentation of training and/or re-training" as parts of a sound program. FDA's data integrity Q&A (Q16) also says training staff to prevent and detect data integrity issues is consistent with 211.25, so a data integrity refresher belongs in the routine curriculum.

GLP and GCP training records

Nonclinical labs work under 21 CFR 58.29, which requires each testing facility to "maintain a current summary of training and experience and job description" for everyone engaged in or supervising a study. Clinical teams follow ICH E6(R3), which FDA published as final guidance on September 9, 2025.

EU GMP Chapter 2: periodic effectiveness checks

If you export to the EU or face PIC/S-style inspections, EudraLex Volume 4, Chapter 2 asks for training of everyone whose duties take them into production, storage or control labs, training for new recruits "appropriate to the duties assigned to them", and continuing training whose "practical effectiveness should be periodically assessed." That is why a scored check after an SOP course carries more weight than a read-and-understood click.

What FDA cites in warning letters

Training findings are usually about following your own procedure. In a March 16, 2026 warning letter to a testing lab, under the heading "Training Program", FDA wrote: "Your training program is inadequate. CGMP training is not regularly performed at your firm as required by your established procedure." Pick a system that makes overdue training visible. Our guide to GMP training requirements covers 211.25 in more depth.

Which training records are Part 11 records?

Not all of them, and the answer decides how much validation work your LMS choice creates.

Predicate rules and records kept in place of paper

FDA's Part 11 scope and application guidance (August 2003) applies Part 11 to "Records that are required to be maintained under predicate rule requirements and that are maintained in electronic format in place of paper format", and to electronic records kept alongside paper "that are relied on to perform regulated activities." A predicate rule is the underlying GMP, GLP or GCP requirement, such as 211.25. A gowning video or a practice quiz is not a record any predicate rule asks you to keep. The signed acknowledgment that an operator was trained on SOP version 7 before running the line probably is.

Hybrid approaches FDA allows

The same guidance says that when printouts meet the predicate rule and are what the firm relies on, FDA "would generally not consider persons to be 'using electronic records in lieu of paper records'." FDA also exercises enforcement discretion on validation and audit trails, while recommending decisions based on "a justified and documented risk assessment", and still enforces the electronic signature sections.

Where training-record validation risk actually sits

The heavy controls in 21 CFR 11.10 and 11.50 (validation, time-stamped audit trails, authority checks, and signatures that show printed name, date and time, and meaning) matter most for the record your procedures treat as the official training record. So write down, record type by record type, where the official version lives. Our post on Part 11 and training records walks through the scope questions, and the training records retention table covers how long to keep each file.

How does a two-system setup work?

360Learning's August 2026 pharma LMS list splits the field into validated GxP platforms and modern LMSs and says "one of these categories is rarely sufficient." The pattern we recommend gives each system one job:

1. Document control (eQMS or validated LMS). SOP versions, change control, the e-signed read-and-understand record and the training matrix your procedures define.
2. Modern LMS (LMS Advisor). The course built on that SOP, video of the procedure, knowledge checks, proctored qualification exams, contractor and client-staff training, and certificates with requalification dates.
3. The link between them. Completion and certificate-issued webhooks, the REST API or a regular CSV export feed an integration you build, which creates or updates the signed record in the eQMS.

What a modern LMS does better

Teaching and testing. eQMS training modules route a document to a role well and are weak at interactive video, question pools, secure exams and training for people outside your directory.

Passing completions by webhook or API

Map one event first: a learner passes the SOP course, the completion webhook fires, and your integration creates the training record in the eQMS for QA to sign. Before you design the eQMS record, check in a demo which fields the completion webhook sends (the learner, course, date and score are the minimum most record designs need), then test the round trip on one SOP.

How do you run GMP onboarding and refreshers in LMS Advisor?

SOP PDFs with required blocks and minimum time

1. Create one course per SOP family (gowning, cleaning, line clearance, sampling) with sections for each procedure.
2. Add the controlled SOP as a PDF lesson and set a lesson minimum time, so nobody scrolls through a 20-page procedure in a minute.
3. Add an interactive module that walks through the critical steps with callouts, flip cards and drag-and-drop items, and mark those blocks as required.
4. End with a scored knowledge check drawn from real deviations, then switch on sequential progression.
5. Assign the course to each role group with a due date and a mandatory flag, and review the overdue report weekly.

Automations email people who never started, stalled mid-course or have not logged in. There are no reminder emails tied to the due date itself, so the overdue report is the thing to watch.

Interactive video of gowning, line clearance and sampling

Ask your best operator to perform the procedure once in front of the Recording Studio (camera, screen or both). Then add chapters, overlay notes and timestamped questions with interactive video, so a wrong answer on glove sequence rewinds to that step. Course and lesson translations help multilingual sites teach from one approved recording.

Data integrity refreshers

Build a short annual course on ALCOA principles, audit trail review and good documentation practice, using examples from your own logbooks. If you use AI authoring, drafts are never published automatically, and an admin can switch AI off entirely or choose Anthropic or OpenAI. We suggest keeping it off for SOP content, or reviewing every draft line by line.

Want to see this on one of your SOPs? Book a demo and bring a procedure you train on today.

How do you build qualification exams you can defend?

Question pools, difficulty and image hotspot defects

Qualification exams belong in the Test Center, which has its own candidate portal and does not need a course enrollment. Tag questions by difficulty, draw each attempt from a pool larger than the exam, and use image hotspot questions for visual inspection: show a vial or a blister photo and ask the candidate to click the defect. Essay and file-upload exam questions are screening items and do not count toward the score, so keep pass or fail on the scored items.

Native proctoring and the evidence trail

Each exam gets its own proctoring settings: periodic webcam snapshots with AI face monitoring (no face or more than one face), fullscreen lockdown, blocked and logged tab switching, copy and paste and right-click, ID photo capture, single-session and device lock, virtual-machine detection and screen snapshots. Snapshots and flagged events go into an evidence trail for review, which is what you will open when a requalification result is challenged.

Requalification with expiring course certificates

Exam certificates do not expire in LMS Advisor, so model periodic requalification on a course certificate. Give the course a validity period in months, and the certificate shows its expiry, flags as expiring soon in the last 30 days and renews when the learner retakes the course. An automation can email the learner before it lapses, and each certificate has a public verification page. The certificates and compliance page shows the settings.

What to ask any LMS vendor about 21 CFR Part 11

Ask a GxP specialist and a modern LMS the same things. Where we stop, we say so.

1. Validation deliverables and who owns them. Does the vendor supply IQ/OQ/PQ or CSA-style evidence, and what is left to you? We ship no validation package, so your QA team documents its own intended use.
2. Audit trail content and retention. What is logged, can it be altered, and how long is it kept? We have audit logs and data retention settings, but we do not claim they meet 11.10(e). Confirm in a demo which events are captured and whether an entry can be changed.
3. Electronic signature manifestation and uniqueness. Does a signed record show printed name, date and time and the meaning of the signature, as 11.50 requires? We do not provide Part 11 e-signatures on training records.
4. Access control, SSO, 2FA and authority checks. We support roles and permissions, SAML 2.0 SSO, SCIM 2.0 provisioning, two-factor authentication and passkeys.
5. Release timing for SaaS and self-hosted installs. Who decides when new code reaches production? We run in our cloud or self-hosted, and self-hosting lets you schedule upgrades. Our self-hosted vs cloud comparison covers the trade-offs.

For medical device production and quality system software, FDA's Computer Software Assurance guidance (September 2025) sets out a risk-based approach worth reading on the drug side too. In the EU, the consultation on a revised Annex 11 and a new Annex 22 closed on October 7, 2025. As of September 2026 the EudraLex Volume 4 page still lists the January 2011 Annex 11, so treat the revised texts as drafts until they are adopted. Security questions for the platform itself are covered on our security and data ownership page.

How do GxP training software options compare?

Vendor claims below are as of September 2026, taken from each vendor's own page. Prices are left out.

LMS Advisor: best overall for teaching and testing next to an eQMS. Timed SOP courses, interactive video, native proctoring, requalification dates and webhooks into your record system. It is the wrong choice as the only system of record for e-signed GxP training.

UL ComplianceWire: best for one validated system with content. UL says it helps "scale trainings to meet regulatory and industry standards in a FDA CFR Part 11 validated system" and offers over 1,000 standard regulatory and knowledge courses.

Veeva Training: best for Veeva Vault shops. Veeva says training "is unified with QualityDocs, ensuring access to source content and automating re-training based on changes". That automatic retraining is the feature we do not have.

Cornerstone Life Sciences: best for a single global enterprise LMS. Cornerstone produces "validation deliverables with every release" and says it can meet Part 11 through configuration, including electronic signatures.

GyrusAim and eLeaP: best for mid-size firms wanting validation in one product. GyrusAim calls itself "a validated LMS". eLeaP's July 2026 buyer guide says its QMS and LMS "run as one validated system, not two integrated tools" and that "SOP revisions then cascade retraining to every affected role".

What do CDMOs, 503Bs and scaling biotechs need?

CDMO: client audits and contractor training

Put each site in a branch and each client program in an organization or group, so reports can be filtered by program. Confirm in a demo how narrowly a program lead's manager view can be scoped before you promise a client that separation. Temps and contractors without company email sign in with a one-time code by SMS or WhatsApp, on the web or in the iOS and Android app. Interactive modules with required blocks run on the web, and quizzes and exams need a connection.

503B outsourcing facilities: aseptic and visual inspection training

Aseptic technique theory and visual inspection are where video and image questions earn their keep. Film the gowning sequence, then qualify people with a proctored exam built on hotspot photos of real defects. Hands-on media fills and practical sign-offs stay with your qualified trainers and your quality system.

Biotech: GCP and GLP before GMP

A scaling biotech usually needs GCP training for clinical staff and vendors, GLP for the lab and onboarding for a team that grows every quarter, before a validated suite makes sense for every course. SCIM provisioning handles joiners, movers and leavers, and SCORM, xAPI or cmi5 packages from your CRO or content vendor upload as lessons.

Implementation checklist

• List which training records your predicate rules require and where the signed version lives.
• Decide per record type: eQMS, a validated LMS, or LMS Advisor with export.
• Write a risk assessment for the LMS use (CSA style) and keep it.
• Map roles to curricula in your SOP and mirror them as groups and course assignments.
• Define refresher frequency and effectiveness checks per role.
• Build SOP courses with required blocks, minimum time and a scored check.
• Set exam blueprints, pools, pass marks and proctoring settings.
• Use course certificates with validity periods for requalification.
• Configure SSO, SCIM, two-factor authentication and role permissions.
• Set up the webhook integration or a regular export into the record system and test it on one SOP.
• Decide AI settings: off, or drafts reviewed before publishing.
• Agree data retention and the export format you will hand an inspector.

Honest limits: where LMS Advisor stops

• We do not market LMS Advisor as meeting Part 11 on its own, and it comes with no validation package. If you use it for records a predicate rule requires, your QA team must assess and validate that use.
• No Part 11 electronic signature manifestation (printed name, date and time, meaning) on training records.
• No automatic retraining when a controlled SOP is revised. Reassign the course by hand or through the API.
• No training matrix module. Approximate it with groups and course assignments.
• No GMP or GxP content library. Build from your SOPs or upload packages from a content vendor.
• No SOC 2, ISO 27001 or HIPAA attestation and no eQMS connector (REST API and webhooks only). HR and CRM connectors cover only BambooHR, Zoho People, Keka, HubSpot and Zoho CRM. Proctored qualification exams are taken on a computer, not in the mobile app.

If your procedures require every read-and-understand record to be e-signed in a vendor-validated system, use a GxP specialist such as ComplianceWire, Veeva Training or GyrusAim, or your eQMS training module, for those records. LMS Advisor can still teach and test around them. The pharmaceutical and life sciences overview shows the other programs it runs, from rep certification to device customer training.

Frequently asked questions

What is GxP training software?

It is the software a regulated life sciences company uses to teach, test and document the training that GMP, GLP and GCP rules require of its people. Some products are sold as validated systems that hold the official record with Part 11 signatures. Others, like LMS Advisor, focus on teaching and testing and pass completions to the system that holds the record.

What is the best GxP training software for a CDMO or mid-size manufacturer?

LMS Advisor is our top pick when you want engaging SOP courses, proctored qualification exams and contractor training next to an eQMS that keeps the signed records. LMS Advisor is our platform. If you need one validated system for everything, look at ComplianceWire, Veeva Training or GyrusAim.

Does GxP training software have to be validated?

It depends on the records it holds. If the system keeps records a predicate rule requires, in place of paper or relied on for regulated activities, FDA recommends basing validation on a documented risk assessment. If the official record lives in your eQMS, the LMS that taught the course carries less of that burden, but your QA team should still document that decision.

Do Part 11 rules apply to every electronic training record?

No. FDA's 2003 scope guidance applies Part 11 to records required by predicate rules that are kept electronically in place of paper, or relied on to perform regulated activities. A practice quiz or an optional video usually falls outside that, while the official training record for a GMP operation usually falls inside.

Is LMS Advisor suitable as a Part 11 system of record?

Not on its own, and we do not claim it is. It has no vendor validation package and no Part 11 electronic signature on training records. Use it to teach and test, and keep the e-signed record in your eQMS.

How often must GMP training be repeated?

21 CFR 211.25 sets no fixed interval. It requires CGMP training on a continuing basis and with sufficient frequency, so your SOP defines the cycle and FDA expects you to follow it, as the March 2026 warning letter above shows.

Ready to test the two-system setup? Book a demo and we will build a GMP onboarding course from one of your SOP PDFs, run a proctored qualification exam and show the completion webhook that feeds your eQMS.