FDA 21 CFR Part 11

Why does it matter?

Part 11 is the rule the FDA inspects against whenever a regulated record exists only as data in a system. It decides whether a batch record, a laboratory result, a device history record or a case report form can stand in an inspection or a submission in place of paper, and whether a signature applied in software can carry the same legal weight as one in ink. A system that cannot show validation, an audit trail and controlled signatures gives the FDA grounds to question every record it holds (11.1(e)).

Key benefits include:

• Records that hold up in an inspection

Validation, accurate and complete copies, and protection of records through the retention period (11.10(a) to (c)) make electronic records usable as evidence.

• Signatures with legal weight

Electronic signatures that meet Subpart C are the legal equivalent of handwritten signatures, initials and other signings required by FDA regulations (11.1(c)).

• Traceable changes

Secure, computer-generated, time-stamped audit trails record who created, changed or deleted a record and when, without obscuring earlier entries (11.10(e)).

• Accountability for signers

Written policies hold individuals accountable for actions taken under their electronic signatures, to deter falsification (11.10(j)).

• A risk-based scope

The 2003 guidance lets firms document a risk assessment and decide where validation and audit trails are warranted rather than treating every system alike.

How does it work?

Part 11 has three subparts. Subpart A (11.1 to 11.3) sets scope, implementation and definitions, including closed system (access controlled by the people responsible for the records), open system (access not so controlled), electronic record, electronic signature and digital signature. Subpart B (11.10 to 11.70) covers electronic records. Subpart C (11.100 to 11.300) covers electronic signatures.

For a closed system, 11.10 lists eleven controls, (a) through (k): validation; accurate and complete copies in human readable and electronic form; protection of records for ready retrieval; limiting access to authorized individuals; audit trails; operational system checks that enforce permitted sequencing; authority checks; device checks; education, training and experience of the people who develop, maintain or use the system; written accountability policies; and controls over system documentation and its change history. An open system adds measures such as document encryption and digital signature standards (11.30).

A signed electronic record must show the printed name of the signer, the date and time of signing and the meaning of the signature, such as review, approval, responsibility or authorship (11.50), and the signature must be linked to its record so it cannot be excised, copied or transferred (11.70). Each signature is unique to one individual and never reassigned (11.100(a)), identity is verified before a signature is issued (11.100(b)), and the organization certifies to the FDA, with a traditional handwritten signature, that its electronic signatures are the legally binding equivalent of handwritten ones (11.100(c)).

Key Elements

• Scope and implementation (11.1 and 11.2)

Part 11 applies to electronic records kept under FDA records requirements and to electronic submissions; records submitted to the agency must be of a type identified in public docket 92S-0251 as accepted electronically. Several food safety and labeling record requirements are excluded (11.1(f) to (p)).

• Controls for closed systems (11.10)

Eleven procedures and controls designed to ensure authenticity, integrity and, when appropriate, confidentiality of electronic records, and that a signer cannot readily repudiate a signed record.

• Controls for open systems (11.30)

The 11.10 controls as appropriate, plus encryption and digital signature standards to protect records from creation to receipt.

• Signature manifestations and linking (11.50 and 11.70)

Printed name, date and time, and meaning displayed with every signed record, and a binding of the signature to the record that ordinary means cannot break.

• Electronic signature components (11.200)

Non-biometric signatures use at least two distinct components such as an identification code and password; the first signing in a session uses all components and later signings at least one component only the signer can use. Misuse by another person must require the collaboration of two or more individuals.

• Identification codes and passwords (11.300)

Unique code and password combinations, periodic checking, recall or revision of issuances, loss management for tokens and cards, transaction safeguards that detect and report unauthorized use, and initial and periodic testing of devices.

What does it cover?

Part 11 applies to every FDA program area: drugs, biologics, medical devices, foods, cosmetics, tobacco and veterinary products, and to any person who keeps electronic records or uses electronic signatures to satisfy an FDA records requirement, including sponsors, manufacturers, laboratories, clinical investigators and contract organizations. It does not apply to paper records that are merely transmitted electronically (11.1(b)) or to the food safety records listed in 11.1(f) to (p). Under the 2003 guidance, the FDA interprets the scope narrowly: records required by predicate rules that are kept electronically in place of paper, and electronic records relied on to perform regulated activities, are in scope.

What are its objectives?

Part 11 exists so that electronic records and signatures can replace paper without weakening the evidence the FDA relies on.

State the criteria under which electronic records and signatures are trustworthy, reliable and equivalent to paper (11.1(a)).

Ensure the authenticity, integrity and, where appropriate, confidentiality of records kept on closed and open systems (11.10 and 11.30).

Make every electronic signature attributable to one verified individual and legally binding (11.100).

Keep an independent, time-stamped record of who did what to a regulated record and when (11.10(e)).

Keep systems, controls and documentation available for FDA inspection (11.1(e)).

Framework in Context

Part 11 sits on top of the predicate rules that require the records in the first place: the current good manufacturing practice regulations in 21 CFR Parts 210 and 211 and the quality system regulation for devices, among others. The FDA's 2003 guidance and its October 2024 clinical investigations guidance explain how the agency applies the rule in practice, and firms that also supply Europe align their validation and audit trail approach with EU GMP Annex 11 and the GAMP 5 good practice guide.

Common Framework Mappings

FDA 21 CFR Part 11 is often mapped to other regulatory and industry frameworks to harmonize controls, ensure data integrity, and facilitate efficient compliance across pharmaceutical, biotech, and related quality management programs.

Mapped frameworks include:

EU GMP Annex 11 – Computerised Systems

FDA 21 CFR Part 210/211 – cGMP for Finished Pharmaceuticals

GAMP 5

ICH Q10 – Pharmaceutical Quality System

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2