Usage Examples
- That eQMS is in Part 11 scope because the batch release approval lives in it.
- We cannot go live until the audit trail and the signature manifestation meet Part 11.
- Shared logins in the LIMS are a Part 11 finding waiting to happen.
What is 21 CFR Part 11?
21 CFR Part 11 is the FDA regulation governing electronic records and electronic signatures, setting the validation, audit-trail, access, and signature controls that make an electronic record equivalent to the paper record a predicate rule already requires.
21 CFR Part 11 exists because FDA had to decide whether a record on a screen carries the same weight as a signed page in a binder. Paper made tampering visible; a database row can be overwritten with no trace. Part 11 sets the criteria under which the agency treats electronic records and electronic signatures as trustworthy and equivalent to paper.
21 CFR Part 11 covers electronic records created, modified, maintained, archived, retrieved, or transmitted under any records requirement in an FDA regulation, plus the electronic signatures applied to them. Part 11 never creates the obligation to keep a record; the predicate rule does, whether that is 21 CFR 211 for drugs or Part 312 for INDs. Records kept outside any FDA requirement fall outside Part 11.
21 CFR Part 11 is applied as a scope decision followed by a control set. Teams map each system to the predicate rules it serves, then implement validation, access limits, authority checks, audit trails, and signature manifestations, and document all of it. FDA's August 2003 Scope and Application guidance narrowed how the agency interprets that scope, but it changed enforcement posture, not the regulation.
Not to be confused with
- Predicate rules
- a predicate rule (21 CFR 211, 58, 312, 820) says a record must exist and be retained. Part 11 says nothing about which records to keep; it governs only the electronic form of records another rule already demands.
- Computer system validation
- validation is a single control under 11.10(a), not a synonym for the rule. A fully validated system still fails Part 11 if signatures are shared or the audit trail can be overwritten.
- EU GMP Annex 11
- the European counterpart for computerised systems, issued as GMP guidance in the EudraLex framework rather than as US federal regulation. Meeting one does not establish compliance with the other, and their signature provisions differ.
- Digital signature
- a digital signature is one cryptographic implementation of a signature. Part 11 defines electronic signature far more broadly and accepts a two-component identification code and password, so cryptography is not required.
Part 11 obligations split into system controls (Subpart B) and signature controls (Subpart C).
What you must do
- 1Determine which of your electronic records are held under an FDA records requirement, because that determination, not the software category, is what pulls a system into scope21 CFR 11.1
- 2Validate the system, limit access to authorized individuals, apply authority checks, and keep secure, computer-generated, time-stamped audit trails21 CFR 11.10
- 3Display and print, on the signed record itself, the signer's printed name, the date and time of execution, and the meaning of the signature such as review or approval21 CFR 11.50
- 4Link every signature to its record so it cannot be excised, copied, or otherwise transferred to falsify a record by ordinary means21 CFR 11.70
- 5Build each non-biometric electronic signature from at least two distinct identification components, and administer them so that impersonation requires collaboration of two or more individuals21 CFR 11.200
Common mistakes
Buying "Part 11 compliant" software and treating the obligation as discharged
the rule binds the regulated company. A vendor can ship audit trails and unique accounts, but it cannot supply your training records, your written policy holding signers accountable, or your systems documentation controls. The 483 observation is written against you, not the vendor.
Shared or generic accounts in a GxP system
an electronic signature must be unique to one individual and never reused or reassigned, and 11.200 requires that impersonating a signer take collaboration of two or more people. A shared QA login defeats both, and every approval made under it becomes unattributable, which puts the underlying batch, study, or submission record in question.
Getting scope wrong in either direction
teams either validate systems no predicate rule touches, burning budget, or miss the spreadsheet that calculates a release decision and the tracker holding the deviation log. Scope follows whether an FDA regulation requires the record, so make and document that call system by system before designing controls.
When This Matters
- That eQMS is in Part 11 scope because the batch release approval lives in it.
- We cannot go live until the audit trail and the signature manifestation meet Part 11.
- Shared logins in the LIMS are a Part 11 finding waiting to happen.
Frequently Asked Questions
Part 11 applies to any system holding electronic records that an FDA regulation already requires you to keep, and to electronic signatures used in place of handwritten ones. Scope follows the record, not the software category: 11.1(b) reaches records created, modified, maintained, archived, retrieved, or transmitted under agency records requirements.
Related Use Cases
- Pharma Use Cases
Cut NDA and sNDA prep time by 60% with AI-assisted drafting and automated readiness checks
- Biotech Use Cases
Compress IND prep from 8-12 weeks to under 3 weeks with AI-assisted drafting and validation
- Regulatory Affairs Workflows
Cut regulatory intelligence tracking from 10+ hours/week to automated, real-time alerts
- Quality/QA Workflows
Track GxP regulation changes and enforcement trends
