Regulatory glossary

21 CFR Part 11: Electronic Records and Signatures, Explained

21 CFR Part 11 is the FDA regulation that sets the conditions under which the agency will accept electronic records and electronic signatures as equivalent to paper records and handwritten signatures. It has been in force since 1997.

The point is not to regulate software. It is to make an electronic record as hard to alter undetectably as a signed paper one, so that an inspector can trust what a system shows them years after the fact.

The predicate rule is the whole key

Part 11 does not apply to every electronic record you hold. It applies to records that some other regulation already requires you to keep, where you have chosen to keep them electronically instead of on paper.

That other regulation is called the predicate rule. It might be GMP under 21 CFR 211, GLP under Part 58, GCP under Part 312, or the device quality requirements in Part 820.

Two consequences follow, and both get missed:

• No predicate rule, no Part 11. A spreadsheet nobody is required to keep is not a Part 11 record, however important it feels internally.
• Part 11 never replaces the predicate rule. Meeting Part 11 does not discharge the underlying GMP or GCP obligation. It sits on top of it.

What Part 11 requires

For closed systems, where access is controlled by the people responsible for the content, the regulation calls for:

• Validation sufficient to ensure accuracy, reliability and consistent intended performance, including the ability to detect invalid or altered records.
• Accurate and complete copies in both human-readable and electronic form, so an inspector can actually be given the records.
• Record protection for the whole retention period, so they stay accurate and retrievable.
• Limiting system access to authorised individuals.
• Secure, computer-generated, time-stamped audit trails that record who did what and when, and that do not obscure previously recorded information.
• Operational and authority checks enforcing permitted sequences of steps and who may perform them.
• Device checks, where relevant, to validate the source of data input.
• Education, training and experience appropriate to the task.
• Written policies holding people accountable for actions taken under their electronic signature.

Open systems, where access is not controlled by the responsible party, add measures such as encryption and digital signature standards.

Electronic signatures

An electronic signature must be unique to one individual and never reused or reassigned. The organisation must verify the person's identity before issuing it.

Signatures not based on biometrics must use at least two distinct identification components, typically a user ID and a password. Within a continuous session the full pair is required for the first signing and one component thereafter; a signing outside a continuous session requires both again.

Every signed record must show, in a form the record itself carries:

• the printed name of the signer
• the date and time of signing
• the meaning of the signature, such as review, approval or authorship

That last item is the one auditors probe. A signature that does not say what it signified is weak evidence of anything.

Enforcement discretion, and why it matters

When Part 11 was new, a broad reading of it caused enough industry disruption that FDA published a 2003 guidance, Part 11, Electronic Records; Electronic Signatures — Scope and Application, which is still the practical reference.

It did two things. It narrowed the scope to records genuinely required by a predicate rule and maintained electronically. And it stated FDA's intent to exercise enforcement discretion over parts of the regulation, including validation, audit trails, record retention and record copying, in favour of a risk-based approach.

The trap: enforcement discretion applies to Part 11, not to the predicate rule. If GMP requires you to validate a system, you still have to validate it. The discretion narrows which Part 11 technical controls FDA will cite, not whether the underlying obligation exists. "Part 11 is discretionary now" is a misreading that has produced real findings.

Where teams actually fail

• Shared logins. Instantly destroys attributability and, with it, the meaning of every signature applied from that account.
• Audit trails that exist but are never reviewed. The regulation expects them to be used, not merely switched on. Unreviewed audit trails are a common observation.
• Audit trails that can be disabled. If an administrator can turn one off, it evidences nothing for the period it was off.
• Spreadsheets doing GxP work. Often the largest uncontrolled Part 11 surface in a company, precisely because nobody thinks of them as a system.
• Vendor claims taken at face value. Software can be capable of Part 11 compliance. Compliance is a property of how you configure, validate and operate it, and the obligation is yours, not the vendor's.
• Hybrid systems. Printing an electronic record and signing the paper does not remove the electronic original from scope.

Part 11 and Annex 11

The EU equivalent is EudraLex Volume 4, Annex 11, covering computerised systems in GMP. The two overlap heavily but are not identical: Annex 11 is written around risk management and the supplier relationship, and covers areas such as periodic evaluation and business continuity more explicitly. Companies shipping to both markets generally build one system satisfying the stricter reading of each requirement rather than maintaining two.