FDA 21 CFR Part 11
FDA 21 CFR Part 11
Full name: Title 21 CFR Part 11, Electronic Records; Electronic Signatures
FDA 21 CFR Part 11 is the FDA regulation establishing the criteria under which electronic records and electronic signatures are considered trustworthy, reliable and equivalent to paper records and handwritten signatures. It applies to FDA-regulated industries, including pharmaceuticals, medical devices and food, whenever an organization chooses to maintain records electronically rather than on paper, requiring controls such as audit trails, access restrictions and validated systems.
Quick facts
| Category | Electronic records and signature integrity regulation |
|---|---|
| Used by | Pharmaceuticals, medical devices, biotechnology, food and other FDA-regulated industries |
| Also called | Part 11 |
| Related standards | FDA 21 CFR Part 820, FDA 21 CFR Part 210/211 |
| Related processes | Electronic signature, audit trail, data integrity, document control, validation |
| Semantic match | FDA 21 CFR Part 11, electronic records signatures, Part 11 compliance, data integrity regulation |
What is FDA 21 CFR Part 11?
FDA 21 CFR Part 11 sets the requirements an organization must meet for electronic records and electronic signatures to be considered as trustworthy and legally equivalent as their paper-based counterparts within FDA-regulated processes.
Core requirements include maintaining a complete, timestamped audit trail of record creation and changes, restricting system access to authorized individuals, validating systems to ensure they perform as intended, and implementing electronic signatures that are uniquely tied to specific individuals and cannot be repudiated.
Part 11 applies broadly across FDA-regulated industries whenever an organization uses electronic systems in place of paper records for activities subject to FDA predicate rules, such as manufacturing records, quality system documentation or clinical trial data.
Why is FDA 21 CFR Part 11 important?
Part 11 compliance gives organizations confidence that their electronic records will hold up to regulatory scrutiny, supporting the shift from paper-based systems to more efficient digital quality and manufacturing records.
Strong audit trails and access controls under Part 11 protect data integrity, ensuring that records cannot be altered without a documented, attributable history, which is essential for regulatory trust and internal quality assurance alike.
For organizations transitioning from paper to electronic systems, Part 11 compliance is often a gating factor, since a non-compliant electronic system could actually create more regulatory risk than the paper process it replaced.
How does FDA 21 CFR Part 11 work?
Key Part 11 compliance elements include:
- System validation. Validate that electronic systems perform reliably and as intended.
- Audit trails. Maintain timestamped records of all record creation, modification and deletion.
- Access controls. Restrict system access to authorized individuals with appropriate permissions.
- Electronic signatures. Implement signatures uniquely linked to individuals, with appropriate authentication.
- Record retention. Retain electronic records for the periods required by applicable predicate rules.
- Ongoing compliance. Maintain controls as systems are updated or replaced over time.
Electronic Records vs. Paper Records Under Part 11
| Comparison | Electronic Records (Part 11 Compliant) | Paper Records |
|---|---|---|
| Audit trail | Automatic, timestamped and system-enforced | Manual, dependent on process discipline |
| Access control | Role-based, system-enforced permissions | Physical security and procedural controls |
Real-world examples of FDA 21 CFR Part 11
A pharmaceutical manufacturer implements a validated electronic batch record system meeting Part 11 requirements, replacing paper batch records with a fully auditable digital process.
A medical device company uses Part 11-compliant electronic signatures for document approvals, ensuring each approval is uniquely attributable and cannot be repudiated later.
A contract manufacturer validates a new quality management system before go-live, confirming its audit trail and access control features meet Part 11 requirements ahead of an FDA inspection.
Regulations and standards related to FDA 21 CFR Part 11
FDA 21 CFR Part 11 applies to electronic records and signatures used in connection with FDA predicate rules, such as those found in 21 CFR Part 820 for medical devices or 21 CFR Part 211 for pharmaceutical manufacturing, rather than existing as a standalone requirement independent of those underlying regulations.
Organizations choosing to use electronic records and signatures in place of paper must demonstrate their systems meet Part 11's technical and procedural controls to maintain the same regulatory standing as paper-based equivalents.
How QT9 helps with FDA 21 CFR Part 11
QT9 QMS FDA 21 CFR Part 11 capabilities
- Provide a pre-validated system with automatic audit trails.
- Support compliant electronic signatures tied to individual users.
- Maintain complete, timestamped records of all system activity.
- Enforce role-based access controls for authorized personnel only.
- Deliver vendor-provided IQ, OQ and PQ documentation to reduce validation effort.
- Support audit-readiness with instant access to compliant electronic records.
Common mistakes with FDA 21 CFR Part 11
Common mistakes include assuming any electronic system automatically satisfies Part 11 without confirming it includes the required audit trail, access control and validation elements.
Other problems include failing to maintain validation documentation as systems are updated, creating gaps in the evidence needed to demonstrate ongoing Part 11 compliance.
Frequently asked questions
What does FDA 21 CFR Part 11 regulate?
Part 11 establishes the criteria for electronic records and electronic signatures to be considered trustworthy and equivalent to paper records and handwritten signatures within FDA-regulated processes.
Does Part 11 apply to every electronic system?
Part 11 applies specifically to electronic records and signatures used in connection with FDA predicate rules, such as those governing medical device or pharmaceutical manufacturing records, rather than to all electronic systems generally.
What is required for a compliant electronic signature under Part 11?
A compliant electronic signature must be uniquely linked to a specific individual, use appropriate authentication, and be non-repudiable, meaning the signer cannot later deny having applied it.
Why is an audit trail important for Part 11 compliance?
An audit trail provides a timestamped record of who created, modified or deleted a record and when, which is essential evidence that electronic records have not been altered without a documented, attributable history.
Does Part 11 require system validation?
Yes. Organizations must validate that electronic systems perform reliably and as intended before relying on them for regulated electronic records and signatures.
Can an organization use paper records instead of complying with Part 11?
Yes. Part 11 applies specifically to organizations that choose to use electronic records and signatures; organizations may continue using paper-based records and signatures without needing to meet Part 11's electronic-specific requirements.