21 CFR Part 11 did not change in 2026. Everything around it did.

Most quality leaders in life sciences can recite Part 11 without opening it. Validation. Audit trails. Signature manifestations. Access controls. Copies the FDA can actually read. The rule was published in 1997 and the requirements have barely moved since.

What has moved is the number of systems those requirements now apply to, and how fast those systems change underneath you.

The regulation held still. The environment did not.

On February 2, 2026, the amended Quality Management System Regulation took effect, replacing most of 21 CFR Part 820 with ISO 13485:2016 incorporated by reference. One day later, the FDA issued an updated final guidance, Computer Software Assurance for Production and Quality Management System Software, which supersedes the September 2025 version and aligns computer software assurance expectations to QMSR.

The interesting part is not the title change. It is the scope.

The guidance now formally defines cloud, IaaS, PaaS and SaaS. It names automation, analytics and AI or ML tools as in scope when they are used for production or quality purposes. It adds a subsection on software changes. It adds a worked example built around a SaaS product lifecycle system, in which the vendor is expected to document what an update changed, what was tested, and what the results showed. It retains a section on electronic records requirements, because Part 11 follows the record, not the vendor.

Read together, the message is straightforward. Your regulated record fabric is now assembled from systems whose release schedule you do not control.

One question is easy. The same question next quarter is hard.

"Is the system validated?" has a clean answer on the day you finish validation.

"Is the system validated?" has a much less comfortable answer eleven months later, after four vendor releases, two new integrations, a permissions restructure and a departure from the quality team.

That is the real shape of Part 11 work now, and it runs through every section of the checklist:

• Validation. Validated against which version, and who confirmed the last three releases did not touch a function you rely on for record integrity?
• Audit trailing. Every system that creates, modifies or deletes a regulated record needs a secure, time-stamped trail that survives the full retention period. Not just the eQMS. Every system.
• Electronic record integrity. Signature manifestations have to carry printed name, date, time and meaning, and they have to survive display, print and export. Signatures have to stay bound to the record they signed.
• Record copying. Accurate and complete copies, on paper and in electronic form, produced through an established export method. This is the question that gets answered in the room, under time pressure, with an investigator watching.
• Record retention and access control. Unique identification code and password combinations, periodic validity checks, and a working procedure for revoking access when a person leaves or transfers.

None of these are hard to understand. They are hard to keep true.

The three answers that go stale first

Scope drift. An engineering team adopts a new tool. Design inputs start living there. Nobody classifies it as a system holding regulated records, so nobody asks a single Part 11 question about it. The record fabric grew and the compliance boundary did not.

Change lag. SaaS systems update on the vendor's calendar. The FDA now expects the vendor to tell you what changed and what was tested. Somebody on your side still has to read that, decide whether it touched anything risk-relevant, and record the decision. Multiply by every connected system.

Access decay. Leavers, transfers, contractors, elevated permissions granted for one release and never withdrawn. Access control is the requirement most likely to be true on paper and false in the system.

Every one of these is invisible to a checklist run once a year. That is not a criticism of checklists. It is a statement about frequency.

Point-in-time compliance cannot cover a continuous surface

The standard response to this problem is more effort. A bigger validation package. A consultant every twelve months. A second quality hire whose real job is chasing other teams for evidence.

That response does not scale, and the arithmetic shows why. Add a system and the reconciliation work grows. Add a framework, ISO 13485 alongside Part 11 alongside EU MDR, and it grows again. Add a product line and it grows again. Headcount rises in step with complexity, and the quality function turns into a permanent evidence-gathering operation with no capacity left for the work that actually reduces risk.

The alternative is not a better filing cabinet. It is compliance that executes continuously: controls monitored rather than sampled, gaps surfaced when they open rather than at audit prep, evidence assembled as work happens rather than reconstructed afterwards, and continuous gap analysis across all your standards instead of a separate manual pass for each one.

Run against that standard, the checklist changes function. It stops being an annual exercise and becomes a specification: forty-odd questions your systems should be able to answer on any given Tuesday, without a fire drill.

Start with the questions

Before deciding how to keep the answers current, get precise about the questions. The checklist breaks Part 11 into five sections, validation, audit trailing, electronic record integrity, record copying, and record retention, and gives you the specific requirement behind each one.

Work through it once for your eQMS. Then work through it for every other system that touches a regulated record. The gap between those two passes is the most useful diagnostic you will run this quarter.

Get the FDA 21 CFR Part 11 checklist

Sources: FDA, Computer Software Assurance for Production and Quality Management System Software, final guidance, February 2026 (supersedes September 24, 2025). FDA, Medical Devices; Quality System Regulation Amendments, final rule effective February 2, 2026.