21 CFR Part 11: what it is, who needs it, and how compliance works

What is 21 CFR Part 11?

21 CFR Part 11 is the FDA's rule for electronic records and electronic signatures. It sets the conditions under which the FDA accepts a record kept electronically, and a signature executed electronically, as equivalent to paper and a handwritten signature. It applies wherever another FDA regulation requires a record to be kept, and compliance is shown to an investigator at inspection.

The rule took effect on 20 August 1997 and its text has had no substantive revision since, apart from a 2023 technical amendment to how the signature certification is sent. The FDA's 2003 guidance on scope and application narrowed how the agency enforces it and still governs how it is read. There is no Part 11 certificate and no certification body.

Who needs to comply with 21 CFR Part 11?

Any FDA-regulated company that keeps a required record electronically in place of paper, whether the record is required by cGMP under 21 CFR 210 and 211, by the QMSR, by the clinical trial regulations or by GLP

Any company that signs those records electronically, from batch release and document approval to training completion and deviation closure

Contract research, manufacturing and testing organisations that keep the predicate records, which comply in their own right, while a software vendor supplies the controls its customer's compliance and inspection rely on

The rule becomes urgent when the first electronic approval replaces a wet signature, when an investigator asks who changed a record and when, or when a customer's supplier questionnaire asks whether the system that holds their records has an audit trail.

What Part 11 requires

Subpart A sets the scope: records a predicate rule requires, kept in electronic form, and signatures executed electronically. Subparts B and C carry the requirements an investigator reads against each system, and the 2003 guidance sets how narrowly they are applied.

Subpart B, 11.10(a), validation

The system is validated to show it does what it is meant to, with records that are accurate and reliable and with invalid or altered records detectable

Subpart B, 11.10(b) and (c), copies and retention

Accurate and complete copies in human-readable and electronic form for the FDA to inspect, and records protected and retrievable for as long as the predicate rule says

Subpart B, 11.10(d), (f), (g) and (h), access and authority checks

Access limited to authorised people, checks that only authorised people can sign, alter or use a record, operational checks that steps happen in the required order, and checks on the device or terminal the entry comes from

Subpart B, 11.10(e), audit trails

A secure, computer-generated, time-stamped record of who created, changed or deleted an entry and when, kept for as long as the record itself, available for inspection, with earlier entries never obscured

Subpart B, 11.10(i), (j) and (k), people and documentation

Training for everyone who develops, maintains or uses the system, written policies holding each person accountable for their signature, and change control over the system's own documentation

Subpart B, 11.30, open systems

The closed-system controls plus encryption and digital signatures where records travel over a system the company does not control

Subpart B, 11.50 and 11.70, signature manifestations and linking

A signed record shows the signer's printed name, the date and time and the meaning of the signature, and the signature is linked to its record so it cannot be copied or moved to another

Subpart C, 11.100, general requirements

Each electronic signature unique to one person and never reassigned, identity verified before the signature is issued, and a written certification to the FDA that electronic signatures are the legally binding equivalent of handwritten ones

Subpart C, 11.200, components and controls

A non-biometric signature uses at least two components, such as an identification code and a password, both entered at the first signing in a session and at least one at each signing after, and usable only by its owner

Subpart C, 11.300, identification codes and passwords

Each combination unique, periodically checked, revised or revoked, with procedures for lost cards and tokens and safeguards against unauthorised use

The 2003 scope and application guidance

The FDA reads the rule narrowly: it applies to records a predicate rule requires and to records a company relies on to perform regulated activities, and the agency exercises enforcement discretion on validation, audit trails, record retention and copies and on legacy systems, expecting the predicate rule and a documented, justified risk assessment to decide the controls

How Part 11 compliance works

1. Decide which records are in scope

List the records each predicate rule requires, mark which are kept electronically and which are signed electronically, and write the decision down for every system.

2. Assess each system against Subparts B and C

Audit trail, access and authority checks, signature manifestation and linking, copies for inspection and retention, and list what is missing.

3. Validate the systems in scope for their intended use

Scaled to the risk the record carries, and keep the validation documented, since the FDA's computer software assurance guidance for production and quality management system software now shapes how much testing that means.

4. Write the procedures and train the people

Signature accountability, account management and password controls, record retention, and the written certification to the FDA that electronic signatures are legally binding.

5. Keep it that way

Periodic review of audit trails, accounts and changes, with revalidation when a system changes, so the record an investigator pulls is the one your approver signed.

Standards that apply alongside 21 CFR Part 11

Pharma manufacturingEU GMP Annex 11: The EU's rule for computerised systems in GMP, which covers the same ground and reaches further into supplier assessment, periodic review and business continuity
Pharma manufacturingcGMP (21 CFR 210 and 211): The predicate rule for most pharmaceutical records Part 11 applies to, from batch records to deviation and complaint files
Medical devicesFDA QMSR: The predicate rule for device records, whose design, complaint and training records Part 11 governs once they are kept electronically
ClinicalICH E6 (R3): Good clinical practice, which expects the same controls on the electronic systems a trial runs on, with the FDA's own clinical guidance pointing back to Part 11
Management systemsISO 27001: The information security standard whose access control, logging and change management answer much of what Part 11 asks a system to show

xCures

xCures is a health and wellness start-up that provides an advanced algorithmic AI platform connecting cancer patients to targeted oncology treatment.

Read the xCures story

“Me getting back hundreds of hours in a year thanks to Qualio is the equivalent of about one FTE.”

Mike TrudnakVP of IT & Information Security, xCures

Guides and checklists for 21 CFR Part 11

Checklist

FDA 21 CFR Part 11 checklist

Guide

Complete guide to computerized system compliance

Guide

CSV to CSA: the evolution of digital life science quality

Questions about 21 CFR Part 11

What is 21 CFR Part 11?

21 CFR Part 11 is the FDA regulation that sets the conditions under which electronic records and electronic signatures are accepted as equivalent to paper records and handwritten signatures. It applies to records another FDA regulation requires, kept or signed electronically, and it has been in force since August 1997. Compliance is shown at inspection.

Who does 21 CFR Part 11 apply to?

Any FDA-regulated company that keeps a required record electronically or signs one electronically: drug and biologics manufacturers under cGMP, device manufacturers under the QMSR, sponsors, CROs and sites under the clinical regulations, and nonclinical laboratories under GLP. The predicate rule decides which records are required, and Part 11 decides how the electronic version has to behave.

Is there a 21 CFR Part 11 certification?

No. Part 11 is a regulation and no body certifies against it, so there is no Part 11 certificate for a company or for software, and no vendor can comply on a customer's behalf. A vendor shows how its system supports the controls the rule names. The customer validates that system for its own use, writes the procedures and keeps the records.

What is the difference between 21 CFR Part 11 and EU Annex 11?

Part 11 is US law for electronic records and signatures wherever an FDA regulation requires a record to be kept. Annex 11 is the EU GMP guide for computerised systems used in GMP activities, and it reaches further into validation, supplier assessment, periodic review and business continuity. A company selling in both markets runs one set of controls that answers both.

Does 21 CFR Part 11 require an audit trail?

Yes, under 11.10(e): a secure, computer-generated, time-stamped audit trail that records who created, changed or deleted an entry and when, kept for as long as the record and available for inspection. The 2003 guidance applies enforcement discretion to the requirement, and the FDA still expects it wherever the predicate rule or data integrity depends on it.

Do we have to certify electronic signatures to the FDA?

Yes. Section 11.100(c) requires a company using electronic signatures to certify to the FDA, in writing, that its electronic signatures are intended to be the legally binding equivalent of handwritten signatures. It is a single company-wide certification, signed by hand and sent electronically or on paper prior to or at the first use of electronic signatures, and the FDA can ask for further certification or testimony on a specific signature.

Can we add 21 CFR Part 11 to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the procedures, validation records and training you already hold against every section, beside cGMP, the QMSR or Annex 11 if you run those too. Sections the frameworks share count once, and the first assessment lists what is covered and what is missing.

Who changed that record, and when?

Bring one record and the procedure it followed. We will show you Part 11 assessed against your procedures section by section, the audit trail behind it, and the evidence exported the way an investigator asks.

Book a demo Get the Part 11 checklist

Less time on audit prep. More time on quality.