21 CFR Part 11: Electronic Records and Signatures Explained

21 CFR Part 11 is the US Food and Drug Administration regulation that defines when electronic records and electronic signatures are trustworthy, reliable and equivalent to paper records and handwritten signatures. It applies whenever companies in FDA-regulated industries, such as pharmaceuticals, medical devices, biologics and clinical research, keep required records electronically or submit them to FDA. Laboratory systems, quality management software, clinical trial platforms and manufacturing systems all fall within its reach.

The regulation dates from 1997, but FDA guidance has shaped how it is applied: a 2003 guidance narrowed its scope and introduced enforcement discretion, a 2024 guidance answered questions for clinical investigations, and a 2025 guidance on Computer Software Assurance encouraged risk-based validation for device makers. This guide explains the requirements, how validation works today, and what software vendors should build.

What is 21 CFR Part 11?

Part 11 has three subparts. Subpart A sets the scope and definitions. Subpart B covers electronic records, including controls for closed and open systems, signature manifestations and linking signatures to records. Subpart C covers electronic signatures, including general requirements, components and controls, and controls for identification codes and passwords. It became effective on 20 August 1997.

Part 11 does not itself say which records must be kept. Those requirements come from "predicate rules", the underlying FDA regulations such as good manufacturing practice, good clinical practice, good laboratory practice and device quality system requirements. Part 11 applies when those records are kept or signed electronically.

Scope and FDA's narrow interpretation

FDA's 2003 guidance, "Part 11, Electronic Records; Electronic Signatures: Scope and Application", explained that FDA interprets Part 11 narrowly. It applies to records required by predicate rules that are maintained electronically in place of paper, records maintained in electronic form and relied on to perform regulated activities, records submitted to FDA electronically, and electronic signatures intended to be equivalent to handwritten signatures. FDA also said it would exercise enforcement discretion on certain requirements, including validation, audit trails, record retention and record copying, while still expecting companies to meet predicate rule requirements and to take a justified, risk-based approach. Other Part 11 controls, such as access controls and electronic signature requirements, remain enforced.

Who must comply?

• Pharmaceutical and biotech manufacturers, for GMP records such as batch records and quality records.
• Medical device manufacturers, for design, production and quality records.
• Clinical trial sponsors, CROs and sites, for electronic data capture, eTMF, ePRO and related systems.
• Laboratories generating data for regulated submissions.
• Food, tobacco and other FDA-regulated industries where predicate rules require records.
• Companies outside the US that make products for the US market or submit data to FDA.

Software vendors are not regulated directly, but their customers must use systems that can meet Part 11, and vendors are expected to provide the features and evidence needed.

Is it mandatory or voluntary?

Mandatory for covered records and signatures. There is no Part 11 certification for software; a vendor can say its product has features that support Part 11, but the regulated company must validate the system for its intended use and operate it with appropriate procedures.

Controls for closed systems (11.10)

A closed system is one where access is controlled by the people responsible for the records. Required controls include:

• Validation to ensure accuracy, reliability, consistent intended performance and the ability to detect invalid or altered records.
• Accurate and complete copies of records in human-readable and electronic form for FDA inspection.
• Protection of records for accurate and ready retrieval throughout the retention period.
• Limiting system access to authorised individuals.
• Secure, computer-generated, time-stamped audit trails recording the date and time of operator entries and actions that create, modify or delete records, without obscuring previous values, retained as long as the records.
• Operational system checks to enforce permitted sequencing of steps and events.
• Authority checks so only authorised individuals can use the system, sign records, access operations or alter records.
• Device checks to determine the validity of data input sources where appropriate.
• Training and qualifications of people who develop, maintain or use the systems.
• Written policies holding individuals accountable for actions taken under their electronic signatures.
• Controls over system documentation, including distribution, access and change control with audit trails.

Open systems, where access is not controlled by those responsible for the records, need these controls plus measures such as encryption and digital signatures to ensure authenticity, integrity and confidentiality.

Electronic signatures

• Signature manifestation (11.50): signed records must show the printed name of the signer, the date and time of signing, and the meaning of the signature, such as review, approval, responsibility or authorship.
• Signature and record linking (11.70): signatures must be linked to their records so they cannot be removed, copied or transferred to falsify records.
• Uniqueness (11.100): each electronic signature must be unique to one individual and not reused or reassigned, and the organisation must verify the person's identity. Organisations must certify to FDA that their electronic signatures are intended to be the legally binding equivalent of handwritten signatures.
• Components (11.200): non-biometric signatures must use at least two distinct identification components, such as user ID and password; in a continuous session, the first signing uses all components and later signings at least one; biometric signatures must be designed so they can only be used by their owner.
• Identification codes and passwords (11.300): maintain uniqueness, periodically check and revise, manage lost credentials, use safeguards against unauthorised use and report attempts, and test devices such as tokens.

Validation and Computer Software Assurance

Computerised systems used for regulated records must be validated for their intended use. Traditionally, this produced large volumes of test scripts and documentation, often called computer system validation (CSV). In September 2025, FDA finalised guidance on Computer Software Assurance (CSA) for production and quality system software used by medical device manufacturers, with an update reported in early 2026. CSA encourages a risk-based approach: identify the intended use, determine the risk to product quality and patient safety if the software fails, choose assurance activities proportionate to that risk, including unscripted and exploratory testing for lower-risk functions, and keep records that are sufficient but not excessive. Many pharmaceutical companies apply similar principles through industry guidance such as GAMP 5, though CSA guidance itself is scoped to device production and quality systems.

Clinical investigations

FDA's guidance on electronic systems, electronic records and electronic signatures in clinical investigations, issued in question-and-answer format, addresses how Part 11 applies to sponsors, investigators and service providers using EDC systems, digital health technologies, cloud services and electronic signatures in trials. It emphasises risk-based validation, ensuring sponsors have appropriate oversight of vendors' systems, and maintaining audit trails and data integrity across the trial lifecycle.

Cloud and SaaS considerations

• The regulated company remains responsible for compliance, even when a vendor hosts the system.
• Vendors should provide documentation of their development, testing, change control and infrastructure qualification to support customers' validation.
• Release management matters: frequent SaaS updates must be communicated with release notes and impact assessments so customers can assess validation impact.
• Audit trails, backups and data export must work in the hosted environment, with records available for FDA inspection.
• Quality agreements should define responsibilities between the vendor and the regulated company.

What software vendors should build

• Immutable, time-stamped audit trails for create, modify and delete actions, showing old and new values, user and reason where required.
• Role-based access control with granular permissions.
• Electronic signature workflows that display name, date, time and meaning, require re-authentication and bind signatures to record versions.
• Password and session policies, account lockout and inactivity timeouts.
• Configurable workflows that enforce step sequencing.
• Export of complete records with audit trails in human-readable and electronic formats.
• Validation support packages: requirements, risk assessments, test evidence and release notes.

Data integrity and ALCOA+

FDA inspections increasingly focus on data integrity, and Part 11 controls are a key part of it. Regulators and industry describe good data using the ALCOA+ principles: attributable to the person who created it, legible, contemporaneous, original, accurate, and also complete, consistent, enduring and available. Software supports these principles by tying every entry to a unique user, time-stamping actions automatically, preserving original values in audit trails, preventing unrecorded deletion, and making records retrievable for their full retention period. Many FDA warning letters cite data integrity failures such as shared logins, deleted or overwritten data, disabled audit trails and unreviewed changes.

Audit trail review in practice

Having audit trails is not enough; regulated companies are expected to review them as part of normal oversight, particularly for critical data such as test results and batch release decisions. Software can make this practical by providing filtered audit trail views, highlighting unusual activity such as repeated changes, deletions or changes after approval, and recording that a review took place. Building review workflows into the product turns a compliance burden into a routine quality check.

Building Part 11 features into products

Designing for Part 11 from the start is far easier than adding it later. Data models should keep record versions rather than overwrite them, store audit events in append-only storage, link signatures to specific record versions with hashes, and separate administrative functions from data changes. We design regulated workflows with immutable audit trails, role-based access and electronic signatures through our custom software development work and experience in healthcare systems.

How regulated companies comply, step by step

1. Identify records and signatures covered by predicate rules and Part 11.
2. Assess systems for required technical controls.
3. Apply a risk-based validation approach, using CSA principles where applicable.
4. Write procedures for access management, signatures, audit trail review, backups and change control.
5. Certify electronic signatures to FDA.
6. Train users and keep records.
7. Review audit trails periodically and investigate anomalies.
8. Manage vendors with quality agreements and audits.

Documentation you will need

• System inventory and Part 11 applicability assessment.
• Validation plans, risk assessments and reports.
• User requirements and traceability.
• Standard operating procedures.
• Electronic signature certification letter to FDA.
• Training records.
• Audit trail review records.
• Vendor assessments and quality agreements.

Inspections and enforcement

FDA investigators review computerised systems during inspections of manufacturers, laboratories and clinical sites. They may ask to see audit trails, user access lists, validation documentation and procedures, and may test whether users can change data without trace. Findings appear in inspection observations and can lead to warning letters, import alerts, delays in approvals or rejection of data in submissions. Companies outside the US are inspected too, and several warning letters to overseas manufacturers have centred on data integrity in laboratory systems.

Timeline and cost considerations

For a new system, building Part 11 features adds moderate development effort, mostly in audit trails, signatures and access control. Validation effort depends on risk and approach; CSA-style risk-based assurance can reduce documentation significantly compared with traditional scripted validation. Retrofitting audit trails and signatures into an existing system is harder and may require data model changes.

Common mistakes

• Calling software "Part 11 certified".
• Shared accounts that make signatures and audit trails meaningless.
• Audit trails that can be disabled or edited by administrators.
• Never reviewing audit trails.
• Over-documenting low-risk functions while missing high-risk ones.
• Uncontrolled SaaS updates without impact assessment.

How it relates to other frameworks

Framework	Relationship
EU GMP Annex 11	European counterpart for computerised systems in GMP.
IEC 62304	Software lifecycle standard for medical device software itself.
HIPAA	Privacy and security of health information, which may apply to clinical data.
ISO/IEC 27001	Security management supporting record protection.
SOC 2	Vendor assurance that regulated customers may request.

Real-world example

An Indian company builds a cloud laboratory information management system for US contract labs. It implements immutable audit trails, role-based access, electronic signatures with meaning and re-authentication, and complete record export. It provides customers with a validation package containing requirements, a risk assessment, automated test evidence and release notes for each update, and signs quality agreements defining responsibilities. Customers perform risk-based validation of their configuration, certify electronic signatures to FDA, and review audit trails monthly.

Next steps

1. Map records to predicate rules.
2. Check technical controls.
3. Validate using a risk-based approach.
4. Write procedures and train users.
5. Manage vendors and updates.

Frequently asked questions

What is 21 CFR Part 11?

The FDA regulation setting requirements for electronic records and electronic signatures to be trustworthy and equivalent to paper and handwritten signatures.

Can software be Part 11 certified?

No. Software can support Part 11 requirements, but the regulated company must validate and operate it compliantly.

What are predicate rules?

Underlying FDA regulations, such as GMP, GCP and GLP, that require records to be kept; Part 11 applies when those records are electronic.

What must an audit trail record?

Secure, computer-generated, time-stamped entries for actions that create, modify or delete records, without obscuring previous values.

What must an electronic signature show?

The signer's printed name, the date and time, and the meaning of the signature.

Does Part 11 apply to companies outside the US?

Yes, when their records support FDA-regulated products or submissions.

What is Computer Software Assurance?

FDA's risk-based approach to establishing confidence in production and quality system software, finalised in 2025 for device manufacturers.

Do SaaS systems need validation?

Yes. Regulated companies must validate systems for intended use, with vendor support for documentation and change control.

Is enforcement discretion still in place?

FDA's 2003 guidance on scope and application, including enforcement discretion for certain controls, remains current, but predicate rules still apply.

Do I need to notify FDA about electronic signatures?

Yes. Organisations must certify to FDA that their electronic signatures are intended to be legally binding equivalents of handwritten signatures.

What is the European equivalent of Part 11?

EU GMP Annex 11 covers computerised systems in European GMP, with similar expectations on validation, audit trails and signatures.