21 CFR Part 11 Compliance: Complete Guide to Electronic Records and Signatures

21 CFR Part 11 is the FDA regulation that establishes criteria for accepting electronic records and electronic signatures as equivalent to paper records and handwritten signatures. Enacted in 1997 and clarified through FDA guidance in 2003, Part 11 applies to any FDA-regulated company that creates, modifies, maintains, archives, retrieves, or transmits electronic records in any format.

Non-compliance with 21 CFR Part 11 can trigger FDA warning letters, 483 observations, product delays, and significant remediation costs. For pharmaceutical and biotech companies, Part 11 compliance is a foundational requirement for regulatory submissions, clinical trials, and manufacturing operations.

In this guide, you will learn:

• The complete structure and requirements of 21 CFR Part 11 (all three subparts)
• How to implement Part 11 compliance for electronic records and electronic signatures
• The difference between closed systems and open systems under Part 11
• Specific audit trail requirements and system validation approaches
• A comprehensive Part 11 compliance checklist for your organization

What Is 21 CFR Part 11?

21 CFR Part 11 is a federal regulation issued by the U.S. Food and Drug Administration (FDA) that defines the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records and handwritten signatures. The regulation is codified in Title 21 of the Code of Federal Regulations (CFR), Part 11.

Key characteristics of 21 CFR Part 11:

• Applies to records required by FDA predicate rules (existing regulations)
• Covers both electronic records and electronic signatures
• Establishes technical and procedural controls for electronic systems
• Requires documented validation of computer systems

The regulation consists of three subparts:

• Subpart A - General Provisions (scope, definitions, implementation)
• Subpart B - Electronic Records (controls, validation, audit trails)
• Subpart C - Electronic Signatures (uniqueness, controls, certification)

Part 11 History and Evolution

Understanding the history of 21 CFR Part 11 provides context for its current interpretation:

21 CFR Part 11 Compliance: Understanding the Scope

Before implementing Part 11 compliance, organizations must understand what falls within the regulation's scope. Not all electronic records require Part 11 controls.

When Part 11 Applies

Part 11 compliance is required when:

1. Records are required by predicate rules - The underlying FDA regulation (21 CFR Parts 210, 211, 820, etc.) requires the record
2. Electronic format is chosen - You elect to maintain records electronically instead of on paper
3. Electronic signatures are used - You use electronic signatures instead of handwritten signatures

When Part 11 Does NOT Apply

According to FDA guidance on Part 11 scope and application:

• Records not required by predicate rules
• Paper records that are merely stored electronically (scanned images for archival)
• Electronic records created before August 20, 1997 (grandfather clause)

“

Important: The FDA takes a risk-based approach to Part 11 enforcement. Focus compliance efforts on records that directly impact product quality and patient safety.

Electronic Records Electronic Signatures: Part 11 Subpart A

Subpart A of 21 CFR Part 11 establishes the general provisions, including scope, definitions, and implementation requirements for electronic records electronic signatures.

Key Definitions Under Part 11

Closed System vs Open System

The distinction between closed and open systems is critical for determining Part 11 requirements:

Closed System (11.10):

• Access controlled by the organization responsible for the records
• Examples: Internal LIMS, validated ERP systems, local document management systems
• Requires baseline Part 11 controls

Open System (11.30):

• Access NOT controlled by the organization responsible for the records
• Examples: Cloud-based systems where vendor controls access, internet-based submissions
• Requires additional controls: encryption, digital signatures, additional security measures

Cloud Systems and Part 11 Classification

A common question is whether cloud-based systems are closed or open. The answer depends on control relationships:

“

Best Practice: When using SaaS or cloud systems, establish written agreements that clearly define access controls, making the system functionally closed.

Part 11 Compliance Requirements: Subpart B Electronic Records

Subpart B (11.10 for closed systems, 11.30 for open systems) establishes the specific requirements for electronic records under FDA 21 CFR Part 11.

11.10 - Controls for Closed Systems

Organizations using closed systems must employ procedures and controls that include:

1. System Validation (11.10(a))

• Validation to ensure accuracy, reliability, consistent intended performance, and ability to discern invalid or altered records
• Documentation of validation activities
• Ongoing validation maintenance

2. Record Generation and Storage (11.10(b))

• Ability to generate accurate and complete copies of records in both human-readable and electronic form
• Protection of records throughout the retention period

3. Record Protection (11.10(c))

• Protection of records to enable accurate and ready retrieval
• Throughout the records retention period

4. System Access Controls (11.10(d))

• Limiting system access to authorized individuals
• Role-based access controls
• Documented access procedures

5. Audit Trails (11.10(e))

• Secure, computer-generated, time-stamped audit trails
• Record the date and time of operator entries and actions
• Must not obscure previously recorded information
• Audit trail documentation must be retained for at least as long as the subject electronic records

“

Critical Requirement: Audit trails must be independently reviewed. FDA expects audit trail review to be part of your routine quality processes, not just during inspections.

6. Operational System Checks (11.10(f))

• Use of operational system checks to enforce permitted sequencing of steps and events

7. Authority Checks (11.10(g))

• Use of authority checks to ensure only authorized individuals can use the system, electronically sign, access the operation, or alter a record

8. Device Checks (11.10(h))

• Use of device checks to determine validity of source of data input or operational instruction

9. Training (11.10(i))

• Determination that persons who develop, maintain, or use electronic record/signature systems have the education, training, and experience to perform their assigned tasks

10. Written Policies (11.10(j))

• Establishment and adherence to written policies holding individuals accountable for actions initiated under their electronic signatures

11. System Documentation Controls (11.10(k))

• Adequate controls over systems documentation including distribution, access, and use
• Revision and change control procedures

11.10 Requirements Summary Table

11.30 - Controls for Open Systems

Open systems require all the controls listed in 11.10 PLUS additional measures:

• Document encryption
• Use of appropriate digital signature standards
• Additional operational controls to ensure record authenticity, integrity, and confidentiality

FDA 21 CFR Part 11: Subpart C Electronic Signatures

Subpart C establishes requirements for electronic signatures that are intended to be the legally binding equivalent of handwritten signatures.

11.50 - Signature Manifestations

Each electronic signature must include:

1. Printed name of the signer
2. Date and time the signature was executed
3. Meaning of the signature (e.g., review, approval, responsibility, authorship)

This information must be displayed clearly and must be part of any human-readable form of the electronic record.

11.70 - Signature/Record Linking

Electronic signatures must be linked to their respective electronic records to ensure signatures cannot be:

• Excised (cut out)
• Copied
• Transferred to falsify an electronic record by ordinary means

11.100 - General Requirements

11.200 - Electronic Signature Components and Controls

Electronic signatures not based on biometrics must employ at least two distinct identification components:

For signatures executed during a single continuous session:

• Both components (user ID + password) required at first signing
• At least one component required for subsequent signings during session

For signatures executed during non-continuous sessions:

• Both components required for EACH signing event

Signature Component Requirements

11.300 - Controls for Identification Codes/Passwords

CFR Part 11 Requirements: Audit Trail Deep Dive

The audit trail is one of the most scrutinized aspects of Part 11 compliance during FDA inspections. Understanding audit trail requirements is essential for Part 11 compliance.

What Must Be Captured in Audit Trails

Per 11.10(e), audit trails must capture:

1. Date and time of entries and actions (computer-generated, time-stamped)
2. Operator identification (who made the change)
3. Previous values (what was there before the change)
4. New values (what it was changed to)
5. Reason for change (when required by predicate rules)

Audit Trail Technical Requirements

Common Audit Trail Failures

FDA commonly cites these audit trail deficiencies in 483 observations:

1. Insufficient detail - Not capturing what specific data changed
2. Missing timestamps - Entries without date/time stamps
3. Modifiable trails - Users can delete or alter audit trail entries
4. No review process - Audit trails exist but are never reviewed
5. Retention gaps - Audit trails not retained as long as records
6. Inconsistent coverage - Some fields audited, others not
7. Time synchronization issues - Multiple systems with different timestamps

“

Best Practice: Implement routine audit trail review as part of your quality system. FDA expects organizations to proactively review audit trails, not just generate them.

Audit Trail Review Frequency

Computer System Validation for Part 11 Compliance

System validation is the cornerstone of Part 11 compliance. Without documented validation, electronic records cannot be considered trustworthy and reliable.

Validation Requirements Under 11.10(a)

The regulation requires validation to ensure:

• Accuracy - System produces correct results
• Reliability - System performs consistently over time
• Consistent intended performance - System does what it is designed to do
• Ability to discern invalid or altered records - System can detect tampering

Risk-Based Validation Approach

FDA guidance supports a risk-based approach to validation:

GAMP 5 Categories and Validation

The GAMP 5 framework provides industry-standard guidance for computer system validation:

Validation Documentation Requirements

Ongoing Validation Maintenance

Validation is not a one-time event. Part 11 requires:

1. Change control - All changes assessed for validation impact
2. Periodic review - Regular assessment of system compliance
3. Revalidation - When significant changes occur
4. Incident management - Tracking and resolving system issues

Part 11 Compliance Checklist

Use this comprehensive checklist to assess your organization's 21 CFR Part 11 compliance status:

Administrative Controls Checklist

System Controls Checklist

Electronic Signature Controls Checklist

Record Controls Checklist

Common Part 11 Compliance Gaps and Solutions

Gap 1: Inadequate Audit Trails

Problem: Systems generate basic audit trails but do not capture sufficient detail or are modifiable.

Solution:

• Configure systems to capture before/after values
• Enable reason-for-change fields where required
• Ensure audit trails are stored in write-once format
• Implement regular audit trail review

Gap 2: Shared User Accounts

Problem: Multiple users share login credentials, making accountability impossible.

Solution:

• Assign unique user IDs to every individual
• Implement role-based access controls
• Disable generic and shared accounts
• Document in policy that account sharing is prohibited

Gap 3: Missing Validation Documentation

Problem: Systems are in use but lack documented validation.

Solution:

• Conduct retrospective validation where possible
• Implement risk-based prioritization
• Document current-state assessment
• Create remediation plan with timelines

Gap 4: No Electronic Signature Certification

Problem: Organization uses electronic signatures but has not certified to FDA.

Solution:

• Submit certification letter to appropriate FDA center
• Maintain copy of certification in quality records
• Update certification as needed for new product types

Gap 5: Inadequate Training Documentation

Problem: Personnel use systems but training records are incomplete or missing.

Solution:

• Create training matrix for all Part 11 systems
• Document initial and ongoing training
• Include Part 11 awareness in training curriculum
• Maintain training records per retention requirements

Gap 6: Legacy System Non-Compliance

Problem: Older systems lack Part 11 controls and cannot be easily upgraded.

Solution:

• Conduct risk assessment of legacy systems
• Implement compensating procedural controls
• Plan for system replacement or upgrade
• Document gap analysis and remediation timeline

Part 11 and Other FDA Regulations

21 CFR Part 11 does not exist in isolation. It works in conjunction with predicate rules:

“

Key Point: Part 11 requirements apply ON TOP OF predicate rule requirements. You must comply with both the underlying regulation AND Part 11 when using electronic records.

Part 11 and Data Integrity

The FDA's 2018 Data Integrity guidance reinforces Part 11 principles. ALCOA+ criteria align with Part 11 requirements:

Key Takeaways

Next Steps

Understanding 21 CFR Part 11 requirements is the first step toward compliance. Implementing those requirements across your electronic systems, including eCTD publishing, LIMS, and clinical trial databases, requires systematic assessment and remediation.

Organizations managing regulatory submissions benefit from automated validation tools that catch errors before gateway rejection. Assyro's AI-powered platform validates eCTD submissions against FDA, EMA, and Health Canada requirements, providing detailed error reports and remediation guidance before submission.

Sources