21 CFR Part 11 is a U.S. Food and Drug Administration (FDA) regulation that sets criteria under which electronic records and electronic signatures can be considered trustworthy, reliable, and generally equivalent to paper records and handwritten signatures. It applies in the context of records required by FDA regulations or submitted to the FDA; it does not automatically apply to every electronic file a company keeps.
What does Part 11 cover?
Part 11 establishes controls for electronic records and signatures used in FDA-regulated activities. Depending on the system and records involved, these controls can include system validation, restricted access, authority checks, secure audit trails, record retention and retrieval, and controls that link an electronic signature to its record. The regulation also sets requirements for electronic signatures, including their uniqueness, identity verification, and meaning.
Part 11 is read alongside the underlying requirements, often called predicate rules, that require a record or signature in the first place. For example, a company must identify which records its applicable regulations require, how those records are maintained, and whether electronic records are relied on for regulated work.
When may it apply?
The FDA’s scope guidance explains that Part 11 can apply when required records are maintained electronically in place of paper, or when electronic records are used alongside paper and relied on to perform regulated activities. A computer-generated printout may be treated differently when the complete paper record satisfies the applicable requirements and is the record relied on. Scope should therefore be assessed record by record, based on the applicable regulations and actual business practices.
What does compliance involve?
Organizations typically define intended use, assess risk, validate systems as appropriate, manage user access, control changes, retain readable records, and ensure that signatures and audit trails support reconstruction of regulated actions. Procedures, training, supplier controls, and periodic review also matter. Buying software described as “Part 11 compliant” does not by itself make a company compliant; system configuration and operating practices are part of the assessment.
The FDA’s 2003 guidance describes its enforcement approach for specified Part 11 provisions. The regulation remains in effect, and applicable predicate-rule requirements continue to apply. The guidance is nonbinding and does not replace a documented assessment of the organization’s own records and processes.
Part 11 and manufacturing systems
In pharmaceutical manufacturing, electronic batch records, manufacturing execution systems, laboratory systems, and quality systems may support regulated records or signatures. Their applicability depends on the records, intended use, and predicate rules, rather than on the product label alone.
For the current regulation, see 21 CFR Part 11 in the eCFR and the FDA’s Part 11 Scope and Application guidance.