What Is FDA 21 CFR Part 11?

FDA 21 CFR Part 11 Explained

Part 11 was issued in 1997 to let regulated companies move off paper without weakening the reliability of the records FDA depends on. It applies to records created, modified, maintained, archived, retrieved, or transmitted in electronic form under any FDA predicate rule - the underlying regulation such as the quality system requirements for devices, current good manufacturing practice for drugs, or the good clinical practice requirements. Part 11 never creates a record requirement on its own; it governs how records that a predicate rule already requires may exist electronically.

The technical requirements for closed systems fall into a handful of categories. Systems must be validated for accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. They must generate accurate and complete copies in both human-readable and electronic form for inspection. Access must be limited to authorized individuals, with operational system checks enforcing sequencing where appropriate and authority checks verifying that a given user may perform a given action or sign a given record.

Audit trails are the requirement that most often drives system selection. Part 11 requires secure, computer-generated, time-stamped audit trails that independently record the operator entries and actions that create, modify, or delete electronic records, and crucially that record changes must not obscure previously recorded information. Audit trails must be retained at least as long as the record itself and be available for review and copying. Systems that overwrite values without preserving prior state, or that permit administrators to edit history, cannot meet this bar regardless of other controls.

Electronic signatures carry their own rules. A signed record must display the printed name of the signer, the date and time of signing, and the meaning of the signature such as approval, review, or responsibility, and that information must be included in any human-readable form of the record. Signatures must be linked to their records so they cannot be excised, copied, or transferred to falsify another record. Non-biometric signatures require at least two distinct identification components, and organizations must certify to FDA that they intend electronic signatures to be the legally binding equivalent of handwritten ones.

The 2003 guidance on scope and application narrowed practical enforcement considerably. FDA stated it would interpret Part 11 narrowly and exercise enforcement discretion in areas including validation, audit trails, record copies, and legacy systems, while emphasizing that predicate rule requirements still apply in full. The common misconception that a vendor can sell a Part 11 compliant system persists. Software can provide compliant capability, but compliance is achieved by the regulated company through validated configuration, documented procedures, training, and controls over how the system is actually used.