21 CFR Part 11 Full Text

21 CFR Part 11 Full Text: Complete Guide to FDA Electronic Records and Electronic Signatures

21 CFR Part 11 Full Text

Introduction: Understanding 21 CFR Part 11

Title 21 CFR Part 11 is one of the most critical regulations affecting life sciences organizations operating under FDA oversight. This regulation, formally titled “Electronic Records; Electronic Signatures,” establishes the criteria under which the FDA considers electronic records and electronic signatures to be trustworthy, reliable, and equivalent to paper records and handwritten signatures. Questions on 21 CFR Part 11 for LMS or eQMS?

Since its implementation in 1997, 21 CFR Part 11 has fundamentally transformed how pharmaceutical companies, medical device manufacturers, biotechnology firms, clinical research organizations, and other FDA-regulated entities manage their digital documentation and validation processes. The regulation impacts every computerized system that creates, modifies, maintains, archives, retrieves, or transmits electronic records required by FDA regulations. Here’s the full text of 21 CFR Part 11.

This comprehensive guide examines the full scope of 21 CFR Part 11, from understanding the complete regulatory text to implementing compliant systems across your organization. Whether you’re establishing initial compliance, validating new systems, or optimizing existing processes, this resource provides the authoritative framework for 21 CFR Part 11 compliance.

21 CFR Part 11 Full Text

Part 1: What is 21 CFR Part 11?

Regulatory Foundation

21 CFR Part 11 was enacted by the Food and Drug Administration on March 20, 1997, to provide criteria for acceptance of electronic records and electronic signatures. The regulation emerged from the need to modernize FDA’s approach to documentation as the life sciences industry increasingly adopted computerized systems.

Scope and Applicability

Who Must Comply

21 CFR Part 11 applies to:

When Part 11 Applies

According to FDA guidance, Part 11 applies to:

  1. Electronic Records That Replace Paper: Records required by predicate rules that are maintained in electronic format instead of paper
  2. Electronic Records Used for Regulated Activities: Records maintained in electronic format that are relied upon to perform regulated activities, even if paper copies exist
  3. Electronic Signatures: Electronic signatures intended to be equivalent to handwritten signatures required by predicate rules
  4. Records Submitted to FDA: Electronic records submitted to FDA under predicate rules in formats the agency accepts electronically

Predicate Rules

Predicate rules are the underlying FDA regulations that require records to be maintained or submitted. Examples include:

Part 2: The Full Text – Key Requirements

Subpart A – General Provisions

Establishes that Part 11 applies to electronic records and signatures under any FDA regulation unless specifically excepted.

Defines when electronic records and signatures may be used in place of paper records and handwritten signatures.

Key definitions include:

Subpart B – Electronic Records

Required Controls:

  1. Validation of Systems
    • Ensure accuracy, reliability, consistent intended performance
    • Ability to discern invalid or altered records
    • Documentation of validation activities
  2. Accurate and Complete Copies
    • Ability to generate accurate copies in both human readable and electronic form
    • Suitable for inspection, review, and copying by FDA
  3. Protection of Records
    • Ensure records are readily retrievable throughout retention period
    • Protection against unauthorized modification or deletion
  4. Audit Trails
    • Computer-generated, time-stamped audit trails
    • Document record creation, modification, and deletion
    • Record changes must not obscure previously recorded information
    • Available for agency review and copying
  5. System Security
    • Operational checks enforcing permitted sequencing
    • Authority checks ensuring only authorized individuals can use system
    • Device checks to determine validity of data input source
  6. Electronic Signatures
    • Signed electronic records must contain:
      • Printed name of signer
      • Date and time of signature
      • Meaning of signature (review, approval, responsibility, authorship)
  7. Documentation Controls
    • Controls for distribution, access, and use of system documentation
    • Revision and change control procedures
    • Maintain audit trail for system documentation

Open systems require all closed system controls plus:

Electronic signatures must display:

Electronic signatures must be linked to their respective records to ensure signatures cannot be excised, copied, or transferred for falsification.

Subpart C – Electronic Signatures

  1. Uniqueness
    • Each signature must be unique to one individual
    • Cannot be reused or reassigned
  2. Verification
    • Identity of individual must be verified before issuing electronic signature
  3. Certification
    • Organizations must certify to FDA that electronic signatures are legally binding equivalent to handwritten signatures

Non-Biometric Signatures:

Controls Required:

Password Controls:

Part 3: FDA Guidance and Interpretation

2003 Guidance – Scope and Application

Following industry feedback, FDA issued guidance in 2003 clarifying Part 11 enforcement:

Narrow Interpretation of Scope

FDA indicated it would interpret Part 11 narrowly and focus on:

Risk-Based Approach

FDA adopted a risk-based approach to enforcement prioritizing:

Enforcement Discretion

FDA exercises enforcement discretion for:

Part 4: Implementation Requirements

System Validation

Validation Approach

IQ – Installation Qualification:

OQ – Operational Qualification:

PQ – Performance Qualification:

Standard Operating Procedures (SOPs)

Essential SOPs for Part 11 Compliance

  1. System Administration
    • User account management
    • Access control procedures
    • Password policies
    • Security incident response
  2. Data Management
    • Backup and recovery
    • Data retention and archival
    • Record change control
    • Audit trail review
  3. Validation and Change Control
    • System validation procedures
    • Change management process
    • Periodic review requirements
    • Revalidation triggers
  4. Training and Documentation
    • User training requirements
    • Documentation standards
    • Record keeping procedures
    • Competency assessment

Part 5: Technical Controls and Security

Access Control Requirements

User Authentication

Multi-Factor Approaches:

Password Requirements:

Audit Trail Implementation

Audit Trail Components

Required Information:

Technical Considerations:

Data Integrity Controls

ALCOA+ Principles

Attributable: Data linked to person who generated it
Legible: Data readable and permanent
Contemporaneous: Recorded at time of activity
Original: First capture or certified copy
Accurate: Error-free and complete
Complete: All data included, including repeat analyses
Consistent: Good documentation practices applied
Enduring: Available throughout retention period
Available: Accessible for review and audit

Part 6: System-Specific Applications

Laboratory Information Management Systems (LIMS)

Part 11 Requirements for LIMS

Electronic Records:

Critical Controls:

Enterprise Resource Planning (ERP) Systems

GxP-Relevant ERP Modules

Inventory Management:

Production Planning:

Learning Management Systems (LMS)

Training Record Compliance

Part 11 Application to LMS:

FDA Inspection Focus:

Quality Management Systems (QMS)

Document Control Under Part 11

Electronic Document Management:

Part 7: Validation Best Practices

Risk-Based Validation Approach

GAMP 5 Categories

Category 1: Infrastructure software (operating systems)
Category 3: Non-configured products (off-the-shelf)
Category 4: Configured products (LIMS, ERP)
Category 5: Custom applications

Validation Effort Scaling

Higher risk systems require:

Validation Documentation

Core Validation Documents

  1. Validation Plan
    • Scope and objectives
    • Roles and responsibilities
    • Risk assessment
    • Testing approach
    • Acceptance criteria
  2. User Requirements Specification (URS)
    • Business requirements
    • Regulatory requirements
    • Technical requirements
    • Security requirements
    • Data integrity requirements
  3. Functional Specifications
    • System functionality
    • User interface design
    • Integration points
    • Report specifications
    • Security features
  4. Test Protocols and Reports
    • Test scripts
    • Expected results
    • Actual results
    • Deviation handling
    • Final approval

Maintaining Validated State

Ongoing Compliance Activities

Periodic Reviews:

Change Management:

Part 8: Common Compliance Challenges

Typical Inspection Findings

Top Part 11 Observations

  1. Inadequate Access Controls
    • Shared passwords
    • Generic user accounts
    • Excessive privileges
    • Poor password management
  2. Audit Trail Deficiencies
    • Disabled audit trails
    • Incomplete change documentation
    • No audit trail review
    • Gaps in audit trail data
  3. Validation Gaps
    • Missing validation documentation
    • Inadequate testing
    • No periodic reviews
    • Poor change control
  4. Data Integrity Issues
    • Data deletion capabilities
    • Ability to bypass controls
    • Incomplete records
    • Time/date manipulation

Remediation Strategies

Corrective Action Approach

  1. Assessment Phase
    • Gap analysis
    • Risk assessment
    • Priority ranking
    • Resource planning
  2. Remediation Phase
    • System upgrades
    • Procedure development
    • User training
    • Validation activities
  3. Verification Phase
    • Effectiveness checks
    • Internal audits
    • Management review
    • Continuous monitoring

Part 9: Industry-Specific Considerations

Pharmaceutical Manufacturing

Critical Systems

Manufacturing Execution Systems (MES):

Key Compliance Points:

Medical Device Manufacturing

Design History File (DHF)

Part 11 Considerations:

Clinical Trials

Electronic Data Capture (EDC)

21 CFR Part 11 Requirements:

FDA Inspection Focus:

Biotechnology

Cell Banking and Storage

Electronic Records:

Part 10: Future Considerations

Evolving Technology Landscape

Cloud Computing

Part 11 in the Cloud:

Best Practices:

Artificial Intelligence and Machine Learning

Validation Challenges:

Regulatory Harmonization

Global Compliance Considerations

EU Annex 11:

Other Regulatory Frameworks:

Conclusion: Achieving and Maintaining Compliance

Key Success Factors

Successful 21 CFR Part 11 compliance requires:

  1. Leadership Commitment: Executive support and resource allocation
  2. Risk-Based Approach: Focus on critical systems and high-risk areas
  3. Comprehensive Procedures: Well-documented SOPs and work instructions
  4. Robust Validation: Thorough testing and documentation
  5. Continuous Training: Ongoing user education and awareness
  6. Regular Assessment: Periodic reviews and internal audits
  7. Change Management: Controlled system modifications
  8. Vendor Partnership: Qualified suppliers and service providers

The Compliance Journey

21 CFR Part 11 compliance is not a destination but an ongoing journey. As technology evolves and regulatory expectations mature, organizations must continuously adapt their approaches while maintaining the fundamental principles of data integrity, security, and traceability.

The investment in Part 11 compliance extends beyond regulatory requirements—it establishes a foundation for operational excellence, quality assurance, and ultimately, patient safety. Organizations that embrace comprehensive Part 11 compliance position themselves for success in an increasingly digital and regulated environment.

How eLeaP Ensures 21 CFR Part 11 Compliance

Built-In Compliance Features

eLeaP’s LMS is designed from the ground up with 21 CFR Part 11 requirements:

Electronic Records Management:

Electronic Signatures:

Validation Support:

Get Started with Compliant Training:

Contact Information: