21 CFR Part 11 on Electronic Records

For life science companies operating under FDA oversight, 21 CFR Part 11 is not a peripheral compliance concern — it is the foundational regulation governing how your organization creates, stores, manages, and signs electronic records. Whether you are a pharmaceutical manufacturer, a medical device company, a biotech startup, or a contract research organization, Part 11 touches nearly every digital system in your operation.

The challenge most organizations face is not a lack of awareness but a lack of clarity. What exactly does Part 11 require? Which systems are in scope? How do you validate compliance? And critically, how does your Quality Management System (eQMS) and/or Learning Management System (LMS) factor into all of it?

This guide answers all of those questions in depth. We’ll cover the regulatory framework, specific technical and procedural requirements, real-world implementation strategies, and how a purpose-built LMS like eLeaP helps life science organizations achieve and maintain 21 CFR Part 11 compliance.

FDA is now inspecting under QMSR

The FDA’s Quality Management System Regulation (QMSR) replaced the legacy QSR (21 CFR Part 820) effective February 2, 2026, aligning U.S. medical device regulations with ISO 13485. If your organization manufactures medical devices, your electronic records and training documentation must now satisfy both 21 CFR Part 11 and QMSR requirements. Download the eLeaP Training Compliance Checklist to see if your records are ready.

What Is 21 CFR Part 11?

21 CFR Part 11 — formally titled “Electronic Records; Electronic Signatures” — is a regulation issued by the U.S. Food and Drug Administration (FDA) under Title 21 of the Code of Federal Regulations. It was established in 1997 to provide a legal framework under which electronic records and electronic signatures are considered equivalent to paper records and handwritten signatures, provided that specific technical and procedural controls are in place.

The regulation applies to all FDA-regulated industries, including pharmaceutical manufacturers, biotech companies, medical device manufacturers, blood banks, tissue processors, clinical research organizations (CROs), and any other entity subject to FDA predicate rules that reference records or require signatures.

At its core, 21 CFR Part 11 addresses two categories:

• Electronic Records (Subpart B — §11.10 and §11.30): Controls for closed and open systems that create, modify, maintain, archive, retrieve, or transmit electronic records.
• Electronic Signatures (Subpart C — §11.50 through §11.300): Requirements for the use, security, and linkage of electronic signatures to their corresponding records.

The Regulatory Predicate Rule Relationship

A critical concept for understanding Part 11 scope is the “predicate rule.” Part 11 does not stand alone — it applies whenever you use electronic records or electronic signatures to satisfy other FDA regulations (predicate rules). These predicate rules include:

• 21 CFR Part 211 — Current Good Manufacturing Practice (cGMP) for Finished Pharmaceuticals
• 21 CFR Part 820 / QMSR — Quality System Regulation for Medical Devices
• 21 CFR Part 606 — Good Manufacturing Practice for Blood and Blood Components
• 21 CFR Parts 312 and 314 — Investigational New Drug and New Drug Applications
• ICH Q10 — Pharmaceutical Quality System

When any of these regulations require records or signatures, and you use an electronic system to fulfill that requirement, 21 CFR Part 11 applies. This is why your LMS — which stores training records that predicate rules explicitly require — falls squarely within Part 11 scope.

What Are Electronic Records Under 21 CFR Part 11?

The FDA defines an electronic record as “any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system.”

This definition is intentionally broad. In practice, virtually every digital file associated with your regulated operations qualifies as an electronic record. For life science organizations, this encompasses a wide range of document types:

Closed Systems vs. Open Systems

Part 11 distinguishes between two types of electronic systems, each with different control requirements:

• Closed Systems (§11.10): Systems where access is controlled by the persons responsible for the content of the electronic records. Your on-premise or internally managed systems typically qualify. Controls must include validation, audit trails, access authority controls, and operational checks.
• Open Systems (§11.30): Systems where access is not controlled by the persons responsible for the records, such as cloud-hosted SaaS platforms where access traverses the internet. Open systems require all closed system controls PLUS additional measures such as encryption and digital signatures to ensure record authenticity and confidentiality.

Many modern QMS + LMS platforms, including eLeaP, are cloud-hosted open systems. This means they must satisfy the more stringent open system requirements of §11.30, including encrypted data transmission, robust authentication, and documented security controls — requirements eLeaP was purpose-built to meet.

21 CFR Part 11 Technical Requirements: A Complete Breakdown

The specific technical and procedural requirements of Part 11 are found primarily in §11.10 (closed systems) and §11.30 (open systems, which incorporates all §11.10 controls plus additional measures). Understanding these requirements is essential for building compliant systems.

§11.10(a) — System Validation

All Part 11-compliant electronic systems must be validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. Validation is not a one-time event — it must be maintained throughout the system lifecycle.

For an LMS, validation means documenting that the system reliably:

• Records course completions accurately and without modification
• Generates and stores electronic signatures correctly
• Produces audit trail entries that cannot be altered or deleted
• Maintains record integrity across system updates and upgrades

eLeaP supports LMS validation activities through comprehensive IQ/OQ/PQ documentation frameworks and system validation protocols aligned with GAMP 5 methodology.

§11.10(b) — Record Generation

The system must be capable of generating accurate and complete copies of records in both human-readable form and electronic form suitable for inspection, review, and copying by the FDA. This means your LMS must be able to produce training records that FDA investigators can review in a legible format during inspections.

§11.10(c) — Record Protection and Retention

Electronic records must be protected to enable their accurate and ready retrieval throughout the applicable retention period. Your LMS training records are subject to retention requirements under applicable predicate rules. These periods vary significantly — from 2 years (21 CFR Part 820/QMSR for medical devices) to 10 years or more (21 CFR Part 606 for blood products). Part 11 itself does not set retention periods; it requires that whatever period is required by the predicate rule be honored.

Key considerations for retention compliance:

• Records must be stored in formats that remain accessible for the full retention period
• Media degradation must be anticipated and addressed
• Backup and disaster recovery procedures must be documented and tested
• Record migration to new systems must preserve content and meaning

§11.10(d) — System Access Limitations

Access to the electronic system must be limited to authorized individuals. For QMS + LMS platforms, this requires a robust user authentication system with role-based access controls, where different user roles have defined and appropriately limited permissions.

§11.10(e) — Audit Trails

This is one of the most critical and frequently cited requirements. Systems must use computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. These audit trails must:

• Be computer-generated (not manually created)
• Include the date and time of each entry or action
• Record the user ID associated with each action
• Document what was changed, including the original and new values
• Be retained for the same duration as the records they document
• Be available for FDA review during inspections

Critically, audit trail records must not be modifiable by anyone — not even system administrators. eLeaP’s audit trail functionality captures all user actions, course completions, record modifications, and system changes with tamper-evident logging.

§11.10(f) — Operational Checks

Systems must enforce the sequencing of steps and events where required to ensure that only authorized individuals can use the system, only authorized activities occur, and that electronic signatures cannot be repudiated.

§11.10(g) — Authority Checks

The system must check the authority of individuals attempting to use the system, access the operation, or perform the computer system functions they are attempting to execute. In LMS terms, this means role-based permissions must be enforced at every system action, not just at login.

§11.10(h) — Device Checks

Where appropriate, systems must use device checks to determine, as they are needed, the validity of the source of data input or operational instruction.

§11.10(i) — Personnel Training

Individuals who develop, maintain, or use electronic record/electronic signature systems must have the education, training, and experience necessary to perform their assigned tasks. This requirement creates a direct link between Part 11 compliance and your training management program — your LMS is both a compliance subject under Part 11 and a tool for documenting compliance with §11.10(i).

§11.10(j) — Written Policies

Organizations must establish and adhere to written policies that hold individuals accountable for actions initiated under their electronic signatures. These policies must be documented, controlled, and accessible.

§11.10(k) — Documentation Controls

Systems must use appropriate controls for the distribution of, access to, and use of documentation for system operation and maintenance. For LMS platforms, this includes controls over training content, version management, and change documentation.

Electronic Signatures Under 21 CFR Part 11

Electronic signatures are a cornerstone of Part 11 compliance and are directly relevant to how your LMS operates. Under §11.3, an electronic signature is defined as “a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual’s handwritten signature.”

What Makes an Electronic Signature Valid Under Part 11?

For an electronic signature to be compliant, it must meet several requirements:

• Uniqueness (§11.100(a)): Each electronic signature must be unique to one individual and shall not be reused or reassigned to another.
• Identity Verification (§11.100(b)): Organizations must verify the identity of individuals before establishing, assigning, certifying, or otherwise sanctioning an individual’s electronic signatures.
• Legal Certification (§11.100(c)): Persons using electronic signatures must certify to the FDA that the electronic signatures in their system are intended to be the legally binding equivalent of traditional handwritten signatures.
• Signature-Record Linkage (§11.70): Electronic signatures must be linked to their respective electronic records in a manner that cannot be excised, copied, or otherwise transferred.

Electronic Signatures in Your LMS

Your LMS uses electronic signatures in multiple contexts, all of which must comply with Part 11:

• Learner login and course completion — the learner’s authenticated login serves as their electronic signature confirming they completed the training
• Administrator actions — changes to records, course modifications, and report exports must be associated with the administrator’s authenticated identity
• Supervisor/manager sign-offs — observation checklist completions and OJT verifications require authenticated signatures from supervisors
• Certification acknowledgments — some training programs require a specific e-signature action separate from simple completion

eLeaP’s e-signature functionality is built directly into the course settings, allowing administrators to require explicit electronic signature acknowledgment at course completion — not just a passive click-through. Each signature is tied to the user’s unique login credentials and recorded in the immutable audit trail.

How 21 CFR Part 11 Affects Your Learning Management System

Your LMS is a primary repository for electronic training records — records that predicate rules explicitly require you to maintain. Under 21 CFR Part 820/QMSR, 21 CFR Part 211, and other applicable regulations, you must document that employees have received and understood training relevant to their job functions. Because you are creating and storing these records electronically, your LMS falls directly under the purview of 21 CFR Part 11.

What Training Records Are Subject to Part 11?

The Part 11 LMS Compliance Checklist

When evaluating your current LMS or selecting a new platform, verify these specific Part 11 capabilities:

Record Retention Requirements Under 21 CFR Part 11

Part 11 itself does not specify retention periods — these are determined by the applicable predicate rules. However, Part 11 does require that records be protected and accessible throughout whatever retention period is required. Organizations often struggle with the intersection of Part 11 and predicate rule retention requirements because they must:

• Know which predicate rules apply to each record type
• Map those retention requirements to records stored in the QMS + LMS
• Ensure the QMS + LMS can store and retrieve records for the full retention period
• Plan for system migrations that preserve record integrity

Common Predicate Rule Retention Requirements for Training Records

Note: Part 11 does not set retention periods — these come from predicate rules. The table below reflects the actual regulatory text; organizations should consult qualified regulatory counsel to confirm requirements for their specific products and jurisdictions.

Converting Electronic Records to Physical Format

Part 11 permits organizations to archive electronic records to physical media, such as microfilm, microfiche, or paper, provided that:

• All predicate rule requirements continue to be satisfied
• The content and meaning of the records are fully preserved
• Copies of required records preserve their original content and meaning
• Standard electronic file formats (PDF, XML, SGML) are used for electronic archival

The FDA will not object to such conversions, and once archived in compliant physical or standard electronic format, the original electronic version may be deleted — provided the above conditions are met.

FDA Inspection Under 21 CFR Part 11: What Investigators Look For

During an FDA inspection focused on Part 11 compliance, investigators will systematically evaluate your electronic systems against the specific requirements of the regulation. For your LMS, inspectors are likely to request:

Documentation Inspectors Will Request

• System validation documentation (IQ, OQ, PQ protocols and reports)
• User access control policies and procedures
• Audit trail records for specific time periods
• Electronic signature policy and the FDA certification letter (§11.100(c))
• Training records demonstrating that system users are trained on the LMS
• Backup and disaster recovery procedures
• System change control records
• Vendor audit records (if the LMS is a third-party system)

Common Part 11 Inspection Findings

FDA Warning Letters and 483 Observations related to Part 11 frequently cite the following deficiencies:

• Inadequate audit trails: Missing, incomplete, or modifiable audit trails are the most common 483 observation.
• Shared user accounts: Multiple individuals sharing a single login invalidates the electronic signature uniqueness requirement of §11.100(a).
• Missing or incomplete validation: System validation documentation that does not adequately demonstrate the system performs as intended.
• Lack of e-signature controls: Systems that do not properly link signatures to records or allow signature repudiation.
• Insufficient access controls: Permissions that are broader than necessary for defined job functions.
• No written policies: Absence of documented procedures governing the use of electronic records and signatures.

21 CFR Part 11 and the Role of System Validation

System validation is perhaps the most resource-intensive aspect of Part 11 compliance. The FDA requires validation for any computerized system used in regulated activities, and validation must demonstrate that the system consistently performs as intended throughout its lifecycle.

The GAMP 5 Framework for QMS + LMS Validation

Good Automated Manufacturing Practice (GAMP 5) is the industry standard framework for validating computerized systems in regulated life science environments. GAMP 5 categorizes software by risk level, which determines the rigor of validation required:

Validation Lifecycle Documents

A complete LMS validation package for Part 11 compliance typically includes:

• Validation Plan — overarching strategy for the validation effort
• User Requirements Specification (URS) — what the system must do from a user perspective
• Functional Requirements Specification (FRS) — how the system will meet URS requirements
• Risk Assessment — identifying and mitigating risks to record integrity
• Installation Qualification (IQ) — documented verification that the system is installed correctly
• Operational Qualification (OQ) — documented verification that the system operates as intended
• Performance Qualification (PQ) — documented verification that the system performs consistently in the production environment
• Validation Summary Report — summary of all validation activities and results
• Validation Maintenance Plan — procedures for managing changes to the validated system

eLeaP’s GxP Validation and Advisory services support life science clients through the complete validation lifecycle, providing documentation templates, protocol support, and validation execution guidance.

Choosing a Part 11-Compliant LMS: What to Look For

Not all learning management systems are designed with 21 CFR Part 11 in mind. Many commercial LMS platforms are built for corporate training or education markets where regulatory compliance is not a consideration. Selecting an LMS without verifying Part 11 capabilities creates significant regulatory risk — and can result in a complete system re-validation when deficiencies are discovered during an FDA inspection.

Essential Part 11 Features for Life Science LMS Selection

• Purpose-built compliance architecture — the system was designed for regulated industries, not retrofitted
• Immutable, computer-generated audit trails — with no admin override capability
• Configurable electronic signature requirements — per course or per user action
• Role-based access controls with documented permission levels
• System validation support and documentation from the vendor
• Complete record export in FDA-reviewable formats
• Documented change control for system updates and upgrades
• Vendor qualification audit support — SOC 2 reports, security assessments
• Integration capabilities with existing quality management systems

Why eLeaP Was Built for Part 11 Compliance

eLeaP was designed from the ground up to serve life science organizations operating under FDA oversight. Unlike general-purpose LMS platforms that offer compliance features as add-ons, eLeaP’s QMS + LMS compliance architecture is foundational to the system:

• Validated System Architecture: eLeaP supports the full GAMP 5 validation lifecycle with IQ/OQ/PQ documentation frameworks and qualified vendor support.
• Immutable Audit Trails: Every user action, record creation, modification, and deletion is captured in a tamper-evident, time-stamped audit trail that satisfies §11.10(e) requirements.
• Configurable E-Signatures: Course-level e-signature settings allow administrators to require explicit electronic signature acknowledgment, with each signature uniquely linked to the user’s authenticated credentials.
• Six-Level Role Hierarchy: Admin, Instructor, Coordinator, Manager, Supervisor, and Trainee roles with granular, enforced permissions satisfy §11.10(d) and §11.10(g) requirements.
• Comprehensive Reporting: Course completion reports, non-completion reports, quiz results, learning path progress, and engagement metrics — all available on demand and schedulable for automatic delivery.
• SCORM Compliance: Full SCORM file support with recorded results ensures third-party eLearning content completions are captured with the same integrity as internally created courses.
• Integrated QMS: eLeaP’s optional Quality Management System integration provides a single platform for training management and quality event management — eliminating data silos that create compliance risk.

21 CFR Part 11 Implementation: A Step-by-Step Approach

Achieving and maintaining Part 11 compliance requires a structured, documented approach. Organizations that treat compliance as a project rather than an ongoing program consistently struggle during FDA inspections. The following framework provides a practical roadmap:

Phase 1: Inventory and Scope

• Identify all electronic systems that create, store, modify, or transmit regulated records
• Map each system to the predicate rules that require the records it manages
• Determine which systems are in scope for Part 11 based on predicate rule mapping
• Document the scope determination with a rationale

Phase 2: Gap Assessment

• Compare current system capabilities against Part 11 requirements
• Assess the validation status of each in-scope system
• Identify gaps in audit trail coverage, access controls, and e-signature capabilities
• Evaluate policy and procedure documentation gaps

Phase 3: Remediation and Validation

• Develop and implement corrective actions for identified gaps
• Execute validation activities (IQ/OQ/PQ) for systems lacking documented validation
• Implement or upgrade electronic signature controls
• Establish or revise SOPs for electronic record management

Phase 4: Training

• Train all system users on Part 11 requirements and their responsibilities
• Document training completion in your LMS with e-signature acknowledgment
• Establish ongoing training requirements for new employees and system changes

Phase 5: Ongoing Compliance Maintenance

• Implement periodic system reviews and re-validation after changes
• Conduct internal audits of Part 11 compliance
• Maintain audit trail monitoring procedures
• Manage vendor relationships and vendor qualification

21 CFR Part 11 Frequently Asked Questions

Does 21 CFR Part 11 apply to cloud-based LMS platforms?

Yes. Cloud-based LMS platforms are classified as open systems under §11.30. They are subject to all the requirements of §11.10 plus additional controls including encryption of data in transit, documented security measures, and digital signature capabilities. eLeaP’s cloud architecture includes TLS encryption for all data transmission and meets the open system requirements of §11.30.

Do all LMS training records require electronic signatures?

Not necessarily. Part 11 requires electronic signatures when the applicable predicate rule requires a signature or when you choose to use an electronic signature as the mechanism for recording completion. However, if your predicate rules require documented sign-off on training completion, you will need e-signature capability in your LMS. eLeaP’s course-level e-signature settings give administrators the flexibility to configure signature requirements based on the regulatory requirements for each training program.

How long must LMS training records be retained?

Retention periods are established by the applicable predicate rules, not by Part 11 itself. Requirements vary significantly by regulation and record type. Under 21 CFR Part 820/QMSR (medical devices), records must be retained for the design and expected life of the device, but not less than 2 years from commercial release (§820.180(b)). Under 21 CFR Part 606 (blood products), individual product records must be retained no less than 10 years after processing completion or 6 months after expiration, whichever is later. Under 21 CFR Part 211 (pharmaceuticals), batch production records are retained at least 1 year past expiration — but Part 211 does not specify a standalone training record retention period. Part 211 training record retention is generally tied to associated product records. Always work with qualified regulatory counsel to establish record-specific retention schedules for your organization.

What is a hybrid record system, and is it acceptable under Part 11?

A hybrid record system combines both paper and electronic components. The FDA accepts hybrid systems provided that all predicate rule requirements are satisfied and the content and meaning of records are preserved across both formats. Many life science organizations maintain paper-based backup processes alongside electronic systems. eLeaP supports hybrid approaches through its comprehensive data export capabilities, allowing electronic records to be archived in paper or standard electronic format.

How does FDA’s QMSR affect Part 11 compliance for medical device companies?

The Quality Management System Regulation (QMSR), which replaced 21 CFR Part 820 in February 2026, aligns U.S. medical device requirements with ISO 13485. QMSR does not replace Part 11 — it remains the governing regulation for electronic records and signatures. However, QMSR’s closer alignment with ISO 13485 means that organizations already certified to ISO 13485 will find many quality system requirements familiar. Your LMS must continue to satisfy Part 11 requirements for all training records required under QMSR.

Take the Next Step Toward 21 CFR Part 11 Compliance

21 CFR Part 11 compliance is not a destination — it is an ongoing commitment to data integrity, system security, and regulatory accountability. For life science organizations, the consequences of non-compliance extend far beyond regulatory citations: they include product recalls, import alerts, consent decrees, and reputational damage that can take years to recover from.

eLeaP has supported life science organizations in achieving and maintaining Part 11 compliance for nearly two decades. Our purpose-built LMS provides the technical controls, validation support, and compliance architecture that regulated industries require — without the complexity and cost of enterprise systems designed for organizations with very different needs.