What is 21 CFR Part 11

Understanding 21 CFR Part 11, Who Must Comply, Key Requirements, Implementation Steps, and How to Achieve FDA Inspection Readiness

What Is 21 CF Part 11

US 21 CFR Part 11—formally titled “Electronic Records; Electronic Signatures”—is the FDA regulation establishing criteria for accepting electronic records and electronic signatures as equivalent to paper records and handwritten signatures. Published in 1997 and clarified through subsequent FDA guidance, Part 11 governs how FDA-regulated organizations create, modify, maintain, archive, retrieve, and transmit electronic records while ensuring data integrity, security, and regulatory compliance. eLeaP provides a fully Part 11-compliant LMS and eQMS purpose-built for FDA-regulated organizations.

For pharmaceuticals, biotechnology, medical device manufacturers, and other life science organizations, understanding and implementing US 21 CFR Part 11 requirements is essential for regulatory compliance, FDA inspection readiness, and avoiding warning letters or consent decrees. The regulation affects virtually every computerized system used in FDA-regulated operations—from manufacturing execution systems and laboratory information systems to quality management platforms and learning management systems.

This comprehensive guide explains what US 21 CFR Part 11 is, who must comply, the regulation’s structure and key requirements, implementation strategies, validation approaches, common compliance challenges, and how to prepare for FDA inspection.

What Is 21 CF Part 11

What Is US 21 CFR Part 11?

US 21 CFR Part 11 is the Code of Federal Regulations section establishing the conditions under which FDA considers electronic records and electronic signatures to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures.

Historical Context and Purpose

Why Part 11 Exists:

Before 1997, FDA regulations required paper-based documentation and wet-ink signatures for critical GMP, GLP, and GCP activities. As organizations adopted electronic systems for efficiency and accuracy, they sought FDA acceptance of electronic records without maintaining parallel paper systems. Part 11 was FDA’s response, establishing criteria that electronic record systems must meet to be considered compliant.

The Regulation’s Goals:

  1. Enable electronic records: Allow FDA-regulated organizations to replace paper with validated electronic systems
  2. Ensure data integrity: Establish controls ensuring electronic records are accurate, complete, and reliable
  3. Prevent falsification: Require safeguards preventing and detecting unauthorized data manipulation
  4. Establish accountability: Link electronic signatures to specific individuals with non-repudiation
  5. Support inspections: Enable FDA investigators to review electronic records during inspections

Regulatory Structure

US 21 CFR Part 11 consists of three subparts:

Subpart A – General Provisions (§11.1 – §11.3):

Subpart B – Electronic Records (§11.10 – §11.70):

Subpart C – Electronic Signatures (§11.100 – §11.300):

Who Must Comply with US 21 CFR Part 11?

Part 11 applies broadly across FDA-regulated industries:

Organizations Required to Comply

Pharmaceutical and Biopharmaceutical Companies:

Medical Device Companies:

Biotechnology and Research Organizations:

Blood and Tissue Establishments:

Other FDA-Regulated Entities:

When Part 11 Applies

Part 11 requirements apply when:

  1. Records are required by predicate rules: Other FDA regulations (Parts 210, 211, 820, etc.) require records to be created and maintained.
  1. Records are maintained electronically: Instead of paper, the organization uses computerized systems.
  1. Electronic signatures are used: Electronic signatures substitute for handwritten signatures on required records.

If all three conditions are met, the system must comply with Part 11.

Important distinction: FDA’s 2003 guidance document “Part 11, Scope and Application” clarified that Part 11 applies only when replacing paper records/signatures with electronic equivalents. Systems that don’t replace paper-based processes have different requirements.

Key Requirements of US 21 CFR Part 11

The regulation establishes specific controls for electronic records and signatures:

Subpart B: Electronic Records Requirements

Organizations using closed systems (systems where access is controlled by the organization) must:

Validation (§11.10(a)): Validate systems to ensure accuracy, reliability, consistent intended performance, and ability to discern invalid or altered records.

Audit Trails (§11.10(e)): Generate secure, computer-generated, time-stamped audit trails independently recording date/time of operator entries creating, modifying, or deleting electronic records. Audit trails must be retained and available for FDA review.

Operational System Checks (§11.10(f)): Implement authority checks, device checks, determination that persons are who they represent themselves to be, and implementation of operational constraints.

Education and Training (§11.10(i)): Ensure personnel are educated, trained, and experienced in Part 11 requirements as they relate to assigned tasks.

Accountability (§11.10(j)): Establish clear accountability for individuals developing, maintaining, or using electronic record/signature systems.

Documentation Controls (§11.10(k)): Determine that persons who develop, maintain, or use electronic record/signature systems have authority to access, change, or delete records.

Device Checks (§11.10(g)): Determine validity of source of data input or operational instruction.

For open systems (where access is not controlled by the organization), all closed system requirements apply plus:

Encryption or Digital Signatures: Employ additional measures such as document encryption and use of digital signatures to ensure authenticity, integrity, and confidentiality.

Subpart C: Electronic Signatures Requirements

Electronic signatures must:

Electronic signatures and handwritten signatures executed to electronic records must be linked to respective records to ensure signatures cannot be excised, copied, or transferred.

Each electronic signature must be unique to one individual and shall not be reused by or reassigned to anyone else.

Electronic signatures based on biometrics must be designed to ensure they cannot be used by anyone other than genuine owners.

Organizations must ensure that identification code and password combinations:

Implementing US 21 CFR Part 11 Compliance

Organizations should follow a structured approach to Part 11 implementation:

Phase 1: System Identification and Risk Assessment

Inventory Electronic Systems: Identify all computerized systems creating, modifying, maintaining, archiving, retrieving, or transmitting GMP/GLP/GCP records.

Common systems include:

Conduct Part 11 Applicability Assessment:

For each system, determine:

Perform Risk-Based Assessment:

Categorize systems by:

Higher-risk systems require more rigorous Part 11 controls.

Phase 2: Gap Analysis

Review Current System Capabilities:

Evaluate whether existing systems provide:

Identify Gaps:

Document where current systems fall short of Part 11 requirements and prioritize remediation based on risk.

Phase 3: System Validation

Develop Validation Strategy:

Installation Qualification (IQ):

Operational Qualification (OQ):

Performance Qualification (PQ):

Create Validation Documentation:

Phase 4: Procedural Controls

Develop Standard Operating Procedures (SOPs):

Required SOPs typically include:

Implement Training Programs:

Train users on:

Phase 5: Ongoing Maintenance and Compliance

Establish Periodic Review:

Implement Change Control:

Conduct Self-Audits:

Common Part 11 Compliance Challenges

Organizations frequently encounter these implementation obstacles:

1. Legacy System Limitations

Challenge: Older systems lack native Part 11 capabilities (comprehensive audit trails, electronic signatures, access controls).

Solutions:

2. Incomplete Audit Trails

Challenge: Systems capture some but not all required audit trail data.

Solutions:

3. User Access Management

Challenge: Maintaining unique user credentials, managing password policies, preventing shared logins.

Solutions:

4. Validation Documentation

Challenge: Creating and maintaining comprehensive validation documentation is resource-intensive.

Solutions:

5. Audit Trail Review

Challenge: Reviewing extensive audit trails for anomalies is time-consuming.

Solutions:

FDA Inspection Preparation

Prepare for FDA inspection by:

  1. Documentation Readiness:
  1. Demonstrate Compliance:
  1. Common FDA Questions:
  1. Inspection Best Practices:

eLeaP Part 11 Compliant Learning Management System (LMS) & Quality Management System (eQMS)

eLeaP provides a fully Part 11-compliant LMS and eQMS purpose-built for FDA-regulated organizations:

Pre-Validated Platform:

Comprehensive Audit Trails:

Electronic Signature Controls:

Access Controls:

Data Integrity:

19+ Years Regulatory Experience:

Frequently Asked Questions About US 21 CFR Part 11

What does US 21 CFR Part 11 regulate?

US 21 CFR Part 11 regulates electronic records and electronic signatures used by FDA-regulated organizations. Specifically, it establishes the technical and procedural requirements that electronic record systems must meet for FDA to consider electronic records and signatures trustworthy, reliable, and equivalent to paper records and handwritten signatures. The regulation covers system validation, audit trails, access controls, electronic signature controls, and documentation requirements. Part 11 applies when FDA regulations require records to be maintained, those records are created and stored electronically, and electronic signatures are used instead of handwritten signatures. It affects computerized systems across manufacturing, laboratory, quality, and training operations in pharmaceuticals, medical devices, biotechnology, and other FDA-regulated industries.

Who needs to comply with 21 CFR Part 11?

Organizations that must comply with US 21 CFR Part 11 include pharmaceutical manufacturers, biotechnology companies, medical device manufacturers, contract manufacturing organizations, research laboratories, clinical research organizations, blood banks, tissue banks, and other FDA-regulated entities. Specifically, Part 11 compliance is required when three conditions are met: (1) another FDA regulation (predicate rule) requires specific records to be created and maintained, (2) the organization maintains those records electronically instead of on paper, and (3) electronic signatures are used instead of handwritten signatures. If all three apply, the electronic record system must comply with Part 11 requirements. Organizations only creating electronic records for convenience without predicate rule requirements have different obligations under FDA’s 2003 guidance on Part 11 scope.

What are the key requirements of 21 CFR Part 11?

Key Part 11 requirements include: (1) System validation ensuring accuracy, reliability, and consistent intended performance. (2) Audit trails – secure, computer-generated, time-stamped logs independently recording who created, modified, or deleted electronic records and when. (3) Access controls – unique user credentials, authority checks, and operational constraints preventing unauthorized access. (4) Electronic signatures – unique to each individual, linked permanently to signed records, including printed name, date/time, and meaning. (5) Data integrity – controls ensuring records remain accurate, complete, and reliable throughout their lifecycle. (6) Training – documented education for personnel on Part 11 requirements relevant to their roles. (7) Documentation – complete validation documentation, SOPs, and records demonstrating ongoing compliance.

What is the difference between electronic signatures and digital signatures?

Electronic signatures and digital signatures are related but different concepts under Part 11. An electronic signature is a broad term meaning any electronic method of signing a record, implemented through various technologies like username/password combinations, biometrics, or digital certificates. A digital signature is a specific type of electronic signature using cryptographic methods based on public key infrastructure (PKI). Digital signatures provide mathematical proof of authenticity, integrity, and non-repudiation through encryption. Part 11 allows both approaches. Most FDA-regulated organizations use simpler electronic signature methods (username/password with signature meaning) for routine operations, reserving digital signatures for open systems or higher-security applications requiring cryptographic validation. Both must meet Part 11’s requirements for uniqueness, permanent record linking, and accountability.

What is an audit trail and why is it required?

An audit trail is a secure, computer-generated, time-stamped electronic record documenting the sequence of activities affecting a specific operation, procedure, or event. Under Part 11 §11.10(e), audit trails must independently record the date, time, and individual responsible for creating, modifying, or deleting electronic records. Audit trails are required to enable reconstruction of events, detect unauthorized access or data manipulation, support regulatory inspection, establish accountability, and ensure data integrity. Compliant audit trails must capture what changed, when it changed, who made the change, and (ideally) why it changed. Audit trails must be retained for the same period as the associated records and be available for FDA review. Organizations must review audit trails periodically to identify anomalies or unauthorized activities.

How do you validate a Part 11 system?

Validate Part 11 systems through Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ). IQ verifies the system is installed correctly per specifications, infrastructure meets requirements, and configuration is documented. OQ tests all Part 11-relevant functions including audit trail completeness and accuracy, user access controls, electronic signature functionality, and data integrity controls. PQ demonstrates the system performs correctly in actual operational use with real users and workflows. Validation must be documented through validation plans, test protocols, execution records, and summary reports creating traceability from requirements through testing to approval. Risk-based approaches focus validation efforts on critical Part 11 controls. Many vendors provide validation documentation packages significantly reducing customer validation burden. Revalidation is required when systems are upgraded or significantly changed.

What happens if you don’t comply with Part 11?

Non-compliance with Part 11 can result in serious regulatory consequences including FDA warning letters citing specific Part 11 deficiencies, consent decrees requiring extensive remediation under FDA oversight, import alerts preventing product entry into the US, withholding of product approval for pending applications, mandatory corrective action plans with FDA verification, increased inspection frequency and scrutiny, and potential product recalls if data integrity issues affect product quality. FDA 483 observations commonly cite inadequate audit trails, insufficient user access controls, lack of validation documentation, poor audit trail review practices, and shared user credentials. Beyond regulatory penalties, Part 11 violations indicate underlying data integrity problems potentially affecting product quality and patient safety, creating significant business risk. Proactive compliance prevents these outcomes and demonstrates organizational commitment to quality.

Do cloud-based systems need to comply with Part 11?

Yes, cloud-based systems used by FDA-regulated organizations must comply with Part 11 when applicable (records required by predicate rules, maintained electronically, with electronic signatures). Cloud deployment doesn’t exempt systems from Part 11 requirements. However, cloud-based systems often facilitate Part 11 compliance through enterprise-grade security (SOC 2 Type 2, ISO 27001 certifications), comprehensive audit logging, robust access controls, encryption at rest and in transit, and vendor-provided validation documentation. When using cloud systems, organizations must ensure vendor contracts address data ownership, FDA inspection access, data retention, and disaster recovery. Organizations remain responsible for Part 11 compliance even when using third-party cloud providers. Qualification of cloud vendors and documented service level agreements are essential. Many modern cloud-based LMS, QMS, and other systems are purpose-built for Part 11 compliance.

What is FDA’s guidance on Part 11 scope and application?

FDA’s 2003 guidance “Part 11, Scope and Application” clarified the regulation’s intent and narrowed its application. The guidance states FDA will exercise enforcement discretion (not strictly enforce all Part 11 requirements) for certain systems if: (1) Records are maintained in electronic format in addition to paper, not instead of paper. (2) Electronic copies are not used in lieu of original paper records during FDA inspections. However, FDA expects all electronic records to comply with predicate rule requirements (underlying GMP, GLP, GCP regulations) even if not enforcing all Part 11 specifics. The guidance identifies limited Part 11 requirements FDA will enforce: validation, audit trails, legacy systems, record retention, and record copying. This risk-based approach allows organizations to focus resources on critical Part 11 controls while maintaining overall data integrity.

How long must Part 11 records be retained?

Part 11 records must be retained for the same duration as required by the predicate rules governing those records. Retention periods vary by record type and regulation. For pharmaceutical drug products, batch records typically must be retained for at least one year after expiration (21 CFR 211.180). For medical devices, quality records must be retained for the lifetime of the device plus two years (21 CFR 820.180), but no less than two years from release. For clinical investigations, records must be retained for two years after marketing application approval or withdrawal (21 CFR 312.62). Audit trails associated with electronic records must be retained for the same period as the records themselves. Organizations must ensure electronic record systems provide long-term data accessibility, account for technology obsolescence, and maintain ability to produce accurate copies years after original creation.

What is the difference between Part 11 and data integrity?

Part 11 is a specific FDA regulation establishing technical controls for electronic records and signatures. Data integrity is a broader concept ensuring data is attributable, legible, contemporaneous, original, and accurate (ALCOA principles) throughout the data lifecycle. While Part 11 is one regulatory framework supporting data integrity in electronic systems, data integrity requirements extend beyond Part 11. FDA expects data integrity regardless of whether records are paper or electronic, whether Part 11 applies, or whether systems are legacy or modern. Part 11 provides specific technical controls (audit trails, validation, access controls) implementing data integrity principles for electronic records. Organizations must maintain data integrity through combination of Part 11 compliance for applicable electronic systems, adherence to predicate rule requirements, robust quality culture and training, appropriate procedural controls, and regular data integrity audits and risk assessments.

Can you use spreadsheets and databases for Part 11 records?

Yes, but with significant caveats. Spreadsheets (Excel) and simple databases can be used for Part 11-regulated records if properly validated and controlled, but they present substantial challenges. Native spreadsheet software lacks comprehensive audit trails, has limited access controls, doesn’t prevent data overwriting or deletion, and is difficult to validate comprehensively. To use spreadsheets for Part 11 records, organizations must implement compensating controls: limit write access to approved users only, create read-only versions for general use, maintain separate audit trail documentation of changes, perform change control for template modifications, validate calculations and macros, and back up regularly with version control. However, most organizations find that dedicated Part 11-compliant systems (QMS, LMS, LIMS) purpose-built with necessary controls are more cost-effective and less risky than trying to force spreadsheets into Part 11 compliance. Use spreadsheets only for low-risk applications with robust manual controls.

What training is required for Part 11 compliance?

Part 11 §11.10(i) requires organizations to ensure personnel are educated, trained, and experienced in Part 11 requirements as they relate to their assigned tasks. Required training includes: (1) General Part 11 awareness for all users of electronic record systems covering regulation’s purpose, data integrity principles, and individual accountability. (2) Role-specific training teaching system users how to properly create, review, approve, and modify electronic records in their work context. (3) Electronic signature training ensuring users understand signature meaning, accountability, and non-repudiation before being granted signature authority. (4) Administrator training for personnel managing systems on user access controls, audit trail review, validation, and change control. (5) Audit trail review training for designated reviewers on identifying anomalies and unauthorized activities. Training must be documented with records showing who was trained, when, and on what topics. Retraining is required when procedures change or deficiencies are identified.

How do you prepare for an FDA inspection focused on Part 11?

Prepare for Part 11-focused FDA inspection by: (1) Organizing validation documentation – ensure IQ/OQ/PQ protocols, execution records, and summary reports are readily accessible and complete. (2) Reviewing SOPs – verify all Part 11-related procedures are current, approved, and actually followed in practice. (3) Verifying training records – confirm all system users have documented Part 11 training relevant to their roles. (4) Testing audit trail access – ensure you can quickly retrieve and display audit trails for any electronic record. (5) Preparing system owners – designate knowledgeable personnel who can explain system validation, controls, and compliance approach. (6) Conducting mock inspections – have quality or IT staff role-play FDA investigators reviewing systems. (7) Reviewing recent audit trail reviews – have documentation showing periodic audit trail monitoring. (8) Preparing demonstration scenarios – practice showing electronic signature application, audit trail review, and access controls. Be prepared to explain limitations and compensating controls honestly.

What is a hybrid system under Part 11?

A hybrid system maintains both electronic and paper versions of the same records, with neither version designated as the “official” record of record. Under FDA’s 2003 Part 11 guidance, FDA exercises enforcement discretion for hybrid systems, meaning FDA will not enforce all Part 11 requirements if organizations maintain paper as the official record and only use electronic copies for convenience. However, if electronic records are used as the primary record during FDA inspections or the paper records are not maintained contemporaneously, Part 11 applies in full. Hybrid systems create compliance challenges including duplicate data entry burden, synchronization requirements between electronic and paper, confusion about which is authoritative, increased storage costs, and difficulty maintaining both systems with equal accuracy. Most organizations have moved away from hybrid approaches in favor of fully validated Part 11-compliant electronic systems eliminating paper entirely for better efficiency and data integrity.

Conclusion

US 21 CFR Part 11 establishes the framework enabling FDA-regulated organizations to leverage electronic record systems while maintaining the data integrity, security, and accountability the FDA requires. Understanding what Part 11 is, who must comply, and how to implement compliant systems is essential for pharmaceutical, biotechnology, medical device, and other life science organizations operating in the modern regulatory environment.

Successful Part 11 compliance requires careful system selection, comprehensive validation, robust procedural controls, ongoing training, and continuous monitoring. Organizations that invest in purpose-built Part 11-compliant systems like eLeaP’s validated LMS platform benefit from pre-configured compliance features, vendor-provided validation documentation, and expert support—significantly reducing implementation effort while ensuring FDA inspection readiness.

Ready to explore eLeaP’s Part 11-compliant learning management system?

eLeaP provides a fully Part 11-compliant learning management system with pre-validated documentation, comprehensive audit trails, electronic signature controls, robust access management, and 19 years of proven expertise serving FDA-regulated organizations with 100% inspection success rate—enabling life science companies to implement compliant training systems efficiently and maintain ongoing regulatory readiness.