FDA 21 CFR Part 11 — Electronic Records; Electronic Signatures

FDA 21 CFR Part 11 — Electronic Records; Electronic Signatures

Issuing body / enforcer: U.S. Food and Drug Administration (FDA), under the Federal Food, Drug, and Cosmetic Act. Jurisdiction: United States — any FDA-regulated entity (pharma, biotech, medical devices, food, blood/tissue) that uses electronic records or signatures in place of paper under an FDA "predicate rule" (e.g., GMP 21 CFR 211, QSR/QMSR 21 CFR 820).

1. What it is

Part 11 (effective 1997) sets the criteria under which FDA considers electronic records and electronic signatures trustworthy, reliable, and equivalent to paper. It does not require anyone to go electronic — but once you do, the controls apply. For controls/automation engineers, Part 11 is the reason SCADA historians, batch records, LIMS, MES, and PLC audit trails in life-sciences plants look the way they do: every regulated action must be attributable, legible, contemporaneous, original, and accurate (the ALCOA principles, with completeness, consistency, endurance, and availability — ALCOA++).

2. Scope, triggers, thresholds

• Trigger: using electronic records/signatures to satisfy any FDA recordkeeping requirement. Paper-only processes are outside Part 11 (but rare in modern plants).
• Closed systems (access controlled by the record owner — the normal plant case) vs. open systems (access not controlled by the owner, e.g., internet-facing) — open systems carry additional encryption/digital-signature controls.
• Controls required (11.10, closed systems): validation of systems; ability to generate accurate, complete copies; protection of records for retention; limited authorized access; secure, computer-generated, time-stamped audit trails recording operator entries and actions (independently, without obscuring prior values); enforcement of operational checks; authority checks; device checks; education/training of personnel; and controls over system documentation.
• Electronic signatures (11.50–11.70): must be unique to the individual, verified at signing, include printed name/date/meaning of signature; biometric vs. non-biometric distinctions; controls to prevent signature falsification.
• Predicate rules first: Part 11 does not create recordkeeping duties — it governs how electronic records satisfy duties created elsewhere (batch records, device history records, CAPA, etc.).

3. Key requirements and compliance obligations

1. Computerized-system validation (CSV): risk-based validation (GAMP 5 is the industry methodology) with IQ/OQ/PQ, requirements traceability, and revalidation on change.
2. Audit trails: immutable, reviewed — FDA's current enforcement focus is not merely having audit trails but reviewing them (data-integrity inspections routinely cite failure to review audit trails).
3. Access control and authority checks: role-based access, unique logins (shared accounts are a classic 483 observation), periodic access review.
4. Record retention and retrieval: records retrievable and readable for the full predicate-rule retention period — including through system upgrades and vendor changes (the "readable archive" problem).
5. Procedural controls: SOPs for system operation, security, change control, backup/restore, and periodic review.
6. EU parallel: Annex 11 of the EU GMP Guide covers computerized systems for the European market — substantially aligned, with its own inspection emphasis.

4. Penalties and consequences

Part 11 has no standalone penalty schedule — violations are enforced through the FD&C Act: FDA Form 483 observations, Warning Letters, import alerts, consent decrees, and product seizure/injunction. Data-integrity failures (audit-trail gaps, shared logins, backdated records) are among the most common drivers of Warning Letters and consent decrees in pharma; a consent decree can idle a plant for years and cost hundreds of millions. Criminal prosecution is available for fraud.

5. Version status and live changes (verified 2026-09-30)

• Regulation unchanged: Part 11's text is stable; the live action is in enforcement interpretation. FDA's 2003 guidance ("Part 11, Electronic Records; Electronic Signatures — Scope and Application") narrowed enforcement to a risk-based approach, and FDA has been working toward revised guidance — [Flag: confirm whether final revised Part 11 guidance has issued; draft guidance on data integrity and on electronic systems has circulated, and inspection practice already reflects it.]
• Data-integrity enforcement wave: FDA (and MHRA/EMA) continue to cite data-integrity failures aggressively — audit-trail review, system-admin privileges, and time synchronization are perennial 483 topics. The 2024 QMSR final rule (21 CFR 820 modernization, aligning with ISO 13485) raises the computerized-system bar for device makers — [Flag: QMSR transition timelines should be confirmed for device programs.]
• Cloud/SaaS: FDA accepts cloud-hosted GxP systems provided validation, audit-trail, and record-retention controls are demonstrated — vendor qualification (including the vendor's own change control) is the inspection focal point.

6. Related certifications

• ISA Certified Automation Professional (CAP) (Controls/Automation flagship): the automation credential most directly relevant — CAP domains cover the control-system lifecycle, and life-sciences automation roles routinely require Part 11 fluency.
• TÜV Rheinland Functional Safety Engineer / CFSE (Controls/Automation flagship): relevant where safety systems and GxP systems intersect (e.g., SIS in pharma utilities), though not Part 11-specific.
• GAMP 5 practitioner training and vendor-specific historian/MES validation training are the usual working credentials; no catalogue certification tests Part 11 clauses directly.

7. Practical notes

• Unique user accounts with no sharing is the single cheapest Part 11 control and the single most cited failure — fix it before the inspection, not during.
• Time synchronization (NTP) across PLCs, historians, and MES is a Part 11 control in practice: unsynchronized timestamps destroy audit-trail credibility.
• Validate the audit-trail review process, not just the audit trail: FDA wants evidence that someone actually looked, on a defined cadence, with documented follow-up.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.