21 CFR Part 11 defines when electronic records and electronic signatures can be treated as equivalent to paper, but only if you implement validated controls, secure audit trails, access restrictions, and proper signature linkage. It governs records that a predicate rule already requires, and it only kicks in when you choose to keep or rely on that record electronically instead of on paper. For regulated teams, practical priorities include validating systems, limiting access, maintaining audit trails, and linking each signature to the record it signs.
TL;DR:
- Part 11 applies only when a predicate rule requires a record and your organization relies on its electronic version as the official record.
- Closed systems require validation, restricted access, retrievable records, and computer generated, time stamped audit trails retained at least as long as the records.
- Each electronic signature must identify the signer, execution date and time, and meaning, while remaining uniquely linked to its record against ordinary transfer or copying.
- Cloud hosting does not transfer responsibility: organizations must validate vendor updates, verify complete audit trail exports and signature links, and document duties in a vendor agreement.
Table of Contents
- Scope and when Part 11 applies (predicate rules and "electronic-in-lieu-of-paper")
- Core Part 11 requirements, clause by clause: what auditors expect to see
- Implementation roadmap: step-by-step actions to achieve Part 11 compliance
- Audit-readiness checklist: documents to present at inspection
- Common misconceptions and enforcement discretion: what inspectors actually focus on
- Integration of 21 CFR Part 11 with quality management systems like ISO 9001 and AS9100
- Specific considerations for medical device manufacturers under Part 11
- Handling electronic signatures in cloud-based platforms and compliance challenges
- Data integrity and security best practices for electronic quality records
- A pragmatic, risk-based approach to Part 11 compliance
- How QA-Report helps teams produce audit-ready records
- FAQ
- Sources
Scope and when Part 11 applies (predicate rules and "electronic-in-lieu-of-paper")
Part 11 does not apply to every digital file in a quality system. Per FDA's Scope and Application guidance, the regulation applies when a predicate rule already requires a record, and your organization maintains or relies on the electronic version in place of paper. No predicate rule, no Part 11 obligation, regardless of how the data is stored.
A predicate rule is the underlying FDA regulation that creates the recordkeeping or signature requirement in the first place. Common examples include:
- Good Manufacturing Practice regulations under 21 CFR Part 211 for pharmaceutical production records
- Quality system records under 21 CFR Part 820 for medical device design history files, device master records, and complaint files
- Clinical investigation records under Good Clinical Practice, including case report forms and informed consent documentation
The distinction that trips up most teams involves printouts. Generating a paper copy from an electronic system does not, by itself, trigger Part 11. The regulation applies when you rely on the electronic record itself as the official version, whether or not a printout also exists. If your batch records, inspection reports, or device history records live natively in software and that software's data is the record FDA will ask to see, you are in Part 11 territory.
Core Part 11 requirements, clause by clause: what auditors expect to see
The eCFR text of Part 11 lays out specific, testable controls rather than broad principles. Each clause maps to a concrete artifact an inspector can ask for, so it helps to think clause by clause instead of treating compliance as one abstract requirement.
§11.10, controls for closed systems, is the backbone of the regulation. It requires:
- Validation of the system to ensure accuracy, reliability, and consistent intended performance
- The ability to generate accurate and complete copies of records in both human-readable and electronic form
- Protection of records to enable their accurate and ready retrieval throughout the retention period
- Limited system access to authorized individuals only
- Secure, computer-generated, time-stamped audit trails that independently record operator entries and actions, retained for at least as long as the subject records, per eCFR §11.10
§11.50, signature manifestations, requires that any signed record display the printed name of the signer, the date and time the signature was executed, and the meaning associated with that signature, such as "reviewed" or "approved." These elements must appear on human-readable forms, including printouts, and are subject to the same controls as the records themselves, as specified in eCFR §11.50.
§11.70, signature and record linking, requires that electronic signatures be bound to their respective records so they cannot be excised, copied, or transferred to falsify another record by ordinary means, according to eCFR §11.70.
Subpart C covers electronic signature requirements, including uniqueness to one individual, identity verification, and two distinct identification components for non-biometric signatures. It also addresses controls for identification codes and passwords.
Clinical investigation guidance confirms the legal weight of these controls. FDA states that electronic signatures meeting Part 11 requirements are generally the legal equivalent of handwritten signatures, which is precisely why the manifestation and linking requirements carry so much inspection scrutiny.
Implementation roadmap: step-by-step actions to achieve Part 11 compliance
Compliance work goes faster when you treat it as a sequence rather than a checklist to tackle all at once. The steps below offer one practical way to organize the work.
- Build a records inventory and retention matrix. List every record type governed by a predicate rule, note its required retention period, and flag which ones currently exist electronically.
- Define a user requirements specification (URS) and validation scope. Draft a Validation Master Plan that identifies which systems need qualification and outlines your IQ/OQ/PQ approach or equivalent testing strategy.
- Configure technical controls. Set up role-based access so each user only touches the functions their job requires, enforce strong credential management, and confirm the system generates immutable, time-stamped audit trails with signatures bound directly to their records.
- Operationalize supporting SOPs. Document how often audit trails get reviewed, how exports and printouts are generated and controlled, how backups run, how changes to validated systems are managed, and how training records are maintained.
- Verify exports and human-readable copies. Confirm that human-readable forms of signed records display the printed name, date and time of the signature, and its meaning.
Our guide on electronic signatures in manufacturing walks through signature binding in more operational detail, and our inspection documentation best practices article expands on export and review procedures.
Pro Tip: Include audit-trail behavior in system validation, not just primary data-entry functions, and document how the system protects the trail.
Audit-readiness checklist: documents to present at inspection
Preparing and organizing relevant evidence before an inspection can help teams respond to questions efficiently.
- Validation documentation, including the Validation Master Plan, the URS, and traceable IQ/OQ/PQ test records or equivalent qualification reports
- User access records, such as access lists and records of account provisioning and deprovisioning
- Audit-trail logs and review records, including documentation of review and any resulting actions
- Human-readable copies that display signature manifestations, along with records showing that archived records can be retrieved
- Policies addressing accountability for actions taken under electronic signatures and, where applicable, the organization's certification to FDA regarding their use
Our device history record compliance guide covers how these artifacts map specifically to device manufacturing recordkeeping.
Common misconceptions and enforcement discretion: what inspectors actually focus on
The biggest misconception is treating Part 11 as a blanket IT security standard. It is scope-dependent: only records required by a predicate rule and relied on electronically fall under it. FDA's own Scope and Application guidance narrowed the Agency's enforcement focus to specific areas, including certain validation, audit trail, and record-copying expectations, but this discretion does not erase the underlying predicate-rule obligations under regulations like Part 211 or Part 820.
Cloud vendors are another consideration. Teams using hosted systems should assess how the system supports applicable Part 11 requirements and their own recordkeeping obligations.
Integration of 21 CFR Part 11 with quality management systems like ISO 9001 and AS9100
Part 11 does not operate in isolation from the quality management system you already run. For manufacturers using ISO 9001 or AS9100, it may be useful to consider how existing quality-management procedures relate to Part 11 controls.
One possible approach is to incorporate relevant Part 11 controls into existing QMS procedures. For example, teams can review document-control procedures alongside applicable Part 11 audit-trail requirements. Your internal audit program can include Part 11 clause checks alongside QMS audits where that fits your organization's audit scope.
AS9102 first article inspection reports and PPAP submissions may be maintained electronically in aerospace and automotive supply chains. Whether Part 11 applies to a particular record depends on whether it is within Part 11's scope, including whether an applicable FDA predicate rule requires it.
Treating Part 11 as an extension of your QMS, rather than a separate regulatory silo, keeps audit preparation consistent and avoids duplicate documentation for the same control.
Specific considerations for medical device manufacturers under Part 11
Device manufacturers face a particular layering effect: 21 CFR Part 820 sets the quality system requirements, and Part 11 governs the electronic form of any Part 820 record you choose to maintain digitally. Device history records, design history files, complaint records, and corrective action documentation all qualify as predicate-rule records the moment they move off paper.
For electronic records and signatures subject to Part 11, signed records must include the signature information required under §11.50, and signatures must be linked to their respective records under §11.70. Part 11 requires applicable electronic signatures to be linked to their respective records so they cannot be transferred to falsify another record by ordinary means.
Calibration and measurement evidence often sits at the center of device quality records as well. Teams managing calibrated instruments across multiple sites sometimes rely on external calibration providers; resources like PCS Precision's comparison of Part 11 and Annex 11 are useful for understanding how calibration-related evidence maps across US and international frameworks when a device manufacturer sells into multiple markets.
Handling electronic signatures in cloud-based platforms and compliance challenges
Cloud-hosted quality systems can raise considerations such as vendor-managed updates and distributed user access. Assess these features as part of the system's validation and compliance planning.
FDA's own commentary on cloud-hosted systems flags that IT teams need to plan specifically for accuracy, reliability, and the ability to discern invalid or altered records when data lives in a cloud environment rather than on-premise infrastructure. That means your validation package should address how the vendor manages version updates, how access provisioning works across your organization's user base, and how audit trails survive a platform migration or vendor change.
Practical steps that reduce friction include confirming your vendor can produce a complete, unaltered export of audit trail data on request, verifying that signature binding survives data export and import, and maintaining your own documented record of which vendor features you rely on for Part 11 controls, independent of the vendor's own claims. A quality agreement or technical agreement with the vendor, spelling out who validates what, closes a gap that inspectors frequently probe.
Data integrity and security best practices for electronic quality records
Good data integrity practice for Part 11 records starts with a straightforward principle: every entry, edit, and deletion should be attributable, legible, contemporaneous, original, and accurate. That principle shapes several concrete practices.
Organizations can set an audit-trail review schedule based on their assessment of record and process risk. Audit-trail documentation should be available in a form that can be reviewed and understood alongside the underlying record.
Access controls should be managed carefully. Review permissions, remove access when it is no longer appropriate, and use individual credentials for electronic signatures to support the Subpart C requirement that each signature be unique to one individual.
Backup and archive processes should support the accurate and ready retrieval of records throughout the applicable retention period, as required by §11.10.
A pragmatic, risk-based approach to Part 11 compliance
A risk-based approach can help teams focus on records within Part 11's scope, prepare relevant evidence, and assess whether repeatable tasks such as audit-trail review can be supported by tools. Software can enforce controls, but documented processes and disciplined reviews are what an inspector ultimately checks.
— Michael Chen
How QA-Report helps teams produce audit-ready records
QA-Report is designed to support measurement and inspection-record workflows. Its measurement wizard links drawing dimensions to measured results and flags out-of-tolerance deviations, while its PDF exports provide a format for documenting inspection records.
We offer cloud and on-premise deployment options for teams in aerospace, automotive, and medical-device production. If you are mapping your URS and validation plan against a new reporting platform, visit our pricing page to compare the Free, Basic, PRO, On-Premise, and Enterprise Solutions options and find the fit for your validation scope.
FAQ
What are the ways compliance with 21 CFR Part 11 can be increased?
Compliance improves most reliably through a validated system, documented role-based access controls, secure time-stamped audit trails, and signatures properly linked to their records as required under §11.10 and §11.70. Regular audit-trail review and ongoing staff training on signature accountability close most of the remaining gaps.
What is 21 CFR Part 111?
21 CFR Part 11 is specifically about electronic records and electronic signatures, distinct from other parts of the CFR that cover manufacturing practices for supplements and other products. Manufacturing, packaging, and labeling processes for supplement producers are covered by a separate regulation rather than electronic recordkeeping.
When did 21 CFR Part 11 go into effect?
Part 11 was published as a final rule in the Federal Register in 1997, establishing the criteria under which FDA would accept electronic records and electronic signatures as equivalent to paper records and handwritten signatures, per the official Federal Register notice.
What does 21 CFR stand for?
21 CFR refers to Title 21 of the Code of Federal Regulations, the section of federal regulations covering food and drugs, including FDA's rules for pharmaceuticals, medical devices, and electronic records. Part 11 sits within this title as the section specifically governing electronic records and electronic signatures.
Does using cloud software automatically make our records Part 11 compliant?
No single software platform makes an organization compliant on its own. Validation, access control, and audit-trail integrity remain the regulated organization's responsibility regardless of whether records are hosted on-premise or in the cloud.
Sources
- Part 11, Electronic Records; Electronic Signatures - Scope and Application | FDA
- eCFR :: 21 CFR Part 11 -- Electronic Records; Electronic Signatures