21 CFR Part 11 is the FDA regulation on electronic records and electronic signatures. It applies to electronic records kept under FDA record requirements or submitted to FDA, and it requires validated systems, secure time-stamped audit trails, limited access, and signatures that show the signer, the date and time and the meaning. FDA interprets its scope narrowly.
- Part 11 applies when an FDA rule requires the record, or when the record is submitted to FDA.
- Audit trails must be computer-generated, time-stamped and kept as long as the records.
- Each signed record shows the printed name, the date and time and the meaning of the signature.
- FDA guidance narrows enforcement of some requirements, but the predicate rules still apply in full.
What is 21 CFR Part 11?
Part 11 sets "the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper" (21 CFR 11.1(a)). It has three subparts: general provisions (11.1 to 11.3), electronic records (11.10 to 11.70) and electronic signatures (11.100 to 11.300).
Who is required to follow 21 CFR Part 11?
Anyone keeping electronic records that an FDA regulation requires. The rule "applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations", and to electronic records submitted to FDA, but "does not apply to paper records that are, or have been, transmitted by electronic means" (21 CFR 11.1(b)).
FDA's scope guidance says the agency "will narrowly interpret the scope of part 11" and does "not intend to take enforcement action to enforce compliance with the validation, audit trail, record retention, and record copying requirements of part 11 as explained in this guidance". It adds that "records must still be maintained or submitted in accordance with the underlying predicate rules" (FDA guidance). In practice: identify which predicate rule (GLP, GMP, GCP and so on) requires each record first.
What is the difference between a closed and an open system?
A closed system "means an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system"; an open system is one where it is not (21 CFR 11.3). Open systems need the closed-system controls plus "additional measures such as document encryption and use of appropriate digital signature standards" (21 CFR 11.30). A validated ELN or LIMS run by your own IT is usually closed; records exchanged through a third party's platform may not be.
What are the 21 CFR Part 11 requirements, section by section?
Paraphrased from the regulation. The download has one row per requirement, each with its section number.
| Section | Requirement |
|---|---|
| 11.10(a) | Validate systems for accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records |
| 11.10(b) | Generate accurate and complete copies in human readable and electronic form for FDA inspection |
| 11.10(c) | Protect records for accurate and ready retrieval throughout the retention period |
| 11.10(d) | Limit system access to authorized individuals |
| 11.10(e) | Secure, computer-generated, time-stamped audit trails; changes must not obscure earlier entries |
| 11.10(f) to (h) | Operational sequence checks, authority checks and device checks |
| 11.10(i) to (j) | Trained people, and a written policy holding individuals accountable for their signatures |
| 11.10(k) | Controls over systems documentation, with change control |
| 11.50 | Signed records show printed name, date and time, and meaning, including on printouts |
| 11.70 | Signatures linked to records so they cannot be excised, copied or transferred |
| 11.100 | Each signature unique to one person; identity verified; certification to FDA |
| 11.200 | Non-biometric signatures use at least two components, such as ID code and password |
| 11.300 | Unique ID and password pairs, periodic checks, loss management, safeguards, device tests |
What does a Part 11 audit trail have to record?
The rule requires "secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records", adds that "Record changes shall not obscure previously recorded information", and says the audit trail must be kept at least as long as the records it covers (21 CFR 11.10(e)). In practice that means who, what, when, the old value and the new value, generated by the system rather than typed by a user.
Part 11 compliance checklist, with a worked example
The Part 11 checklist (CSV) has 30 rows, one per requirement, with columns for evidence, status and owner. The example below is invented: a contract lab reviewing the ELN it uses for sponsor studies.
| Section | Finding (fictional) | Action |
|---|---|---|
| 11.10(a) | Vendor validation package on file; no lab-specific validation of configured templates | Write and run a configuration validation protocol |
| 11.10(e) | Audit trail records edits but exports only inside the application | Confirm an export path that keeps the audit trail with the records |
| 11.50 | Printouts show signer and date but not the meaning of the signature | Add "reviewed" or "approved" to the signature block |
| 11.100(c) | No record of the certification letter to FDA | Find it or send it, and file the copy |
| 11.300(b) | Passwords never expire for instrument accounts | Set periodic review and remove shared accounts |
Common Part 11 mistakes
- Treating a vendor's "Part 11 compliant" claim as your validation; you validate the system as you configured and use it.
- Shared logins on instruments, which break unique signatures and authority checks.
- Audit trails that can be switched off, or that live only in the application and are lost on migration.
- Signature blocks without the meaning of the signature.
- Exporting PDFs as the only copy and discarding the electronic record and its metadata.
- Forgetting the predicate rule: Part 11 controls how a record is kept, not whether it must be kept.
How the regulation is organized
Part 11 sits in Title 21 of the Code of Federal Regulations, Chapter I (the FDA), and is short: three subparts and ten sections. The official, current text is on the eCFR, free to read.
| Subpart | Sections | What they cover |
|---|---|---|
| A. General provisions | 11.1 to 11.3 | Scope, implementation (including records submitted to FDA) and definitions such as closed and open systems |
| B. Electronic records | 11.10, 11.30, 11.50, 11.70 | Controls for closed and open systems, what a signed record must show, and linking signatures to records |
| C. Electronic signatures | 11.100, 11.200, 11.300 | General requirements, signature components and controls, and controls for ID codes and passwords |
Validated electronic records are also a data asset
Records kept under Part 11 come with what most datasets lack: who did what, when, and every change since. That audit trail is what lets anyone trust an experiment years later.
AI developers working on biology and chemistry ask for experiments like these with their context and their failures. Sponsor-owned studies, partner-restricted projects and identifiable human-subject data stay out unless the agreements and consents allow them; licensing R&D lab notebooks covers the general case.
If your company keeps years of lab notebooks and assay results, the guide for biotechs, CROs and contract labs explains what AI developers ask for and who signs. To see what yours could be worth, describe them in six questions; no files or system access needed.
Common questions
What does 21 CFR Part 11 stand for?
Title 21 of the Code of Federal Regulations, Part 11: the FDA regulation on electronic records and electronic signatures. It sets when FDA treats electronic records and signatures as equivalent to paper records and handwritten signatures.
Who is required to follow 21 CFR Part 11?
Anyone who keeps electronic records required by an FDA regulation, such as GLP, GMP or clinical trial rules, or who submits electronic records to FDA. It does not apply to paper records that were only transmitted electronically.
What are the main requirements of 21 CFR Part 11?
Validated systems, accurate copies, record protection, limited access, secure time-stamped audit trails, operational, authority and device checks, trained staff, signature manifestations, signature-record linking, unique signatures with two components, and password and token controls.
Does Part 11 require an audit trail for every change?
For records within its scope, yes: 11.10(e) requires computer-generated, time-stamped audit trails of entries and actions that create, modify or delete records, without obscuring earlier entries. FDA's scope guidance describes enforcement discretion for some of these requirements, but the predicate rules still apply.
What must an electronic signature show under Part 11?
The printed name of the signer, the date and time of signing, and the meaning of the signature, such as review, approval, responsibility or authorship. These must also appear on any printout or display of the record.
Is a software vendor's Part 11 certificate enough?
No. Software can provide the features, but the regulated company must validate the system as configured and used, write the procedures, control access and keep the records. Ask the vendor for its validation package and build on it.
What is the difference between Part 11 and EU Annex 11?
Part 11 is a US FDA regulation; Annex 11 is the EU GMP guidance on computerised systems. They cover similar ground, such as validation, audit trails and signatures. Check each against its own text when you work in both regions.
Can a company export Part 11 records to share with a partner?
It can share a copy, but the original records, audit trails and signatures must stay intact and retrievable in the source system for the full retention period. Check that the export keeps metadata and audit trails, and that agreements allow sharing.
When did 21 CFR Part 11 take effect?
August 20, 1997. FDA's September 2003 scope and application guidance refers to systems "operational before August 20, 1997, the effective date of part 11" and describes enforcement discretion for them when several conditions are met. One condition is that "The system currently meets all applicable predicate rule requirements".
Sources and further reading
Origin Data Partners is an independent data partner. We work with buyers, and a buyer may pay us when a deal closes.
- 21 CFR 11.1: scope of Part 11 (electronic records and signatures)
- 21 CFR 11.3: definitions (closed and open systems)
- 21 CFR 11.10: controls for closed systems
- 21 CFR 11.30: controls for open systems
- 21 CFR 11.50: signature manifestations
- 21 CFR 11.70: signature/record linking
- 21 CFR 11.100: general requirements for electronic signatures
- 21 CFR 11.200: electronic signature components and controls
- 21 CFR 11.300: controls for identification codes and passwords
- FDA guidance: Part 11, Electronic Records; Electronic Signatures, Scope and Application
- eCFR: 21 CFR Part 11, current text