21 CFR Part 11 vs EU GMP Annex 11
The two rulebooks for electronic records and computerised systems.
What a comparison is not
A comparison is SPEQ’s reading of how two published documents differ. Neither is the right answer, it is not a determination of which applies to you, and neither is summarised in a way that replaces reading it.
FDA 21 CFR Part 11 sets the US requirements for electronic records and electronic signatures — when they are trustworthy, reliable, and equivalent to paper. EU GMP Annex 11 governs computerised systems used in GMP activities. They overlap heavily (audit trails, access control, validation) but Part 11 is signature-centric US regulation, while Annex 11 is a broader, system-lifecycle GMP guideline.
| ASPECT | 21 CFR PART 11 | EU GMP ANNEX 11 |
|---|---|---|
| Focus | Electronic records and electronic signatures | Computerised systems used in GMP, across their lifecycle |
| Legal nature | US federal regulation (enforceable rule) | EU GMP guidance given legal force via directives |
| Electronic signatures | Detailed, explicit requirements (a core subject) | Addressed, but less prescriptive than Part 11 |
| Validation | Requires validation of systems (§11.10(a)) | Detailed validation + lifecycle expectations (risk-based) |
| Audit trails | Required, secure, computer-generated, time-stamped | Required; explicit expectation of audit-trail review |
| Suppliers / service providers | Not the central focus | Explicit expectations for suppliers and IT service providers |
| Data / risk framing | Record trustworthiness and equivalence to paper | Risk-based system management within the quality system |
Meet Part 11 for any system that creates, modifies, or maintains electronic records or applies electronic signatures for FDA-regulated activities in the US.
Meet Annex 11 for computerised systems used in EU GMP activities — it takes a broader lifecycle and supplier view and pairs with GAMP 5 for implementation.
They are complements, not alternatives. A global system is designed to satisfy both: Part 11’s signature and record controls plus Annex 11’s lifecycle, supplier, and audit-trail-review expectations. Build once to the union of the two — audit trails, access control, validation, e-signatures, and periodic review — and you clear both regimes.
21 CFR Part 11 vs EU GMP Annex 11: frequently asked questions
Common questions on how 21 CFR Part 11 and EU GMP Annex 11 differ and when each applies.
Do I have to comply with both?
If you operate in both the US and EU, yes. They overlap substantially, so a well-designed system meets both at once — but Part 11’s electronic-signature specifics and Annex 11’s supplier/lifecycle expectations mean neither fully contains the other.
Which is stricter on electronic signatures?
Part 11 is more prescriptive about electronic signatures (their components, controls, and the record-signature link). Annex 11 addresses signatures but leaves more to risk-based judgement.
Does Annex 11 require audit-trail review?
Yes. Annex 11 makes the review of audit trails an explicit expectation, which aligns with modern data-integrity guidance. Part 11 requires secure, time-stamped audit trails but is less explicit about routine review — though FDA data-integrity guidance now expects it too.
How does GAMP 5 relate to these?
GAMP 5 is the how-to. Part 11 and Annex 11 say what electronic records/computerised systems must achieve; GAMP 5 provides the risk-based methodology to validate the system so it meets those requirements.