21 CFR Part 11

Part 11 does not stand alone. It applies only where a predicate rule — 21 CFR 211, 820, 58, 312 and the rest — already requires the record to be kept. Part 11 then sets the conditions under which an electronic version of that record, and an electronic signature on it, can be trusted as much as paper and ink. Asking "does Part 11 apply?" is really asking "which predicate rule requires this record?"

The technical requirements cluster into a few themes: validation of the system for its intended use; secure, computer-generated, time-stamped audit trails that record who did what and when, and that do not obscure previously recorded information; the ability to generate accurate and complete copies in both human-readable and electronic form; limiting system access to authorised individuals; and, for signatures, a manifestation showing the signer, date, time, and meaning, permanently linked to the record.

FDA’s 2003 Scope and Application guidance narrowed enforcement considerably, applying enforcement discretion to parts of the rule while keeping validation, audit trails, and record retention firmly in scope. Two decades of warning letters have made the practical priorities clear: audit trails that are enabled and actually reviewed, no shared logins, and no ability to delete or reprocess data without trace.

• —Applies only where a predicate rule already requires the record — Part 11 governs the electronic form, not the obligation.
• —Core controls: validation, secure time-stamped audit trails, accurate copies, access limited to authorised users.
• —Audit trails must not obscure previously recorded information — and must be reviewed, not merely enabled.
• —E-signatures need a manifestation (signer, date/time, meaning) permanently linked to the record.
• —Shared or generic logins break attributability and are a recurring warning-letter finding.
• —The 2003 Scope and Application guidance applies enforcement discretion in places, but not to validation, audit trails, or retention.

21 CFR Part 11 (Electronic Records; Electronic Signatures, 1997); FDA guidance, Part 11 Electronic Records; Electronic Signatures — Scope and Application (2003); the EU analogue is EU GMP Annex 11; see also MHRA GXP Data Integrity Guidance (2018) and PIC/S PI 041-1.