Electronic Records; Electronic Signatures
Sets the criteria under which FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and equivalent to paper records and handwritten signatures executed on paper.
What this does not cover
stated in the document's own scope- Applies only where a predicate rule requires the record; Part 11 creates no recordkeeping obligation of its own — remove the predicate requirement and Part 11 has nothing to attach to.
- Sets criteria for trustworthy electronic records and signatures, not a validation methodology — that role belongs to GAMP 5 and the applicable predicate-rule GMP.
- Governs record and signature integrity, not the wider data-governance and lifecycle expectations detailed in the PIC/S and MHRA data-integrity guidances.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
21 CFR Part 11 sets the criteria under which FDA will accept electronic records and electronic signatures as trustworthy, reliable, and equivalent to paper records and handwritten signatures. It applies to records that are created, modified, maintained, archived, retrieved, or transmitted electronically under any FDA predicate rule. The requirements fall into two groups: controls for closed and open systems — validation, audit trails, record copying, access limits, and operational and authority checks — and controls that make an electronic signature legally binding, including the components of a signature, its linkage to its record, and how identity is verified before signatures are issued.
Scope & applicability
All persons required to maintain records or submit information to FDA under statutes enforced by the Agency. Applies to any electronic records that are created, modified, maintained, archived, retrieved, or transmitted under applicable FDA requirements.
Legal basis & how it acquires force
Part 11 is a binding regulation in Title 21 CFR, issued under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act. It does not stand alone: it applies only where another regulation — a “predicate rule” such as Part 211, Part 820, or Part 58 — already requires a record to be kept. A 2003 FDA guidance narrowed how the agency intends to exercise enforcement discretion over certain Part 11 provisions, but the regulation itself remains in force and defines when electronic records satisfy those predicate-rule recordkeeping obligations.
Document structure
| Part | Covers |
|---|---|
| Subpart A | General provisions — scope, definitions, and the implementation of the rule |
| Subpart B — §11.10 | Controls for closed systems: validation, accurate copies, record protection, access limits, audit trails, and authority checks |
| Subpart B — §11.30 | Controls for open systems, including document encryption and additional measures for records not controlled by the record-keeping entity |
| Subpart B — §11.50 / §11.70 | Signature manifestations and the signature/record linking that binds a signature to its record |
| Subpart C | Electronic signatures: uniqueness, identity verification, and the controls for identification codes and passwords |
Key requirements
- Audit trails for all operator entries, computer-generated data, and changes
- System access controls — unique user IDs, passwords, biometrics
- Electronic signatures include printed name, date/time, and meaning of signature
- Software validation — installation qualification, operational qualification, performance qualification
- Copies of records in readable form (human-readable and electronic output)
- Protection of records throughout retention period
Implementation tips
- Scope determination is the first step — not all electronic systems are Part 11 systems
- Audit trail review must be part of batch release or QA review — document the review frequency
- Password policies must align to current guidance: complexity, expiry, shared accounts prohibited
- Hybrid systems (paper + electronic) carry their own validation requirements — document the hybrid process
Revision notes
No amendments since the rule took effect in 1997. FDA issued Guidance for Industry on Scope and Application (2003) as primary interpretive reference. Data Integrity guidance (2018) significantly expanded practical requirements.
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
Part 11 is the US electronic-records companion to the EU’s EudraLex Volume 4 Annex 11 on computerised systems, and the two are routinely read together in global operations. It is supported on the implementation side by GAMP 5 for computerised-system validation and by the PIC/S PI 041 and MHRA data-integrity guidances, which apply the same ALCOA record attributes. Part 11 supplies the US legal criteria; those documents describe how systems are built and assessed to meet them.
21 CFR Part 11: frequently asked questions
Quick answers to common questions about 21 CFR Part 11.
What is a predicate rule and why does it matter for Part 11?
A predicate rule is any other FDA regulation that requires a record to be created or kept — for example Part 211 or Part 820. Part 11 only applies to records maintained electronically to satisfy such a rule, so it never operates on its own.
Is Part 11 the same as EU Annex 11?
They are counterparts, not identical. Part 11 sets US criteria for electronic records and signatures; EudraLex Annex 11 sets EU expectations for computerised systems. Global operations typically satisfy both together.
Did the 2003 guidance repeal Part 11?
No. The 2003 “scope and application” guidance described FDA’s intended exercise of enforcement discretion over certain provisions during re-examination, but Part 11 remains a binding regulation.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.