21 CFR Part 11: electronic records and electronic signatures, for IT
What Part 11 requires of the systems that keep your GxP records electronically, how FDA's Scope and Application guidance narrows it, and what that means for the IT department.
What Part 11 covers
Part 11 of Title 21 of the Code of Federal Regulations, in effect since 20 August 1997, sets the conditions under which FDA considers electronic records and electronic signatures trustworthy, reliable and equivalent to paper records and handwritten signatures. It applies to records that the predicate rules (for example the drug CGMP regulations in 21 CFR 210 and 211) require you to keep, when you keep them electronically.
- § 11.10, closed systems: validation, accurate and complete copies, record protection and retention, limited system access, secure time-stamped audit trails, operational, authority and device checks, training, written accountability policies and control of system documentation
- § 11.30, open systems: additional measures such as encryption and digital signature standards
- § 11.50 and § 11.70: the printed name, date, time and meaning of each signature, and a signature that cannot be separated from its record
- Subpart C, §§ 11.100 to 11.300: unique signatures, identity verification, certification to FDA, and controls for identification codes and passwords
The Scope and Application guidance
In 2003 FDA published its guidance on the scope and application of Part 11. It narrowed how the agency interprets the scope of Part 11 and announced enforcement discretion for some of its requirements (validation, audit trails, record retention and record copying) and for legacy systems, while the predicate rules stay fully enforced. FDA asks companies to base these controls on a documented risk assessment and on the system's impact on product quality and record integrity.
In practice: know which systems hold predicate-rule records, assess their risk, validate them in proportion, and keep audit trails, access control and record retention in line with that assessment.
What falls to IT
Most Part 11 controls are built into the systems you run or into how you run them: accounts and access reviews, audit trail settings, backups and restores, time synchronization, password rules, training records for users and administrators, and the procedures for all of it. These are the records an investigator asks for, and the ones that drift when nobody tracks the due dates.
With the GxP Validation Assistant
How the assistant covers Part 11
Every section, in its own words
Part 11 is a rule pack, each rule citing its section. SOPs cite the rules they implement; an electronic records procedure covers the assessment per record, closed and open systems and the certification letter.
Guidance next to the rule
The Scope and Application guidance is a separate pack labeled guidance, so the risk-based reasoning is documented alongside the regulation.
The operating records
Access reviews, change control, incidents and CAPA, periodic reviews, audit trail reviews and training records, with reminders when they are due.
E-signatures optional
Off, it drafts documents for signature on paper or in your validated system. On, its own signatures show name, date, time and meaning, and you validate it for that use.
Rule texts are summaries in the product's own words with their sources; the official text of 21 CFR Part 11 is published in the eCFR. The assistant supports your validation; it does not make a system compliant.
See it with your own systems.
Watch the webinar, or install the assistant and try it for 14 days.