Glossary · Data integrity
21 CFR Part 11 (electronic records and signatures)
Also known as: Part 11, 21 CFR 11, Electronic Records; Electronic Signatures rule
21 CFR Part 11 is the US FDA regulation, in effect since 1997, that sets the criteria under which electronic records and electronic signatures are considered trustworthy, reliable and generally equivalent to paper records and handwritten signatures. It applies to records required by other FDA regulations, such as drug and device GMP rules.
- GxP
- Data integrity
- USA
In one sentence
21 CFR Part 11: FDA criteria for trustworthy electronic records and electronic signatures in regulated drug, device and biologics work.
Example
A device manufacturer moves its complaint files to an electronic quality management system; it validates the system, configures unique accounts and audit trails, and links each approval signature to the record with the signer's name, date, time and meaning of the signature.
How it applies
- Scope: Part 11 applies to records that FDA predicate rules require to be kept or submitted, when they are kept or submitted electronically. The predicate rule decides whether a record is needed; Part 11 decides how an electronic version must be controlled.
- Electronic records (Subpart B): Controls for closed systems include validation, the ability to generate accurate copies, record protection, limited system access, secure, computer-generated time-stamped audit trails, operational and authority checks, and training. Open systems need additional measures such as encryption.
- Electronic signatures (Subpart C): Each signature is unique to one person, shows the signer's printed name, date and time and its meaning (such as review or approval), and is linked to its record so it can't be copied or removed. Organizations certify to FDA that their electronic signatures are the legally binding equivalent of handwritten ones.
- Scope and Application guidance (2003): FDA narrowed its interpretation and announced enforcement discretion for certain requirements, including validation, audit trails, record retention and record copying, while predicate rule requirements continue to apply. Current expectations on audit trail review are set out in FDA's 2018 data integrity Q&A.
- Technical documentation: Keep the system validation file, a list of which records are Part 11 records, access and signature procedures, and evidence of audit trail review. These are what inspectors ask for.
Part 11 vs. EU GMP Annex 11
Part 11 is a binding US regulation focused on electronic records and signatures across all FDA-regulated activities. EU GMP Annex 11 is a GMP guideline for computerized systems in medicinal product manufacturing and covers the wider system lifecycle, including risk management, suppliers, periodic review and business continuity. Companies selling in both markets usually build one control set that satisfies both.