21 CFR Part 11
21 CFR Part 11 is the FDA regulation that sets when electronic records and electronic signatures are treated as trustworthy and equivalent to paper and handwritten signatures. It applies to records kept under other FDA requirements (the predicate rules); FDA's 2003 guidance narrows how it enforces some Part 11 controls but keeps the predicate rules fully enforced.
On this page · 6 sections
How does 21 CFR Part 11 apply to your shop floor?
Pick your industry and scale — Ask V5 rewrites the definition in your context, gives a worked example, and shows what V5 does on day one.
01What Part 11 covers
Part 11 sets the criteria under which FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable and generally equivalent to paper (11.1(a)). It applies to electronic records created, modified, maintained, archived, retrieved or transmitted under any FDA records requirement, and to electronic records submitted to FDA under the FD&C Act and PHS Act (11.1(b)). It does not apply to paper records merely transmitted electronically.
Part 11 does not itself say which records you must keep. That comes from the predicate rule for your product, for example drug CGMP in Part 211. Part 11 governs how those records are trustworthy when kept electronically.
02Controls for closed systems (11.10)
| Clause | Control |
|---|---|
| 11.10(a) | Validation to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records |
| 11.10(b) | Accurate and complete copies in human-readable and electronic form for FDA inspection |
| 11.10(c) | Protection so records can be accurately and readily retrieved throughout the retention period |
| 11.10(d) | Access limited to authorised individuals |
| 11.10(e) | Secure, computer-generated, time-stamped audit trails of entries and actions that create, modify or delete records; changes must not obscure earlier information; retained at least as long as the records |
| 11.10(f) | Operational system checks to enforce permitted sequencing of steps, as appropriate |
| 11.10(g) | Authority checks so only authorised individuals can use the system, sign, alter records or perform operations |
03Electronic signature requirements
- 11.50: signed records show the signer's printed name, date and time of signing, and the meaning (such as review, approval, responsibility or authorship), and these appear in any human-readable form.
- 11.70: signatures are linked to their records so they cannot be excised, copied or transferred to falsify a record by ordinary means.
- 11.100: each signature is unique to one person and never reused or reassigned; identity is verified before a signature is issued; organisations certify to FDA that their electronic signatures are intended as the legally binding equivalent of handwritten ones.
- 11.200: non-biometric signatures use at least two distinct components (such as ID and password); in one continuous session the first signing uses all components and later signings at least one; outside a continuous session every signing uses all components.
04How FDA enforces it: the 2003 scope guidance
FDA's Scope and Application guidance states that FDA intends to exercise enforcement discretion for the Part 11 requirements on validation, audit trails, record retention and record copying, as explained in the guidance, and for all Part 11 requirements on legacy systems operational before 20 August 1997. FDA says it will enforce all predicate rule requirements, including predicate rule recordkeeping.
05Common failure modes and how to evaluate controls
| Failure mode | How to evaluate |
|---|---|
| Shared or generic logins | Check user lists against people; confirm no account is used by more than one person (11.100(a), 11.10(d)). |
| Audit trail off, editable or not reviewed | Make a test change and confirm the original value, user and time are retained and cannot be altered. |
| Signature lacks meaning or time | Inspect printed and on-screen records for name, date/time and meaning (11.50). |
| Signature can be copied between records | Ask the supplier how signatures are bound to record content (11.70) and test it. |
| No certification letter to FDA | Confirm the 11.100(c) certification has been submitted. |
| Validation assumed from vendor | Confirm your own intended-use validation evidence exists; supplier documents can support but not replace it. |
06Where V5 fits
V5 provides 21 CFR Part 11 e-signatures, an immutable audit trail and two-signature formula approvals, and Enterprise may include IQ/OQ documentation and validation support. Using these features does not make a site compliant: your procedures, user administration, FDA certification letter, PQ and validation for your intended use remain your responsibility.
Frequently asked questions
Q.Does Part 11 tell me which records to keep?+
No. Predicate rules such as 21 CFR 211 define which records are required. Part 11 sets how those records and signatures are trustworthy when electronic.
Q.Is Part 11 still enforced?+
Yes. FDA's 2003 guidance describes enforcement discretion for validation, audit trail, record retention and record copying requirements, and for legacy systems, but Part 11 remains in effect and predicate rules are fully enforced.
Q.What must an electronic signature show?+
The signer's printed name, the date and time of signing, and the meaning of the signature, in both electronic and printed forms of the record (11.50).
Q.Do I need to notify FDA before using electronic signatures?+
Under 11.100(c), you certify to FDA that your electronic signatures are intended to be the legally binding equivalent of handwritten signatures, using a handwritten-signed certification.
Q.Is Part 11 the same as EU Annex 11?+
No. They overlap in intent but are separate documents from different regulators; check each for the markets you supply.
Primary sources
Further reading
Explore this topic
21 CFR Part 11 sits inside 2 overlapping topic clusters in our glossary. Every neighbour is one click away.
Electronic records, signatures, audit trail and ALCOA+ data-integrity principles.
HCT/Ps, blood cGMP, donor eligibility, ISBT 128 labeling and forward-tracing lookback.
Want to see how 21 CFR Part 11 could fit into your own records and workflows? Explore the related V5 pages or talk to our team about what applies to your operation.