21 CFR Part 11: Electronic Records; Electronic Signatures

Context and history

Part 11 is the US regulation that sets out when FDA accepts electronic records and electronic signatures in place of paper records and handwritten signatures. It sits in Title 21 of the Code of Federal Regulations. FDA issued the final rule in March 1997, and it took effect on 20 August 1997, at a time when industry wanted to move from paper to electronic systems.

It proved broad and costly to apply. In 2003 FDA published its Scope and Application guidance, saying it would interpret Part 11 narrowly and would not enforce certain requirements, such as validation and audit trails, while the regulation remains in effect and predicate rules still apply. That guidance has its own record on this site.

It is one of the most cited documents in computerised systems compliance, and its EU counterpart is Annex 11. The two overlap heavily but are written differently, as the crosswalk on this site shows.

Who and what it applies to

Records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under any FDA records requirement, and electronic records submitted to FDA under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, even if they are not specifically identified in regulations.

It reaches well beyond drugs: any FDA-regulated activity whose records requirements are met electronically is affected, including devices, biologics and clinical research.

Not covered: Paper records that are, or have been, sent by electronic means.

What it contains

11.1 Scope

Sets out the criteria under which FDA considers electronic records and signatures trustworthy, reliable and equivalent to paper. Meeting Part 11 lets electronic signatures stand in for handwritten signatures.

11.2 Implementation

How electronic records may be maintained or submitted in place of paper.

11.3 Definitions

Defines terms such as closed system, open system, electronic record, electronic signature, digital signature and biometrics.

11.10 Controls for closed systems

The core of the rule. Procedures and controls to ensure authenticity and integrity, covering validation, accurate copies, record protection, limited access, audit trails, operational checks, authority checks, device checks, training, accountability policies, and control of system documentation.

11.30 Controls for open systems

The closed system controls, as appropriate, plus further measures such as encryption and digital signature standards.

11.50 Signature manifestations

A signed record must show the printed name, date and time, and meaning of the signature.

11.70 Signature/record linking

Signatures must be linked to their records so they cannot be removed, copied or transferred to falsify a record.

11.100 General requirements

Each signature is unique to one person, identity is verified first, and people must certify to FDA that their signatures are intended as the legally binding equivalent of handwritten signatures.

11.200 Electronic signature components and controls

Non-biometric signatures use at least two distinct identification components, and biometric signatures must be usable only by their genuine owner.

11.300 Controls for identification codes/passwords

Uniqueness, periodic checks, loss management, transaction safeguards and device testing.

Key points

• It applies to records required by other FDA rules, called predicate rules.
• Closed systems, where access is controlled by those responsible for the records, have a core set of controls.
• Open systems need those and more, to protect records in transit.
• Audit trails in 11.10(e) must be secure, computer-generated and time-stamped.
• Each electronic signature must be unique to one person and never reused or reassigned.
• Identity must be verified before a signature is set up.
• A signed record must show name, date, time and meaning.
• Signature users must send a certification to FDA, sometimes called a letter of non-repudiation.
• FDA's 2003 guidance explains where it applies enforcement discretion, so read the two together.

In practice

General reading, not advice. This is drafted with AI and may not fit your situation. It does not replace the official text, your own quality system or qualified advice, and an inspector may take a different view.

• Start from the predicate rule: identify which required records you keep electronically, then apply Part 11 to those.
• Do not rely on the 2003 discretion to skip controls: predicate rules, and data integrity expectations, still apply.
• Check that a letter of non-repudiation has been sent for your organisation.
• For a multinational site, map Part 11 against Annex 11 and implement the stricter expectation once.
• Ask vendors for evidence, but remember that a system cannot be Part 11 compliant by itself: compliance also depends on how you configure and use it.

Read from the source document on 1 Nov 2026. This is our own description, not the official text. Check the full dated history in the change log below.