Part 11, Electronic Records; Electronic Signatures: Scope and Application (FDA guidance)

Context and history

FDA issued this guidance in 2003, six years after Part 11 took effect. The document itself is dated August 2003, and FDA's list shows issue on 5 September 2003. It followed concerns that Part 11 was being read too broadly, discouraging innovation and adding cost without a matching public health benefit, and FDA had begun re-examining Part 11 as part of its wider GMP initiative.

It does not change the regulation. Part 11 remains in effect. What it does is explain how FDA reads the scope and where it intends to exercise enforcement discretion, while predicate rule requirements continue to apply in full. More than twenty years on, it is still the document that shapes how Part 11 is applied.

Who and what it applies to

Persons who, in fulfilment of FDA requirements, create, modify, maintain, archive, retrieve or transmit electronic records and signatures, across drugs, biologics, devices, foods and veterinary products.

What it contains

I. Introduction

States FDA's intent to interpret Part 11 narrowly while re-examining it.

II. Background

How Part 11 came about, and concerns since it took effect.

III.A Overall approach

Part 11 remains in effect. FDA will not enforce certain provisions, as described, but predicate rules still apply.

III.B.1 Narrow interpretation of scope

Part 11 does not apply merely because a computer was used to create a paper record.

III.B.2 Definition of Part 11 records

Describes when records count, including records kept in electronic form in place of paper, and electronic records relied on to perform regulated activities. Companies should document which they rely on.

III.C.1 Validation

FDA will not enforce the validation requirement of 11.10(a). Companies should base validation decisions on a justified, documented risk assessment.

III.C.2 Audit trail

Discretion applies, while audit trails or other measures may still be needed to ensure records are trustworthy, based on predicate rules and risk.

III.C.3 Legacy systems

Discretion for systems operational before 20 August 1997, if they met predicate rules and remain fit for purpose, with stated criteria.

III.C.4 Copies of records

Discretion on copies, with inspectors given reasonable access.

III.C.5 Record retention

Discretion on retention, with records kept according to predicate rules and a justified risk approach.

Key points

• Part 11 remains in effect, and this guidance does not rewrite it.
• FDA narrows its enforcement on validation, audit trails, retention and copies, but not on other requirements.
• Predicate rules still apply in full.
• Decide and document which records are Part 11 records.
• Use a justified, documented risk assessment for decisions.
• Controls on signatures and access remain.

In practice

General reading, not advice. This is drafted with AI and may not fit your situation. It does not replace the official text, your own quality system or qualified advice, and an inspector may take a different view.

• Write down your Part 11 record decision for each system, because the guidance expects you to be able to justify it.
• Do not treat discretion as permission: FDA data integrity guidance still expects audit trail review.
• Keep this guidance with Part 11 in any training, as Part 11 alone gives a misleading picture of enforcement today.

Read from the source document on 1 Nov 2026. This is our own description, not the official text. Check the full dated history in the change log below.