21 CFR Part 11

What does 21 CFR Part 11 cover?

Part 11 covers specified electronic records and electronic signatures used under FDA requirements. The key starting point is the predicate rule — the statute or another FDA regulation that requires a record or submission. Under the FDA's narrow interpretation, Part 11 generally applies when a required record is maintained electronically in place of paper, when an electronic version is relied on for regulated activity, or when a covered record is submitted electronically. Merely using a computer to create a paper record does not always make the underlying electronic file a Part 11 record.

What controls can Part 11 require?

For a closed system, the regulation addresses controls such as system validation, accurate and complete copies, record protection, authorized access, secure time-stamped audit trails, operational and authority checks, training, accountability policies and controlled system documentation. The applicable control set depends on the system and record. Predicate-rule requirements continue to apply even where the FDA describes enforcement discretion for certain Part 11 provisions in its scope-and-application guidance.

What counts as an electronic signature?

An electronic signature must be unique to one individual and must not be reused or reassigned. Signed electronic records must show the signer's printed name, the date and time, and the meaning of the signature, such as review or approval. The signature must be linked to its record so it cannot be excised or transferred. Organizations using electronic signatures as legally binding equivalents of handwritten signatures must also provide the certification required by section 11.100(c).

How does Part 11 apply to device manufacturers?

A device manufacturer should inventory the records required by the QMSR and other FDA rules, decide which electronic records it relies on, and document the scope determination. An eQMS or manufacturing-software vendor is not "FDA Part 11 certified" on the manufacturer's behalf. The regulated company remains responsible for validating its intended use, configuring controls and preserving reliable, inspectable records. Part 11 readiness therefore sits within the broader United States quality-system and data-governance program.