21 CFR Part 11 in plain English
Part 11 is short: about three pages of rules on when FDA accepts electronic records and electronic signatures in place of paper and ink. Here's what each part asks for, what's usually on your software vendor, and what stays with you.
Who it applies to
Part 11 applies to records that another FDA regulation (a predicate rule) requires you to keep, when you keep them electronically instead of on paper, and to electronic signatures used in place of handwritten ones. Predicate rules include the drug GMPs (21 CFR 210 and 211), good laboratory practice (21 CFR 58), clinical investigations, and the device quality system rule (21 CFR 820, now the QMSR).
FDA's 2003 guidance Part 11, Electronic Records; Electronic Signatures: Scope and Application narrowed how the agency applies it. FDA said it would apply enforcement discretion to some requirements (validation, audit trails, record retention, record copying and legacy systems), while still expecting the predicate rules and the other Part 11 controls to be met. In practice, inspectors still expect validated systems and secure audit trails for GMP records, because the predicate rules and data integrity expectations require them anyway.
The controls for your systems (§11.10)
For a closed system (one where access is controlled by the people responsible for the records, which includes most SaaS used by a company), §11.10 lists the controls:
| §11.10 | What it asks | Usually whose job |
|---|---|---|
| (a) | Validation, to ensure accuracy, reliability and consistent performance, and the ability to detect invalid or altered records | Shared: the vendor validates the platform; you verify it for your intended use |
| (b) | Accurate and complete copies, readable by people and suitable for FDA's inspection | Vendor (PDF and export features) |
| (c) | Protection of records so they're retrievable throughout the retention period | Vendor (storage, backups); you (retention decisions) |
| (d) | Access limited to authorized individuals | Vendor provides; you decide who gets access |
| (e) | Secure, computer-generated, time-stamped audit trails of when records are created, modified or deleted, that don't obscure earlier values and are kept as long as the records | Vendor |
| (f) | Operational checks that enforce the permitted sequence of steps | Vendor provides workflows; you configure them |
| (g) | Authority checks: only authorized people can sign, access, change or operate the system | Vendor provides; you configure who may do what |
| (h) | Device checks, where the source of input matters | Depends on the system |
| (i) | People who develop, maintain or use the system have the education, training and experience to do so | You (and the vendor for its own staff) |
| (j) | Written policies holding people accountable for actions under their electronic signatures | You |
| (k) | Control of system documentation (distribution, access, change control) | You, with the vendor's documentation |
Open systems (§11.30) need the same controls plus measures such as encryption and digital signatures to protect records in transit.
Electronic signatures
- §11.50 Signature manifestations. A signed record shows the printed name of the signer, the date and time, and the meaning of the signature (review, approval, responsibility, authorship), on screen and on printouts.
- §11.70 Linking. Signatures are linked to their records so they can't be cut, copied or moved to falsify another record.
- §11.100 General requirements. Each signature is unique to one person and never reused or reassigned; you verify the person's identity before giving them one; and you certify to FDA in writing that your electronic signatures are the legally binding equivalent of handwritten ones.
- §11.200 Components. Signatures not based on biometrics use at least two distinct identification components, such as a user ID and a password. In one continuous session, the first signing uses all components and later signings at least one (typically the password); signings outside a continuous session use all of them.
- §11.300 Controls for IDs and passwords. Unique combinations, periodic checks, procedures for lost or compromised credentials, safeguards that detect and report attempts at unauthorized use, and testing of any devices (such as tokens) that generate them.
What stays with you
No software makes a company "Part 11 compliant" by itself. Even with a well-built system, these are yours:
- A validation (or assurance) record for your intended use of the system, scaled to risk
- Procedures for access, account management, audit trail review, backup and restore, and change control of your configuration
- Training records for the people who use it
- A written policy that people are accountable for actions under their electronic signatures
- The certification letter to FDA about electronic signatures (§11.100(c))
- Supplier qualification of the vendor, usually with a quality agreement