A QA reviewer signs a paper batch record and the trail is right there. Ink, initials, a date scribbled beside it. Once that approval moves into a computerized GxP system the trail has to be built into the software instead – nobody can eyeball it anymore. The company must prove the record is authentic plus traceable, that access was restricted, that the signature really belongs to the signer.
The system itself also had to be validated. For electronic records in FDA-regulated work, these expectations are set by 21 CFR Part 11. This guide covers requirements, key controls, validation as well as practical steps toward 21 CFR Part 11 compliance.
What Is 21 CFR Part 11?
21 CFR Part 11 is the FDA regulation deciding when an electronic record or electronic signature can be trusted in place of paper and ink. It was issued in 1997. Companies were moving records onto computers; FDA wanted that done without losing trust.
An electronic record is any text, data, image or audio in digital form that a computer system creates, changes, stores or retrieves. In pharma that covers lab results, batch records, SOPs, training records – along with much of what sits in a pharmaceutical document management system.
Not every computerized record falls under Part 11 though. Applicability depends on which FDA requirement the record satisfies, also on how it’s kept or submitted. FDA reads the scope narrowly. Most 21 CFR Part 11 guidelines for pharmaceuticals start from that narrow reading.
Who Must Follow 21 CFR Part 11?
Pharma manufacturers, biotech companies, medical device firms, labs, contract manufacturers. The usual list. Industry alone doesn’t trigger Part 11 though. The record does.
The underlying obligations are called predicate rules – FDA requirements that say which records a company must keep or submit. When a predicate rule requires a record and the company keeps it electronically the 21 CFR Part 11 requirements apply. An electronic batch record? Inside. A team’s lunch rota on a shared drive? Not even close. Mapping records early saves wasted effort in 21 CFR Part 11 compliance.
Compliance Obligations Under 21 CFR Part 11
The 21 CFR Part 11 requirements are split into three subparts; most 21 CFR Part 11 guidelines follow the same split.
Subpart A: General Provisions
Scope, implementation, plus the definitions used throughout – closed vs open systems, for one.
Subpart B: Electronic Records
Most day-to-day obligations for electronic records sit here. Closed systems have to be validated. They must produce accurate, complete copies besides protecting records for retrieval through the whole retention period. Access is limited to authorized people. Audit trails need to be secure, computer-generated, time-stamped. Operational checks, authority checks, device checks – all expected. Staff need proper training; system documentation is kept under change control.
Subpart C: Electronic Signatures
Each signature belongs to one person. Never reassigned, issued only after identity is verified, linked to the record it signs. Non-biometric signatures need at least two identification components, usually a user ID plus a password.
In practice these controls run through a Quality Management System where approvals along with change records face inspection.
Electronic Records and Electronic Signature Requirements
A defensible electronic record is accurate, complete, authentic – it really came from the person and system it claims to. Changes are either blocked or recorded. The record stays readable for the full retention period, copies ready for inspectors.
An electronic signature comes with its own 21 CFR Part 11 requirements. It belongs to one individual. The signed record shows the printed name, date and time, as well as the meaning: review, approval, responsibility or authorship. It is permanently linked to the record and sits behind secure authentication.
Buying software with e-signatures doesn’t make a company 21 CFR Part 11 compliant. Never did. 21 CFR Part 11 compliance comes from configuration, validation, procedures, access control, training – all working together. An OJT sign-off from a login nobody can trace? Worth nothing. That’s the job a Learning Management System with traceable signatures does.
Audit Trail Requirements Under 21 CFR Part 11
An audit trail is the system’s own account of what happened to the data. Who acted. What got created or changed, when it happened, the previous value where relevant, the reason for change if procedures ask for one. Read end to end it lets you follow a record from creation to archive.
Under 21 CFR Part 11, audit trails are secure, computer-generated plus time-stamped; a change must never hide the earlier entry. They’re kept as long as the records themselves. Our pharmaceutical document management guide shows audit trails next to version control and signatures, supporting 21 CFR Part 11 compliance.
How ALCOA+ Supports Data Integrity ?
Regulators use the ALCOA principles as shorthand for trustworthy data. Data should be Attributable to whoever generated it, Legible for its whole life, Contemporaneous with the work, Original or a certified copy, Accurate. The “+” adds Complete, Consistent, Enduring, Available.
Unique logins make an entry attributable. Contemporaneous recording is handled by system time stamps. Signatures give approvals meaning, yet it’s the audit trail that proves a record is complete and stayed consistent. See our article on data integrity in pharma for more.
Why Access Control Matters for Part 11 Compliance ?
Audit trails lose most of their value the moment people share logins. Four QC analysts, one “LAB01” account. The audit trail records that LAB01 changed a result – nobody can say which analyst did it. Inspectors treat shared credentials as a direct threat to data integrity in pharma.
Role based access control fixes this. Everyone gets an individual account with least-privilege rights tied to their role; authoring is kept separate from approval. Sensitive actions are guarded by authority checks. Access gets removed promptly when people leave or move, periodic access reviews become part of 21 CFR Part 11 compliance. KOŚA Products include role-based controls for these workflows.
Computer System Validation Under 21 CFR Part 11
Validation shows a system does what it’s supposed to do. FDA expects the approach to be risk-based, justified, documented. Computer system validation runs from intended use through user requirements, risk assessment, planning, testing – each requirement traced to its evidence. After go-live change control takes over. Revalidation is done where risk calls for it, the system stays validated until it’s retired. Inspectors will want this evidence. It’s core to the 21 CFR Part 11 requirements – Audit & Compliance Management support keeps it up to date for ongoing 21 CFR Part 11 compliance.
GAMP 5 and Risk-Based Validation
ISPE’s GAMP 5 scales validation effort to risk across the system lifecycle. A configured LIMS holding release data deserves far more testing than a tool with no quality or safety impact.
Computer Software Assurance
Computer software assurance (CSA) came out of FDA guidance for medical device production and quality system software, finalized in 2025. Some pharma teams borrow the thinking. Risk-based assurance, critical thinking, testing matched to risk, objective evidence. CSA does not replace validation. It moves effort off low-risk paperwork, toward the functions that matter.
Difference Between 21 CFR Part 11 and EU Annex 11
21 CFR Part 11 and EU Annex 11 overlap a lot, but each looks at compliance through a different lens. Part 11 is limited to electronic records and signatures – it’s an FDA rule.
Area | 21 CFR Part 11 | EU Annex 11 |
Regulatory authority | US FDA | European GMP framework |
Main emphasis | Electronic records and signatures | Computerized systems across the GMP lifecycle |
Validation | Required for applicable systems | Lifecycle, risk-based focus |
E-signatures | Detailed requirements | Addressed within system controls |
Audit trails | Required where appropriate | Strong emphasis on auditability |
Risk management | Through FDA guidance and predicate rules | Explicit lifecycle emphasis |
Companies selling into both markets usually design controls along with computer system validation evidence that satisfy both.
Common 21 CFR Part 11 Compliance Problems
Plenty of systems sold as 21 CFR Part 11 compliant still get inspection findings. The gaps are in how they’re used. Shared credentials top most lists. Close behind – an audit trail that is incomplete or never reviewed, unvalidated systems, weak passwords, excess access that role based access control should have stopped. Others: an electronic signature not linked to its record, records lost before retention ends, changes made outside change control, conflicting versions across disconnected systems.
Training matters too. A validated system can still fail 21 CFR Part 11 compliance when people skip procedures. Our guide to GxP training in pharma covers closing that gap.
21 CFR Part 11 Compliance Checklist
This is a first pass 21 CFR Part 11 Checklist. Assess each line against the 21 CFR Part 11 requirements and the 21 CFR Part 11 guidelines.
- Confirm Part 11 even applies – records first, then the system.
- Define intended use.
- Validate the system based on risk.
- Restrict access to authorized users.
- Keep user identities unique.
- Turn on secure, time-stamped audit trails.
- Protect electronic records through retention.
- Records should be retrievable in readable form.
- Implement compliant electronic signatures.
- Maintain the right SOPs.
- Train users.
- Control system plus configuration changes.
- Review access privileges periodically.
- Review audit evidence.
- Keep validation documentation inspection-ready.
From Individual Controls to Connected GxP Compliance
Lots of companies run documents, training, quality events, audits, batch records, access, validation evidence in separate tools. Trouble shows up in between. Permissions differ per system. A signature in one can’t be traced from another. Inspection prep takes days.
Connected controls fix this: a common user identity, consistent permissions, linked electronic signatures, connected electronic records, complete audit trail evidence, faster retrieval. KOŚA brings quality, document control, workforce readiness and regulated operations onto one platform. It pays off most in Electronic Batch Records – identity, signatures plus audit evidence all meet there – making 21 CFR Part 11 compliance easier to demonstrate.
Build Sustainable 21 CFR Part 11 Compliance
Part 11 compliance is judged on evidence. For any record the company must show who acted, what happened, when. That the record can still be trusted, access was authorized, the system works as intended. Evidence ready on inspection day. Audit trails, electronic signatures, access control, validation, data integrity, training – each one supplies part of that answer.
Ready to strengthen electronic record control and inspection readiness? Explore how KOŚA connects documents, quality, training, audit evidence and regulated workflows within one GxP-ready platform.
Book a KOŚA demo for a personalized session with the KOŚA team.
Frequently Asked Questions
1. What does 21 CFR Part 11 cover?
21 CFR Part 11 is FDA’s rule for when electronic records along with electronic signatures can replace paper and ink, and still be trusted.
2. Which organizations must follow 21 CFR Part 11?
Any organization keeping or submitting FDA-required records electronically. Manufacturers, labs, contract organizations are typical – but the deciding factor is the record plus its predicate rule, not the industry.
3. What does 21 CFR Part 11 require ?
Validated systems, tight access, electronic records protected through retention, secure time-stamped audit trails, controlled electronic signatures – those are the main 21 CFR Part 11 requirements. Procedures and training back it up.
4. How does 21 CFR Part 11 define an audit trail?
An audit trail is a secure, computer-generated, time-stamped log of who created, modified or deleted an electronic record and when. Changes mustn’t hide earlier entries; the trail is kept as long as the record.
5. What rules apply to electronic signatures under 21 CFR Part 11?
Each electronic signature has to be unique to one person, issued after identity verification, protected by secure authentication. The signed record shows the printed name, date and time, plus the meaning. The signature stays permanently linked to it.
6. 21 CFR Part 11 vs EU Annex 11: what sets them apart?
It is about scope and focus. Part 11 places full emphasis on electronic records and signatures EU Annex 11 covers computerized systems across the whole GMP lifecycle.