FDA 21 CFR Part 11: Requirements, Audit Trails and Electronic Signatures

21 CFR Part 11 is the FDA regulation that sets out when electronic records and electronic signatures can be trusted as equivalent to paper records and handwritten signatures. This page answers the questions we see most often, in short, with the source for each.

Last reviewed 15 October 2026. This page is general information about 21 CFR Part 11 and related guidance. It is not legal or regulatory advice, and it may not reflect the latest version of the regulation or guidance. Check the current text and consult your own regulatory affairs or legal advisers before relying on it for compliance decisions. Innovatum does not warrant that any software is Part 11 compliant; compliance depends on how an organisation configures, validates and operates a system.

What is 21 CFR Part 11?

Part 11 is the part of US federal regulations that sets the criteria under which the FDA considers electronic records and electronic signatures trustworthy, reliable and generally equivalent to paper records and handwritten signatures. It took effect on 20 August 1997.

It applies to records that other FDA rules require you to keep and that you choose to keep electronically, to electronic signatures used on those records, and to electronic records submitted to the FDA under the Federal Food, Drug, and Cosmetic Act or the Public Health Service Act, even if no regulation specifically names those records (21 CFR 11.1). The FDA’s 2003 scope and application guidance takes a narrow view of that scope.

Who does Part 11 apply to?

It applies to FDA-regulated organisations that keep required records electronically, including drug, biologic and medical device manufacturers. For labeling, that means approved label content, the version that was printed, and the approval history, where a predicate rule such as 21 CFR 211 (drugs) or the labeling and packaging controls in 21 CFR 820 (devices) requires the record.

Part 11 is not a standalone rule about labeling. A predicate rule says which record you must keep. Part 11 says how an electronic version of it must be controlled.

Is Part 11 mandatory?

Part 11 applies when you choose to keep records that other FDA rules require in electronic form, or to use electronic signatures on them. It does not require you to go electronic. If you do, the controls in Part 11 apply to those records and signatures.

What are the Part 11 requirements?

The regulation has three subparts:

• Subpart A, general: scope, implementation and definitions.
• Subpart B, electronic records: controls for closed systems (11.10), open systems (11.30), signature manifestations (11.50) and linking signatures to records (11.70).
• Subpart C, electronic signatures: general requirements (11.100), signature components and controls (11.200) and controls for identification codes and passwords (11.300).

The controls that closed systems must include under 11.10 cover, among others, system validation, accurate and complete copies of records, record protection and retention, access limited to authorised individuals, secure time-stamped audit trails, operational and authority checks, device checks, trained personnel, written policies on accountability for actions taken under electronic signatures, and controls over systems documentation, including revision and change control (11.10(a) to (k)).

What is the difference between open and closed systems under Part 11?

It depends on who controls access. A closed system is an environment in which system access is controlled by the persons who are responsible for the content of the electronic records on it (11.3(b)(4)). An open system is one where access is not controlled by those persons (11.3(b)(9)). Closed systems follow the controls in 11.10. Open systems must also follow 11.30, which requires procedures and controls to ensure record authenticity, integrity and, as appropriate, confidentiality, and says they should include the 11.10 controls as appropriate plus additional measures such as document encryption and appropriate digital signature standards.

What does Part 11 require for audit trails?

11.10(e) is one of the controls a closed system must include: secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify or delete electronic records. Record changes must not obscure previously recorded information. Audit trail records must be kept for at least as long as the subject records and be available for FDA review and copying.

Separately, the FDA’s 2003 guidance says it intends to exercise enforcement discretion on certain Part 11 requirements, including computer-generated, time-stamped audit trails, while predicate rules still apply. It says decisions on audit trails should rest on a justified and documented risk assessment.

How often should audit trails be reviewed?

Part 11 itself does not set a review frequency. The FDA’s drug data integrity Q&A says audit trail review is similar to checking cross-outs on paper: the people responsible for record review should review the audit trail for the data as they review the rest of the record (Q7). If the regulations already set a review frequency for the data, use the same frequency for its audit trail. If they do not, set the frequency using your knowledge of the process and a risk assessment that weighs data criticality, control mechanisms and impact on product quality (Q8).

For what the FDA expects in practice, see its data integrity Q&A, which covers what an audit trail is (Q1.c), who reviews audit trails (Q7) and how often (Q8). Its 2024 Q&A on electronic systems in clinical investigations covers audit trail expectations (Q12 and Q13). The data integrity Q&A is a drug CGMP guidance (21 CFR parts 210, 211 and 212, from CDER, CBER and CVM, not CDRH), and the 2024 Q&A covers clinical investigations, so treat both as context for device labeling, not as direct requirements.

What does Part 11 require for electronic signatures?

Four requirements matter most:

1. Signature manifestations (11.50). A signed record must show the printed name of the signer, the date and time of signing, and the meaning of the signature, such as review, approval, responsibility or authorship.
2. Signature and record linking (11.70). Electronic signatures, and handwritten signatures executed to electronic records, must be linked to their records so they cannot be excised, copied or transferred by ordinary means to falsify another record.
3. Unique to one individual (11.100(a) and (b)). Each electronic signature must be unique to one person and not reused or reassigned, and the organisation must verify the signer’s identity before issuing it.
4. Certification to the FDA (11.100(c)). People who use electronic signatures must certify to the FDA that their electronic signatures are intended to be the legally binding equivalent of traditional handwritten signatures. One letter can cover every electronic signature an organisation uses.

Shared logins do not meet these requirements: signatures must be unique to one person (11.100(a)) and access must be limited to authorised individuals (11.10(d)). For context, the FDA’s drug data integrity Q&A (Q5) makes the same point under parts 211 and 212, which require actions to be attributable to one individual.

Does an email approval count as an electronic signature?

Not automatically. Part 11 defines an electronic signature as a computer data compilation of any symbol or series of symbols executed, adopted or authorised by an individual to be the legally binding equivalent of the individual’s handwritten signature (11.3(b)(7)). An email approval only works as one if it meets the same requirements as any other electronic signature: the signer’s name, the date and time and the meaning of the signature shown on the record (11.50), a link to the record that cannot be broken (11.70), a signature unique to one person whose identity was verified (11.100), and the organisation’s certification to the FDA (11.100(c)). If an approval in a mailbox cannot show those, treat it as outside Part 11 and keep the approval inside a system that can.

Is there such a thing as Part 11 certified software?

No. The FDA does not certify software or electronic signature systems as Part 11 compliant, and it does not do preliminary evaluations of electronic systems for Part 11 compliance; it evaluates them during inspection. Its 2024 Q&A addresses both points (Q28 on electronic signature systems, Q16 on preliminary evaluations in clinical investigations).

A system can provide the technical controls Part 11 asks for, but compliance depends on how an organisation configures, validates, operates and governs it. When a vendor says “Part 11 compliant”, ask what controls the software provides, what validation evidence exists, and which responsibilities stay with you. No vendor can sell you compliance. See how RONOVA approaches compliance.

Does Part 11 require software validation?

Yes. 11.10(a) requires validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. The FDA’s 2003 guidance says the extent of validation should follow a justified, documented risk assessment.

On 3 February 2026 the FDA issued final guidance, Computer Software Assurance for Production and Quality Management System Software, which supersedes the 24 September 2025 version and describes a risk-based approach to assurance. The guidance states, in its Part 11 section, that the FDA’s enforcement discretion on Part 11 validation requirements does not apply to validating production or quality management system software under ISO 13485 subclauses 4.1.6, 7.5.6 and 7.6.

The same guidance lists, among its examples of software features, functions or operations that are generally high process risk, those that produce instructions for use or other labeling provided to patients and users that are necessary for safe operation of the medical device. So labeling functions can carry high process risk, and the assurance effort should reflect that.

Who is responsible for validation when the software is cloud-hosted?

The regulated company stays responsible. The FDA’s 2024 Q&A says that when regulated entities contract with IT service providers, including for cloud computing software and platform services, the regulated entities are responsible for ensuring that electronic records meet Part 11 requirements. It lists what to assess in the provider, including its validation of the specific services, access controls, audit trails, data backup and recovery, and the ability to provide copies of records for as long as they must be kept. That Q&A covers clinical investigations, so treat it as the FDA’s reasoning for device labeling, not a direct requirement.

The Computer Software Assurance guidance says cloud computing used as part of production or the quality management system, including when it supports recordkeeping, is within its scope. It also notes that not every cloud model is directly used as part of production or the quality system: an infrastructure storage service, for example, may not be. EU Annex 11 asks for formal agreements with third parties that state their responsibilities (clause 3).

In practice, split the work in writing: what the vendor validates and supplies, what you validate and configure, and how releases are handled. The question that decides the ongoing cost is what happens to your validated state when the vendor ships an update. Ask for the release cadence, the notice period and the regression evidence that comes with a release, and keep your own change control so that the scope of any revalidation follows what the change touched.

For how validation works on RONOVA, including what happens to a validated state when the platform is updated, see validation.

How does Part 11 compare with EU Annex 11?

Both set expectations for computerised systems in regulated manufacturing, but they come from different regulators and are built differently.

Part 11 and EU Annex 11 compared (Annex 11: 2011 text, in force)

Topic	21 CFR Part 11	EU GMP Annex 11 (2011 text, in force)
Issued by	US FDA	European Commission (EudraLex Volume 4), applied by national authorities
Legal status	Binding federal regulation	GMP guideline interpreting the EU GMP directives
Focus	Trustworthiness of electronic records and signatures	Lifecycle management of computerised systems used in GMP
Audit trails	Required for closed systems (11.10(e))	Risk-based: consider recording GMP-relevant changes and deletions, with the reason documented (clause 9)
Electronic signatures	Detailed requirements (Subpart C)	One short clause: same impact as handwritten signatures, permanently linked to the record, with time and date (clause 14)
Suppliers and service providers	No dedicated section	Dedicated section, with formal agreements stating third-party responsibilities (clause 3)
Risk management	Reflected mainly through FDA guidance	Built into the text: validation extent and data integrity controls follow a documented risk assessment (clause 1)

The table describes the 2011 text of Annex 11, the version in force at the date above. A revised draft was published for consultation in July 2025, and no final version or application date has been published, so check which version applies to you. The table is a simplification. Neither document replaces the other, and organisations that sell in both regions usually map their controls to each.

Annex 11 applies to GMP for medicinal products, not medical devices. It matters to device-labeling readers if their company also makes drugs or combination products, supplies drug manufacturers, or is audited against it by a customer.

Does Part 11 still apply under the QMSR?

Yes. The FDA’s Quality Management System Regulation (QMSR) took effect on 2 February 2026. It removed most of the old Part 820, including 820.70, and incorporated ISO 13485:2016 by reference. It did not remove Part 11: a document required under Part 820 and kept in electronic form is generally subject to Part 11, as the FDA’s Computer Software Assurance guidance states.

If you keep device records electronically under the QMSR, the Part 11 controls above still apply. Check the FDA’s QMSR FAQ for any change in how it is applied at inspection.

How does this apply to labeling?

Labels are controlled records. The approved content, the version that was printed, who approved it and when, and the change history are all records you may be asked to produce at inspection. If you manage them electronically, the controls above apply: limited access, audit trails, signatures with a name, date and meaning, and a validated system.