What is 21 CFR Part 11?
21 CFR Part 11 is the US FDA regulation on electronic records and electronic signatures. It sets out when the FDA accepts electronic records and signatures as equivalent to paper records and handwritten signatures: the system must be validated, access limited to authorised people, every change captured in a secure, time-stamped audit trail, and each signature linked to its record. It applies to records that other FDA rules require you to keep or submit.
Source: 21 CFR Part 11: Electronic Records; Electronic Signatures (eCFR)
T. LozerCompliance Strategy Specialist · entroit GmbH
· Updated
What Part 11 requires
Part 11 has been in force since 20 August 1997. It does not tell you which records to keep; other FDA rules, such as the GMP regulations, do that. Part 11 decides whether an electronic version of those records is trustworthy. For systems where you control access, Part 11 compliance includes:
- validation of the system, including its ability to detect invalid or altered records
- accurate and complete copies of records for FDA inspectors, in readable and electronic form
- access limited to authorised individuals, with checks on who may sign or change a record
- secure, computer-generated, time-stamped audit trails that record who created, changed or deleted what and when, without hiding the previous value
- signatures that show the signer’s printed name, the date and time and the meaning, such as review or approval
- signatures unique to one person and linked to their record so they cannot be copied to another
- training for everyone who develops, maintains or uses the system
Before using electronic signatures, a company must certify to the FDA in writing that they are the legally binding equivalent of handwritten signatures.
21 CFR Part 11 and EU GMP Annex 11 compared
| 21 CFR Part 11 | EU GMP Annex 11 | |
|---|---|---|
| Type | US federal regulation | EU GMP guideline, applied in inspections |
| Scope | Electronic records required by FDA rules | Computerised systems used in GMP-regulated activities |
| Validation | Required | Required, extent based on a documented risk assessment |
| Audit trail | Required for creating, changing and deleting records | Based on risk, for GMP-relevant changes and deletions, with the reason |
| Electronic signatures | Name, date and time, meaning; linked to the record | Same impact as a handwritten signature; linked to the record, with date and time |
| Suppliers, business continuity, periodic review | Not addressed directly | Explicit requirements |
Companies that supply both markets usually build one set of controls that meets both.
What Part 11 means for your ERP and warehouse system
Software can provide the controls, but compliance stays with the company that uses it: you configure roles, write the procedures, train users and carry out the computer system validation. entroit records every booking in an audit trail with who, when and why, and supports electronic signatures designed around EU GMP Annex 11. For medical device companies and other manufacturers, a validation package with IQ/OQ/PQ and test protocols shortens the path to a validated system.