United States (FDA)
21 CFR Part 11: Electronic Records and Electronic Signatures
Part 11 sets the conditions under which FDA treats electronic records and electronic signatures as trustworthy and equivalent to paper records and handwritten signatures. For a device manufacturer, it comes into play the moment a record that FDA requires (a DHR, a complaint file, a CAPA, a training record) lives in software, or someone signs it electronically.
At a Glance
- Regulation
- 21 CFR Part 11
- Subject
- Electronic Records and Electronic Signatures
- Group
- United States (FDA)
A plain-language summary, not legal advice. Always read the current official text.
What It Covers
Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under FDA record requirements, and to electronic records submitted to FDA. It also applies when electronic signatures are used in place of handwritten signatures required by other FDA regulations. Records that exist only on paper, even if typed on a computer first, are generally outside its scope.
The rule's controls fall into a few themes. Systems should be validated for their intended use. Records should be protected and retrievable for their retention period, with secure, computer-generated, time-stamped audit trails that record changes without obscuring the original entry. Access should be limited to authorized individuals, and operational and authority checks should enforce the intended sequence of steps. Electronic signatures should show who signed, when, and what the signature meant (such as review or approval), and should be linked to the record so they cannot be copied or removed.
Whether a given system meets Part 11 is not a property of the software alone. It depends on how the firm configures the system, the validation it performs and documents, and the procedures it follows for access, training, signature accountability and record retention. A vendor can supply features that support Part 11, but the firm is responsible for showing that its implementation meets the rule. FDA has also published guidance describing how it interprets the rule's scope and where it applies enforcement discretion.
Who It Applies To
- Device manufacturers who keep FDA-required quality records in an eQMS, ERP, MES, LIMS or other software
- Firms that sign approvals, reviews or releases electronically
- Sponsors and investigators handling electronic records in clinical investigations
- Software and contract service providers whose systems hold a client's FDA-required records, through the client's obligations
What Auditors Check
Validation for Intended Use
Evidence that each system holding required records was validated for the way your firm actually uses it, with the validation kept current through upgrades and configuration changes.
Audit Trails
Whether the system records who changed what and when, keeps the prior value, and whether anyone reviews the audit trail where it matters.
Access Controls and User Management
Unique user accounts, role-based permissions, prompt removal of departed users, and no shared logins on systems that hold required records.
Electronic Signature Manifestation and Linking
Signed records show the signer's printed name, the date and time, and the meaning of the signature, and the signature stays bound to the record it was applied to.
Procedures and Accountability
Written procedures that hold individuals accountable for actions taken under their electronic signatures, plus training records for the people using the system.
Record Retention and Retrieval
Whether required records can be produced in a readable form for the full retention period, including after a system migration or retirement.
Related Services
Software Validation and Device Software (CSV, IEC 62304)
Validate software used in production and the QMS, and build device software on an IEC 62304 lifecycle.
AI-Assisted QMS Gap Assessment
An AI-assisted first pass over the QMS documents you already have, with every result reviewed by an advisor.
FDA Inspection Readiness (CP 7382.850)
FDA device inspection preparation built around Compliance Program 7382.850 and its risk-based approach.
Questions
Can we buy software that takes care of Part 11 for us?
Software can provide features that support Part 11, such as audit trails and signature controls, but conformance depends on how your firm configures, validates and uses it. Your procedures for access, training and signature accountability are part of the picture. Expect an investigator to ask for your validation and your procedures, not the vendor's brochure.
Does Part 11 apply to every spreadsheet we use?
It applies when an electronic record is one FDA requires you to keep, or when you rely on it in place of a paper record for a required activity. A spreadsheet used only as a scratch tool may fall outside scope, while one that is your official record of a required activity likely falls inside it. Deciding and documenting which records are in scope is a useful first step.
What does an electronic signature need to show?
A signed electronic record should show the signer's printed name, the date and time of signing, and the meaning of the signature, such as review, approval or authorship. The signature must be linked to its record so it cannot be removed, copied or transferred to falsify another record.
How does QMSAdvisor handle our uploaded records?
The platform preserves your original files, records a SHA-256 fingerprint for each one, and keeps an immutable activity history of every action. That supports review of your quality records during readiness work. It does not replace your own validated systems of record or your Part 11 assessment of them.
21 CFR Part 11
Check Your Quality System Against 21 CFR Part 11
An AI-assisted first pass maps your existing documents against the requirements in scope, and an advisor reviews every result. Please don't send confidential documents yet: secure upload is set up after onboarding.
