What does 21 CFR 211.68 require for automated and computerised equipment, and when can a system replace the second-person check?

121 CFR 211.68, clause by clause.

Section 211.68 covers “Automatic, mechanical, and electronic equipment”, not only computers: (a) allows it under a written programme of checks, (b) controls computer records, and (c) says when equipment can replace one of two people.¹

Paragraph (c) came with a 2008 rule, effective 8 December 2008.² FDA reads “systems” broadly: people, machines and methods, from hardware, software and networks to personnel and SOPs.³

Part 211 never says “audit trail”, yet FDA’s Q&A expects audit trails reviewed with the record, citing among others 211.101(c) and (d), 211.103 and 211.182, the operations paragraph (c) covers.³⁴ See audit trail requirements and Part 11 requirements.

221 CFR 211.68 records checklist.

These are the records an inspector can ask for under paragraphs (a) and (b), plus the restore test EU GMP asks for, and the evidence to have before relying on (c).

Two edge cases come from FDA’s Q&A. “Temporary backup copies (e.g., in case of a computer crash or other interruption) would not satisfy the requirement”, and shared, read-only accounts are acceptable for viewing data but “do not conform with the part 211 and 212 requirements for actions, such as second person review, to be attributable to a specific individual.”³

3When a system can replace the second person.

Paragraph (c) names five rules that ask for one person to do a step and another to check it. In each, equipment used in line with the section can take the first person’s place; it never takes the checker’s.¹²

FDA declined requests in 2008 to let equipment check work a person had done, including a barcode scan confirming an ingredient a person added:

“Revised Sec. 211.101(c) only permits human checking of weighing, measuring, and subdividing operations performed by automated equipment; we did not propose to allow automated checking of these operations.” Final rule, 73 FR 51919, 8 September 2008²

So under 211.101(d) an addition made by a person still needs a second person to verify it, scan or no scan.²⁴

The check is of the equipment, not a repeat of its work. In the same rule, “the person doing the checking must verify that the automated equipment is functioning properly and that the operations are reliably performed in the intended manner”, and FDA does not expect that a person will normally need “to repeat all of the automatic calculations by hand”.² The level, nature and frequency of that check can vary with the level of automation, and the 2008 amendments were “not intended to either add to or detract from any existing requirements”.²

FDA’s 1982 CPG 425.500 accepts a validated system that performs, supervises or checks significant steps, with checks of the initial, branching and final steps in the batch record.⁷ That does not take the person out of the check. In 2008 FDA rejected the reading that the CPG “allows for elimination of human oversight”: “a person, rather than automated equipment, is needed to record these checks of production steps in batch records”, and “All automated systems require some level (commensurate with the complexity and risk inherent in the system) of human oversight or checking for expected performance at appropriate intervals.”²

3.1Cleaning and charging: what FDA answered in 2008.

• Starting a CIP cycle is not performing it. FDA does not believe “that initiation of the automated cleaning cycle by a human operator constitutes performance of the cleaning process”, so only the person verifying the completed cycle signs the 211.182 log, for “both portable equipment skids and fixed equipment”.²
• Outputs are not the whole check. Equipment outputs “will normally be key factors, but not necessarily the only ones”. Manufacturers should “determine the reliability of the outputs and periodically check them”, for example by checking that an alarm works, monitoring the cleaning supplies a cycle uses or checking the rinse independently.²
• Fully automated additions still get a person. For a liquid line charged by equipment, where only the equipment’s own outputs show what went in, FDA still wanted “human verification that components were properly added to the liquid production line by the automated equipment”. For continuous additions it expects “a suitable system of human oversight”, not a witness for each one.²

4Example: an automated weigh and dispense.

Batch 26-208 calls for 12.400 kg of microcrystalline cellulose, with a tolerance of ±0.5%: 12.400 × 0.005 = 0.062 kg, so 12.338 to 12.462 kg.

The last row is a judgement, not a quoted rule. The 2008 rule does not mention typed weights, but 211.101(c)(3) relieves the second person only when the weighing is “performed by automated equipment”, and once a person reads and types the number, the weight “correct as stated in the batch production records” rests on that person. The conservative reading, and the one consistent with FDA’s refusal to let equipment check human work, is to bring the second person back.⁴² See potency-adjusted dispensing for the calculation that often sits upstream.

5Example: an input/output and backup-restore record.

6How EU GMP compares.

Keep two checks apart. For typed entries, both regions accept automated checks: Annex 11 section 6 says “This check may be done by a second operator or by validated electronic means”, and FDA’s CPG 425.400 says efficient input edits “could mitigate the need for more detailed manual data checks”.⁶⁵ The check of the dispensed material is different: EU GMP 5.38 wants it “independently checked and the check recorded” without saying by whom, while FDA’s 2008 rule makes the check of an operation human.⁸²

APIs sit between. Part 211 covers drug products, which Part 210 defines as finished dosage forms, and FDA adopted ICH Q7 as final guidance in September 2016.⁴¹⁰¹¹ Q7 5.45 says the check on manually entered critical data “can be done by a second operator or by the system itself”, so a US API maker can rely on the system there, while 211.68(c) and the 2008 refusal bind finished-dosage makers.¹² PIC/S PE 009-18 carries the same Annex 11 text, and the UK keeps applying the EU guidelines as they stood at the end of 2020, the 2011 Annex 11 among them.¹³¹⁴

The July 2025 draft Annex 11 drops the second operator and asks systems to check that manually entered critical data are plausible.⁹ It is still a draft; see the Annex 11 revision.

7What inspectors cite.

“Furthermore, your firm did not adequately maintain backups of data generated by your laboratory equipment.” NWL Netherlands Services B.V., warning letter 320-25-59, 1 April 2025¹⁵

“Your firm confirmed that you did not back up the electronic data located on the GC computer.” Laboratorios Jaloma S.A. de C.V., warning letter 320-26-78, 22 May 2026¹⁶

“These deficiencies demonstrate your failure to maintain a robust program to assure the proper performance of equipment essential to the manufacturing, processing, and holding of your drug products.” Granules India Limited, warning letter 320-25-48, 26 February 2025¹⁷

The Granules finding concerned air handling units and HEPA filters, cited under 211.68(a): the paragraph reaches far beyond computers.¹⁷

8How it runs in Seal.

In Seal, weigh and dispense records the container scan, the gross, tare and net readings and the verification against the batch step, with the original values retained. Configure the balance connection to keep device identity and calibration status with each capture. Before go-live, test it for disconnection, stale readings, unit changes and invalid values; any permitted manual fallback needs its own attribution and review. A failed identity check stays on the record beside a passing weight, so a correct number alone does not complete the step.

Validation follows the same proportion as the rule: computer system assurance starts from intended use and function risk, links supplier evidence, the configuration baseline, testing and release, and assesses each change from what moved. Neil can draft dispensing checks with their failure cases; the manufacturing owner verifies devices, units and exception behaviour and releases the workflow under change control.