1What Part 11 covers.
Part 11 sets out when FDA treats electronic records and electronic signatures as “trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper”.¹ It applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under any of FDA’s records requirements, and to electronic records submitted to FDA. It does not apply to paper records that are sent electronically.¹
The regulations that require a record in the first place, such as the drug CGMP regulations, are what FDA calls predicate rules. Since 2003 FDA has read Part 11’s scope narrowly: it applies when a record a predicate rule requires is kept electronically in place of paper, or kept both ways with the electronic record relied on for regulated work. When people print a record from a computer and rely on the paper, which meets the predicate rule, Part 11 is generally not triggered.² FDA recommends deciding in advance, for each required record, whether the paper or the electronic record is the one relied on, and documenting that decision, for example in an SOP.²
2What a closed system must do.
Most systems a GxP team runs are closed systems: access is controlled by the people responsible for the records in them. Section 11.10 lists the controls such a system needs.³
| Section | Control |
|---|---|
| 11.10(a) | Validation, to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records. |
| 11.10(b) | Accurate and complete copies of records, in human-readable and electronic form, for FDA to inspect. |
| 11.10(c) | Records protected so they can be retrieved accurately throughout their retention period. |
| 11.10(d) | Access limited to authorised individuals. |
| 11.10(e) | Secure, computer-generated, time-stamped audit trails of entries and actions that create, modify or delete records, which don’t obscure what was recorded before. |
| 11.10(f) | Operational checks that enforce the permitted sequence of steps. |
| 11.10(g) | Authority checks, so only authorised people sign, alter records or perform the operation. |
| 11.10(h) | Device checks on the validity of a data input’s source, where appropriate. |
| 11.10(i) | People who build, maintain or use the system have the education, training and experience to do so. |
| 11.10(j) | Written policies holding people accountable for actions under their electronic signatures. |
| 11.10(k) | Controls over system documentation, with change control. |
Audit trail records must be kept at least as long as the records they describe, and be available for FDA to review and copy.³
3What an electronic signature must show.
A signed electronic record must show the signer’s printed name, the date and time of signing, and what the signature means, such as review, approval, responsibility or authorship. Those details are part of any human-readable form of the record, on screen or on paper.⁴ Each signature must be linked to its record so it can’t be excised, copied or otherwise transferred to falsify a record by ordinary means.⁵
Each electronic signature belongs to one person and is never reused or reassigned. The organisation verifies the person’s identity before issuing it, and certifies to FDA that its electronic signatures are the legally binding equivalent of handwritten ones.⁶ A signature that isn’t biometric uses at least two components, such as an identification code and a password. In one continuous session the first signing uses all of them and later signings at least one; outside such a session, every signing uses all of them.⁷
4Where FDA uses enforcement discretion.
FDA’s 2003 guidance says it does not intend to take enforcement action on Part 11’s validation, audit trail, record retention and record copying requirements, as the guidance explains them, or on systems in use before 20 August 1997. Part 11 itself remains in effect, and records must still meet the predicate rules, which FDA does enforce.²
For validation, the guidance asks for an approach based on “a justified and documented risk assessment” of the system’s potential to affect product quality, safety and record integrity. It gives the example that validation would not be important for a word processor used only to write SOPs.²
5How Part 11 compares with EU Annex 11.
In the EU, computerised systems used in GMP work fall under Annex 11 of the EU GMP guidelines, published in EudraLex Volume 4.⁸ A company that supplies both markets usually designs one set of controls to meet both, since both expect validated systems, controlled access, audit trails and attributable signatures.
6How it runs in Seal.
Seal keeps version history, audit trails and role-based access with every record, and an electronic signature keeps the signer, the time and the meaning of the approval, linked to the record. The validation and AI assurance guide sets out how each change to a process is specified, tested and approved before release, and Regulatory and validation covers Part 11, Annex 11 and GAMP 5 together.
References
- 121 CFR 11.1, Scope, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- A/ section- 11. 1 (read 6 November 2026) - 2Guidance for Industry: Part 11, Electronic Records; Electronic Signatures, Scope and Application, FDA, August 2003. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ part- 11- electronic- records- electronic- signatures- scope- and- application (read 6 November 2026) - 321 CFR 11.10, Controls for closed systems, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 10 (read 6 November 2026) - 421 CFR 11.50, Signature manifestations, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 50 (read 6 November 2026) - 521 CFR 11.70, Signature/record linking, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 70 (read 6 November 2026) - 621 CFR 11.100, General requirements, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- C/ section- 11. 100 (read 6 November 2026) - 721 CFR 11.200, Electronic signature components and controls, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- C/ section- 11. 200 (read 6 November 2026) - 8EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026)
AQuestions and answers
Does Part 11 apply to every computer system in a GMP company?
No. FDA reads it narrowly: it applies to records the predicate rules require when they are kept electronically in place of paper, or kept both ways with the electronic copy relied on, and to electronic records submitted to FDA. A system used only to print records that you then rely on as paper generally falls outside it.
What is a predicate rule?
FDA’s name for a regulation that requires a record or signature in the first place, such as the drug CGMP regulations in 21 CFR 211. Part 11 sets how such records are kept when they are electronic; the predicate rule says which records you need.
Does Part 11 require audit trails?
Section 11.10(e) requires secure, computer-generated, time-stamped audit trails of operator entries and actions that create, modify or delete records, kept as long as the records themselves. FDA’s 2003 guidance places audit trails under enforcement discretion, but recommends deciding on them from a risk assessment, and the predicate rules still require the records to be accurate.
What does an electronic signature need to show?
The printed name of the signer, the date and time it was signed, and its meaning, such as review, approval, responsibility or authorship. Those details have to appear wherever the record is shown or printed.
Is Part 11 the same as EU Annex 11?
No. Part 11 is a US regulation for records FDA requires; Annex 11 is part of the EU GMP guidelines for computerised systems. Their expectations overlap, so companies supplying both markets usually meet both with one set of controls.