1What Part 11 requires.
Part 11 applies to records that FDA’s other regulations require when they are kept in electronic form. For a closed system, one where access is controlled by the people responsible for the records on it, section 11.10(e) requires “secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records”. Record changes “shall not obscure previously recorded information”, and the audit trail is kept at least as long as the records it describes and is available for FDA to review and copy.¹
Section 11.10(k)(2) asks for a second kind of audit trail: revision and change control procedures that document the time-sequenced development and modification of systems documentation. Open systems need the same controls, as appropriate, plus measures such as encryption.¹ The wider rules are explained in What does 21 CFR Part 11 require?
FDA’s 2003 scope and application guidance says FDA intends to exercise enforcement discretion over the audit trail requirements in 11.10(e) and (k)(2). Part 11 remains in effect, and predicate rule requirements to document date, time or sequence of events, and to ensure changes do not obscure previous entries, still apply. FDA recommends deciding on audit trails from the predicate rules, “a justified and documented risk assessment” and the potential effect on product quality, safety and record integrity, and notes that audit trails “can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation”.²
2What Annex 11 requires.
EU GMP Annex 11, in operation since 30 June 2011, applies to all computerised systems used in GMP-regulated activities. Section 9 asks that, based on a risk assessment, consideration be given to building in “a record of all GMP-relevant changes and deletions”. For a change or deletion of GMP-relevant data “the reason should be documented”, and audit trails need to be “available and convertible to a generally intelligible form and regularly reviewed”.³
Other sections complete the picture. Section 12.4 asks that systems record the identity of operators entering, changing, confirming or deleting data, with the date and time. Section 8.2 asks that, for records supporting batch release, printouts can show whether any data has changed since the original entry. Section 14 expects electronic signatures to be permanently linked to their records and to include the time and date they were applied.³
3What each entry should capture.
The clearest difference between the two texts is the reason for a change. Data integrity guidance from FDA and PIC/S fills in the detail.¹⁴³⁵
| Element | Part 11 and FDA guidance | EU GMP Annex 11 | PIC/S PI 041-1 |
|---|---|---|---|
| Who | Operator entries and actions (11.10(e)); FDA’s HPLC example includes the user name | Identity of the operator entering, changing, confirming or deleting data (12.4) | The user who took the action |
| What | Actions that create, modify or delete records, without obscuring earlier information (11.10(e)) | All GMP-relevant changes and deletions (9) | The action, including old and new values |
| When | Computer-generated date and time (11.10(e)) | Date and time (12.4) | Date and time, recorded at the time of the activity |
| Why | Not in 11.10(e); FDA expects a justification for reprocessing | Reason for a change or deletion of GMP-relevant data (9) | The reason, and who authorised a change to data |
| Access | Kept at least as long as the records, available to FDA (11.10(e)) | Available and convertible to an intelligible form (9) | Printable and exportable in a meaningful format |
| Review | Reviewed with the record it belongs to | Regularly reviewed (9) | Critical audit trails reviewed before the operation closes |
4What the data integrity guidance adds.
FDA’s December 2018 data integrity guidance defines an audit trail as a secure, computer-generated, time-stamped electronic record “that allows for reconstruction of the course of events relating to the creation, modification, or deletion of an electronic record”. Its example for an HPLC run includes the user name, the date and time of the run, the integration parameters and details of any reprocessing, with the justification for reprocessing documented. Audit trails include those that track changes to data and those that track actions at the record or system level, such as attempts to access the system or rename or delete a file.⁴
MHRA’s GXP guidance of March 2018 says an audit trail lets the history of a record be reconstructed, including the “who, what, when and why” of each action. It says audit trails that a risk assessment identifies as required should be switched on, users should not be able to amend or switch them off, and a record should be kept if a system administrator does. Changes should be dated and time-stamped, with the time zone where applicable, and the reason recorded.⁶
PIC/S PI 041-1 of 1 July 2021 asks that audit trail functionality be “enabled and locked at all times”, with an automatic entry if an administrator can and does deactivate or change it. Entries should be recorded in true time: a system that writes one entry only after a sequence of interactions is complete may not meet expectations where each step is critical.⁵
5How audit trails are reviewed.
FDA compares audit trail review to assessing cross-outs on paper. The people who review a record under CGMP review the audit trail with it. Where CGMP sets a review frequency for the data, the audit trail follows it, such as review after each significant step under 211.188(b) and before batch release under 211.22. Otherwise the frequency comes from a risk assessment.⁴ PIC/S expects critical audit trails to be reviewed with the other records of an operation before it is completed, for example before batch release, and non-critical ones during system reviews at a set frequency.⁵ The detail is in What is an audit trail review?
6What the draft Annex 11 would change.
From 7 July to 7 October 2025 the European Commission consulted on a revised Annex 11, drafted by the EMA GMDP Inspectors Working Group with PIC/S.⁷ Its section 12 would require systems where users can create, modify or delete data to log all manual user interactions automatically. Each entry would capture the user, and their role where they can hold more than one, the old and new values, and the date and time, with the time zone where applicable, and the system would prompt for the reason for a change. Audit trails would be enabled and locked, searchable and sortable, and reviewed before batch release unless a later review can be justified.⁸
The draft is not in force. On 6 November 2026 EudraLex Volume 4 still lists the January 2011 revision of Annex 11.⁹ See What does the draft revision of EU GMP Annex 11 change?
7How it runs in Seal.
Seal keeps an audit log on each record, with version history, role-based access and electronic signatures that retain the signer, the time and the meaning of the approval, linked to the record. The audit trail review blueprint preserves before-and-after values, timestamps, reasons and source references, places vendor audit-trail exports, such as a chromatography data system’s, beside the record they belong to, and can make a required review a gate on the result or disposition.
Seal’s regulatory overview and the validation and AI assurance guide set out what to demonstrate in qualification: who created or changed each record and when, the required signatures and authority checks, and the effect of changing an approved record.
References
- 121 CFR Part 11, Electronic Records; Electronic Signatures, sections 11.3, 11.10 and 11.30, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11 (read 6 November 2026) - 2Guidance for Industry: Part 11, Electronic Records; Electronic Signatures, Scope and Application, FDA, August 2003, sections I and III.C.2. https:/
/ www. fda. gov/ media/ 75414/ download (read 6 November 2026) - 3EudraLex Volume 4, Annex 11: Computerised Systems, European Commission, revision 1, in operation from 30 June 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 4Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018, questions 1.c, 7 and 8. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 5PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, PIC/S, 1 July 2021, section 9.6. https:/
/ picscheme. org/ docview/ 4234 (read 6 November 2026) - 6‘GXP’ Data Integrity Guidance and Definitions, revision 1, MHRA, March 2018, section 6.13. https:/
/ assets. publishing. service. gov. uk/ media/ 5aa2b9ede5274a3e391e37f3/ MHRA_ GxP_ data_ integrity_ guide_ March_ edited_ Final. pdf (read 6 November 2026) - 7Stakeholders’ Consultation on EudraLex Volume 4: Chapter 4, Annex 11 and New Annex 22, European Commission, July 2025. https:/
/ health. ec. europa. eu/ consultations/ stakeholders- consultation- eudralex- volume- 4- good- manufacturing- practice- guidelines- chapter- 4- annex_ en (read 6 November 2026) - 8Annex 11: Computerised Systems, draft for consultation, European Commission and PIC/S, July 2025, section 12. https:/
/ picscheme. org/ docview/ 9714 (read 6 November 2026) - 9EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026)
AQuestions and answers
Does Part 11 require the reason for a change to be recorded?
Section 11.10(e) does not mention a reason. It requires the date and time of entries and actions, with earlier information left visible. EU GMP Annex 11 asks for the reason for any change or deletion of GMP-relevant data, MHRA and PIC/S guidance expect it, and FDA’s data integrity guidance expects a justification when laboratory data are reprocessed.
Can an administrator switch an audit trail off?
Users should not be able to, and anything an administrator does to it should leave a record. MHRA says users should not be able to amend or switch off an audit trail, and that a record should be kept if an administrator does. PIC/S expects audit trails to be enabled and locked, with an automatic entry if an administrator deactivates or changes them. FDA recommends giving the administrator role to people independent of those responsible for the record content.
Does every GxP system need an audit trail?
Annex 11 and FDA’s 2003 guidance both tie the decision to a documented risk assessment, and FDA notes audit trails are particularly appropriate where users create, modify or delete regulated records in normal operation. Where a very simple system has none, PIC/S expects alternative controls such as procedures and second-person checks, and expects companies to upgrade older systems.
How long must audit trails be kept?
Part 11 says at least as long as the electronic records they describe, and available for FDA to review and copy. Annex 11 asks that data stay accessible, readable and accurate throughout the retention period, and that archived data can still be retrieved after the system changes.
Do logins belong in the audit trail?
FDA counts audit trails that track system-level actions, such as attempts to access the system, alongside those that track changes to data. MHRA says audit trail review need not cover every system activity, such as logging on and off. The draft revision of Annex 11 would add an access log of each login and logout, separate from or part of the audit trail.
Is an audit trail the same as change control?
No. PIC/S notes that an audit trail should not be confused with change control, the quality system process for approving changes. Part 11 does ask, in 11.10(k)(2), for change control procedures that keep a time-sequenced record of changes to system documentation.