1Which signatures meet Part 11.
Part 11 names no products, and FDA “does not certify electronic systems and methods used to obtain electronic signatures”.¹² The answer depends on the signature type and the set-up:
| Signature | Status | What decides it | Source |
|---|---|---|---|
| Digital certificate | Electronic signature | Still needs the meaning shown and the signer’s identity verified before issue | 11.3(b)(5), 11.50, 11.100(b)¹ |
| DocuSign Part 11 module | Can comply | Module on for the account, configured and validated by you; identities verified; letter sent to FDA | DocuSign;³ Q24² |
| DocuSign, no module | Not on its own | DocuSign puts signing authentication, the reason for signing and the manifestation in the module | DocuSign³ |
| Acrobat Sign enterprise | Can comply | The only Adobe service marked “FDA 21 CFR Part 11 ready”; Bio-Pharma settings on | Adobe⁴⁵ |
| Finger or stylus | Handwritten | Must be linked to its electronic record, and should be placed as it would appear on paper | Q25;² 11.3(b)(8), 11.70¹ |
| Pasted signature image | Not acceptable | The MHRA calls it “not adequate”; it can be copied to another record, which 11.70 forbids | MHRA 6.14;⁶ 11.70¹ |
| Print, sign, scan | Handwritten on paper | If the paper is the record, Part 11 does not apply; if the scan replaces it, it must be an accurate copy and becomes a Part 11 record | 11.1(b);¹ 2003 guidance III.B;⁷ 211.180(d)⁸ |
| Wet ink on a printout | Hybrid | Linked to the electronic record, for example by the record’s hash printed on the signature page | 11.70;¹ draft Annex 11 13.9⁹ |
| Business contract | Usually outside Part 11 | Part 11 covers records a predicate rule requires or that are submitted to FDA | 11.1(b);¹ 2003 guidance III.B.2⁷ |
FDA’s 2024 questions and answers are guidance for clinical investigations, but their signature answers read the same sections of Part 11 that GMP signatures must meet. They let you rely on the provider’s information or on “their own validation of the services when warranted”.²
2How to set up DocuSign and Acrobat Sign for Part 11.
| Control | DocuSign Part 11 module | Acrobat Sign Bio-Pharma settings | Part 11 |
|---|---|---|---|
| Switching on | DocuSign enables the module; the profile then shows “Part 11 Module Enabled” | Account Settings, Bio-Pharma Settings; business and enterprise tiers | Prerequisite |
| Signing reason | Always required; defaults author, reviewed and approve; editable on Enterprise Pro | Switch on “Require signers to provide a signing reason”; admin list or free text; not on initials or stamps | 11.50(a)(3) |
| Re-authentication | Original Part 11 Signing, the default: at opening and at every signature or initial; Rapid: at opening and before completing | “Challenge for each signature”, or at opening, or when finalising | 11.200(a)(1) |
| Signer login | Account login by default; or an SMS code plus the phone’s last four digits; or identity verification plus login | SMS for external signers, Acrobat Sign login for internal; stop senders changing the method | 11.100(b), 11.300 |
| Not allowed | Delegated, in-person, free-form, paper, fax and mobile-app signing; PowerForms | None listed | 11.100(a) |
- Rapid signing needs a written rationale. Under Rapid, signers authenticate to open the envelope and again before completing it, entering nothing at each field between.¹² Part 11 allows fewer components only for later signings within “a single, continuous period of controlled system access”, and FDA’s 1997 preamble expected controls such as automatic log-off after a short idle period.¹¹⁸ So test and record that nothing is signed before the completing authentication, which uses every component, and that an idle session closes; Acrobat Sign’s “Challenge when the agreement is finalized” needs the same. The draft Annex 11 wants a full re-authentication at each signature, “a password or biometrics only” for those “in immediate sequence”, and calls “relying on the previous system authentication” not acceptable, so Original is safer if EU inspectors also visit.⁹
- SMS needs one too. DocuSign’s SMS option asks for “the last four digits of their phone number and a code that they receive by SMS”.¹³ The digits are not secret, so record why the pair counts as “two distinct identification components” under 11.200(a)(1), for example that the code proves possession of a phone verified as the signer’s.¹ That check is yours: the customer “must perform identity verification of any individual who intends to use an electronic signature”, and the module “relies on the association of an email address with the signer”.¹⁹ Internal signers can use account login instead.
- Acrobat Sign on a business plan. Business accounts get the Bio-Pharma settings, but Adobe marks only the enterprise service “FDA 21 CFR Part 11 ready”.⁵⁴ On business, Adobe’s compliance list makes no Part 11 claim, so your own validation has to carry the case.
3Part 11 e-signature configuration checklist.
Use it before the first GMP signature. Part 11 covers signatures a predicate rule requires, such as the two on a master production record; where 211.186(a) asks for a “full signature, handwritten”, 11.1(c) makes a compliant electronic signature its equivalent.²⁰⁷¹
| Requirement | Configure or verify | Evidence to keep |
|---|---|---|
| 11.50 | Printed name, date and time, and meaning on the signed PDF and its printout, not only in the portal | Signed test record and its printout |
| 11.70 | A signature cannot be copied to another record; a change after signing shows | Edit a copy of a completed PDF; validation flags it |
| 11.100(a) | One account per person; no shared mailboxes or delegated signing | User list against staff list |
| 11.100(b) | Identity verified before a first signature, for example by government-issued ID | Identity check per signer, suppliers included |
| 11.100(c) | Letter of non-repudiation with FDA before or at first use; one company-wide letter covers all employees | Copy and proof of submission |
| 11.200(a) | All components at each signing outside one continuous session; only the owner can sign | Test signing from an e-mailed link |
| 11.300 | Unique ID and password pairs, periodic checks, lockout on failed attempts | Settings export |
| 11.10(a), 11.30 | Configuration validated for your use; open-system controls | Vendor reports, such as DocuSign’s separate Validator module, plus your own tests |
| 11.10(e) | Audit trail kept with the record and any PDF copy | DocuSign’s certificate of completion, or Adobe’s agreement report, filed with the PDF |
| 11.10(j) | Signers held accountable by written policy | Signed acknowledgement |
| Predicate rule | Signed PDF kept for the retention period, such as 1 year after batch expiry | Retention entry |
Since March 2023 the letter can go electronically; FDA now takes it through the ESG NextGen portal, and a paper copy is optional.¹²¹ DocuSign calls itself “a compliant open system under Part 11”, so 11.30 applies too.²²¹ Adobe’s footnote to “Part 11 ready” adds: “Ultimately, the customer is responsible for ensuring compliance with legal obligations”.⁴ See validating SaaS.
4Example: an SOP approved through a signing service.
This record is invented for illustration.
| Field | Entry |
|---|---|
| Record | SOP-QA-014 version 6, Deviation management, as a PDF from document control, 3 November 2026. |
| Signing | Part 11 module, Original Part 11 Signing. Author, reviewer and approver each opened the e-mailed link, logged in, then logged in again and chose a reason at the signature: 11.200(a)(1)(ii). |
| Validation | VAL-ES-002, February 2026: Validator reports reviewed, plus 9 site tests, including the printout, an edited copy, a wrong password and a signer with no account. All passed. |
| Signer | Meaning | Signed, UTC |
|---|---|---|
| Priya Nair, QA Specialist | I am the author of this document | 3 Nov 2026 16:05:12 |
| Tom Hughes, Production Manager | I have reviewed this document | 4 Nov 2026 09:41:30 |
| Dana Okoro, Head of QA | I approve this document | 4 Nov 2026 14:32:07 |
5What inspectors cite.
Both letters cite borrowed or shared credentials in GMP systems:
“our investigator observed that the login credentials of employee, (b)(4), were used to document the completion of several manufacturing activities on two drug product batch records dated March 17, 2021, and July 19, 2021. However, you stated to our investigator that (b)(4) has not been employed at the company since September 2019.” Colorful Products Corporation, warning letter, 10 May 2022²³
“The sharing of credentials constitutes a serious violation of data-integrity principles and is inconsistent with GMP requirements. Your quality system failed to detect and prevent repeated occurrences of this practice.” Curia New York, Inc., warning letter, 18 September 2026²⁴
A signing service cannot tell who typed a password: leavers’ accounts, shared mailboxes and 11.300’s periodic checks stay with you.¹
6How EU GMP, the MHRA and PIC/S treat these services.
Annex 11 of 2011 asks for the impact of a handwritten signature within the company, a permanent link to the record, and the time and date; Adobe marks Acrobat Sign enterprise “EudraLex Volume 4 Annex 11 ready”.²⁵⁴
The draft Annex 11, consulted on from 7 July to 7 October 2025, is not yet adopted: the Commission’s GMP page still lists the January 2011 text.²⁶²⁷ Its section 13 goes further:⁹
- Open systems. Where the owner lacks full control of access, signatures should also meet requirements “such as trusted services”; under eIDAS a qualified electronic signature has “the equivalent legal effect of a handwritten signature”.²⁸
- Manifestation and changes. Username and role join the 11.50 items, and a signed record either cannot be changed or visibly loses its signature.
The MHRA wants a validated signing process and the signer’s title shown, says “The use of advanced electronic signatures should be considered where this method of authentication is required by the risk assessment”, and rejects “An inserted image of a signature” or a footnote saying the document was signed, where entered outside the validated process.⁶ PIC/S tells inspectors to check that signatures are validated and their issue controlled.²⁹ See Part 11 vs Annex 11.
7How it runs in Seal.
Seal’s document control records each electronic signature with the signer, date, time and meaning, and keeps the approvals and audit trail of every version for its retention period. In electronic batch records each signature is bound to its record, the verifier can be required to differ from the performer, and critical actions can require reauthentication.
Where agreements are signed elsewhere, the DocuSign connection lets Seal reference completed envelopes with their combined PDFs and completion certificates. It reads only: it does not send or sign envelopes, and DocuSign stays the source of truth.
References
- 121 CFR Part 11, Electronic Records; Electronic Signatures, sections 11.1, 11.3, 11.10, 11.30, 11.50, 11.70, 11.100, 11.200 and 11.300, as amended 2 March 2023 (88 FR 13018), eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11 (read 8 November 2026) - 2Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers, guidance for industry, Revision 1, section III.E, questions 24 to 29, FDA, October 2024. https:/
/ www. fda. gov/ media/ 166215/ download (read 8 November 2026) - 3Life Sciences Modules for 21 CFR Part 11, Docusign product page. https:/
/ www. docusign. com/ products/ life- sciences- modules (read 8 November 2026) - 4Adobe Compliance Certifications, Standards, and Regulations, Adobe Trust Center, last updated 21 May 2026, Acrobat Sign Solutions for enterprise and footnote 1. https:/
/ www. adobe. com/ trust/ compliance/ compliance- list. html (read 8 November 2026) - 5Configure bio-pharma settings, Adobe Acrobat Sign Help, last updated 19 December 2023. https:/
/ helpx. adobe. com/ sign/ web/ settings- configuration/ bio- pharma- settings/ bio- pharma- settings- configuration. html (read 8 November 2026) - 6GXP Data Integrity Guidance and Definitions, Revision 1, section 6.14, MHRA, March 2018. https:/
/ assets. publishing. service. gov. uk/ media/ 5aa2b9ede5274a3e391e37f3/ MHRA_ GxP_ data_ integrity_ guide_ March_ edited_ Final. pdf (read 8 November 2026) - 7Guidance for Industry: Part 11, Electronic Records; Electronic Signatures, Scope and Application, sections II and III.B, FDA, August 2003. https:/
/ www. fda. gov/ media/ 75414/ download (read 8 November 2026) - 821 CFR 211.180, General requirements (records and reports), paragraphs (a) and (d), eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 180 (read 8 November 2026) - 9Annex 11: Computerised Systems, draft for consultation, sections 13.2 to 13.9, European Commission and PIC/S, July 2025. https:/
/ health. ec. europa. eu/ document/ download/ 40231f18- e564- 4043- 94de- c031f813d38b_ en?filename=mp_ vol4_ chap4_ annex11_ consultation_ guideline_ en. pdf (read 8 November 2026) - 10Docusign Part 11 Module Administration, Docusign support guide, last updated 1 August 2025. https:/
/ support. docusign. com/ s/ document- item?language=en_ US&bundleId=tja1628891649386&topicId=xms1583277464677. html&_ LANG=enus (read 8 November 2026) - 11Configure Part 11 Signing Reasons, Docusign support guide, last updated 25 February 2026. https:/
/ support. docusign. com/ s/ document- item?language=en_ US&bundleId=tja1628891649386&topicId=ylf1583277472869. html (read 8 November 2026) - 12Signing Experiences for Part 11 Accounts, Docusign support guide, last updated 25 May 2025. https:/
/ support. docusign. com/ s/ document- item?language=en_ US&bundleId=tja1628891649386&topicId=zjj1626294860666. html&_ LANG=enus (read 8 November 2026) - 13Authentication Methods for Part 11 Signers, Docusign support guide, last updated 1 August 2025. https:/
/ support. docusign. com/ s/ document- item?language=en_ US&bundleId=tja1628891649386&topicId=zta1646351656754. html&_ LANG=enus (read 8 November 2026) - 14Features and Functions Not Available in the Docusign Part 11 Module, Docusign support guide, last updated 13 October 2026. https:/
/ support. docusign. com/ s/ document- item?language=en_ US&bundleId=tja1628891649386&topicId=ezy1659124843196. html&_ LANG=enus (read 8 November 2026) - 15Part 11 Information in Completed Documents, Docusign support guide, last updated 1 August 2025. https:/
/ support. docusign. com/ s/ document- item?bundleId=tja1628891649386&topicId=ikd1583277463288. html&_ LANG=enus&language=en_ US (read 8 November 2026) - 16Validator for Life Sciences, Docusign support guide, last updated 1 August 2025. https:/
/ support. docusign. com/ s/ document- item?language=en_ US&bundleId=tja1628891649386&topicId=vwh1583277474107. html&_ LANG=enus (read 8 November 2026) - 17Signing reasons, Adobe Acrobat Sign Help, last updated 14 October 2025. https:/
/ helpx. adobe. com/ sign/ web/ settings- configuration/ bio- pharma- settings/ signing- reasons. html (read 8 November 2026) - 18Electronic Records; Electronic Signatures, final rule, preamble comment 124, FDA, Federal Register 62 FR 13430, 20 March 1997. https:/
/ www. govinfo. gov/ content/ pkg/ FR- 1997- 03- 20/ pdf/ 97- 6833. pdf (read 8 November 2026) - 19Part 11 Envelope Access and Signatures, Docusign support guide, last updated 1 August 2025. https:/
/ support. docusign. com/ s/ document- item?language=en_ US&bundleId=tja1628891649386&topicId=dgf1583277465613. html&_ LANG=enus (read 8 November 2026) - 2021 CFR 211.186(a), Master production and control records, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211 (read 8 November 2026) - 21Letters of Non-Repudiation Agreement, ESG NextGen, FDA, content current as of 16 July 2026. https:/
/ www. fda. gov/ industry/ getting- started- esg- nextgen/ letters- non- repudiation- agreement (read 8 November 2026) - 22Simplify 21 CFR Part 11 Compliance Documentation, Docusign guide summary page. https:/
/ www. docusign. com/ resources/ whitepapers/ using- docusign- to- facilitate- compliance- with- 21- cfr- part- 11 (read 8 November 2026) - 23Colorful Products Corporation, warning letter, MARCS-CMS 624415, item 4, citing 21 CFR 211.68(b), FDA, 10 May 2022. https:/
/ www. fda. gov/ inspections- compliance- enforcement- and- criminal- investigations/ warning- letters/ colorful- products- corporation- 624415- 05102022 (read 8 November 2026) - 24Curia New York, Inc., warning letter, MARCS-CMS 728790, item 3, FDA, 18 September 2026. https:/
/ www. fda. gov/ inspections- compliance- enforcement- and- criminal- investigations/ warning- letters/ curia- new- york- inc- 728790- 09182026 (read 8 November 2026) - 25EudraLex Volume 4, Annex 11: Computerised Systems, section 14, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 8 November 2026) - 26Stakeholders’ consultation on EudraLex Volume 4, Chapter 4, Annex 11 and new Annex 22, European Commission, 7 July to 7 October 2025. https:/
/ health. ec. europa. eu/ consultations/ stakeholders- consultation- eudralex- volume- 4- good- manufacturing- practice- guidelines- chapter- 4- annex_ en (read 8 November 2026) - 27EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 8 November 2026) - 28Regulation (EU) No 910/2014 on electronic identification and trust services (eIDAS), Articles 3 and 25, EUR-Lex. https:/
/ eur- lex. europa. eu/ legal- content/ EN/ TXT/ HTML/ ?uri=CELEX:32014R0910 (read 8 November 2026) - 29PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, section 9.5, item 4, PIC/S, 1 July 2021. https:/
/ picscheme. org/ docview/ 4234 (read 8 November 2026)
AQuestions and answers
Is a scanned signature an electronic signature?
Arguably yes, but not a valid one. Part 11 defines an electronic signature as any symbol or series of symbols a person executes, adopts or authorises as the legally binding equivalent of their handwritten signature, so a pasted image can count as one. It then fails the rules on linking and on two identification components, because anyone can copy it, and the MHRA calls an inserted image not adequate. Inside a configured signing service an uploaded image is only the signature’s appearance: the authenticated, logged act is the signature. A scanned page can still be an accurate copy of a signed paper record.
How do you check that a signed PDF meets Part 11?
Open the completed PDF and print it. Each signature should show the signer’s printed name, the date and time and the meaning, such as approved, in the document itself and on the printout, not only in the service’s portal. Then check that the audit trail or certificate of completion is filed with it, that each signer had their own account, and that an edit to a copy shows as a change. A drawn or typed name with no meaning beside it does not meet 11.50, whatever account sent it.
What is the difference between DocuSign and DocuSign Part 11?
DocuSign Part 11 is an add-on module for life sciences accounts. It adds authentication at each signature, a required reason for signing and a signature manifestation, applied to every envelope sent from the account, and it switches off features Part 11 signing cannot use, such as delegated, in-person and fax signing. Standard DocuSign is the same signing service without those controls, which is why it is not enough for GMP signatures on its own.
How much does the DocuSign Part 11 module cost?
DocuSign does not publish a price. Its life sciences module page sends buyers to sales, and its public plans page lists no Part 11 module. Budget for the module, the separate Validator for Life Sciences if you want DocuSign’s monthly test reports, and a plan that allows the configuration you need: customising the signing reasons, for example, needs an Enterprise Pro plan.
Is a letter of non-repudiation still required for electronic signatures?
Yes. Section 11.100(c) still requires it before or at the first use of electronic signatures, and FDA confirmed this in 2024. One company-wide letter, signed by hand by someone authorised to act for the company, covers all its employees. FDA now takes it electronically through its submissions gateway portal; mailing a paper copy is optional.
Can suppliers and contract manufacturers sign our GMP records in DocuSign?
Yes, if they sign through the same configured account and you treat them like any other signer: verify each person’s identity before their first signature, give each their own credentials, and make sure their signatures carry name, date, time and meaning. FDA’s sample company-wide letter covers signatures by a company’s employees, agents or representatives, so decide whether the supplier’s staff sign under your letter or their own company’s, and write that into the quality agreement with the list of their signatures your records rely on.