1Know what you are choosing.
No regulation defines an electronic batch record (eBR) or a manufacturing execution system (MES). The rules set what a batch record must contain and how a computerised system must be controlled; the product categories are the industry’s. The common reference for where an MES sits is ISA-95, the standard for enterprise-control system integration. ISA’s description places manufacturing execution systems at level 3, manufacturing operations management, between the control systems at level 2 and business systems such as ERP at level 4, and says the standard “primarily deals with the interface between levels 3 and 4”.¹
On this page an eBR means the batch record function: the record 21 CFR 211.188 requires, executed and captured electronically. Decide which level 3 activities your sites need now, whether batch execution alone or materials, equipment and weigh and dispense as well, and which can follow, because scope drives cost, interfaces and validation.
2Start from requirements, not a feature list.
Annex 11 asks for user requirements that “describe the required functions of the computerised system and be based on documented risk assessment and GMP impact”, traceable through the system’s life.² PIC/S adds that requirements should “adequately address data management and integrity requirements”, and that GMP-critical systems should be evaluated for data integrity controls before purchase.³ The draft revision of Annex 11 would make this explicit for bought and hosted software: a requirements specification supplied by the vendor should still be reviewed, approved and owned by the regulated user.⁴
Write the requirements from a representative master batch record. 211.188 gives the content the record must capture, from component batches and weights to in-process results, yields and the people who performed and checked each step.⁵ 211.186 gives what the master record must specify, including theoretical yield limits beyond which an investigation under 211.192 is required.⁶ Add the systems the record must exchange data with: balances, control systems, the LIMS, the QMS and ERP. For critical systems Annex 11 expects a description of “data flows and interfaces with other systems or processes”.²
3Test candidates on your own record.
A scripted demonstration shows the normal run. Ask each supplier to run your representative record, including what goes wrong.
| Test | What to look for | Basis |
|---|---|---|
| Attribution | Every entry tied to one person; no shared logins; access granted and removed on record. | 21 CFR 11.10(d) and (g); Annex 11, section 12 |
| Audit trail | Changes recorded with the time, the person and the reason, and visible at review. | 21 CFR 11.10(e); Annex 11, sections 8.2 and 9 |
| Signatures | Name, date and time, and meaning shown; linked to the record. | 21 CFR 11.50 and 11.70; Annex 11, section 14 |
| Sequence and limits | Steps enforced in order; values outside limits stopped or routed. | 21 CFR 11.10(f); Annex 11, section 4.7 |
| Equipment data | Values from balances and instruments checked on entry; a second check on critical manual entries. | 21 CFR 211.68(b); Annex 11, sections 5 and 6 |
| Automated checks | A step performed by equipment and checked by one person. | 21 CFR 211.68(c) and 211.188(b)(11) |
| Release | Review before release; certification limited to Qualified Persons. | 21 CFR 211.192; Annex 11, section 15 |
| Records | Complete, readable copies for inspection, for the whole retention period. | 21 CFR 11.10(b) and (c); Annex 11, sections 7, 8.1 and 17 |
| Outage | A documented, tested fallback for critical steps. | Annex 11, section 16 |
The controls in the table come from Part 11’s requirements for closed systems,⁷ its signature rules,⁸⁹ 211.68 on computerised equipment,¹⁰ 211.192 on review before release¹¹ and Annex 11.² Under 211.68(c), equipment can satisfy the requirement for a second person to check a step if “one person checks that the equipment properly performed the operation”.¹⁰
4Ask how a change is validated.
The system will change after go-live: new products, recipe improvements, the supplier’s own releases. FDA treats each CGMP workflow as an intended use to be validated, and its example is an MES: qualifying the platform “does not demonstrate that a given MPCR generated by the MES contains the correct calculations”, where an MPCR is a master production and control record.¹² So ask how a change to one master record is specified, tested and released, how long it takes, and whether batches in progress keep the version they started with.
FDA’s computer software assurance guidance, reissued on 3 February 2026 for medical device production and quality management system software, sets out a risk-based way to scale that work.¹³ Among the functions it calls generally high process risk are those that maintain process parameters identified as essential to device safety, and those that determine the acceptability of product or process “with limited or no additional human awareness or review”. It also lets manufacturers build on “validation activities performed by other entities (e.g., developers, suppliers, cloud service providers)”.¹³ For medicines the same idea appears in Annex 11 and FDA’s data integrity guidance, which both scale validation to risk.²¹² ISPE’s GAMP 5 Second Edition, published in July 2022, encourages regulated companies “to maximize supplier involvement to leverage knowledge, experience, and documentation where possible”.¹⁴
5Assess the supplier.
Annex 11 requires formal agreements with third parties that supply, configure, validate, maintain or retain a system, stating their responsibilities; it says “the competence and reliability of a supplier are key factors” and that the need for an audit “should be based on a risk assessment”.² Suppliers’ quality system and audit information should be available to inspectors on request.² FDA’s assurance guidance lists what a vendor assessment can draw on: onsite audits where applicable, accreditations and certifications such as Service Organization Controls reports and ISO certifications, the vendor’s development, testing and cybersecurity practices, and its data integrity capabilities.¹³
Two contract terms matter for an eBR in particular. The draft Annex 11 would have contracts define “an exit strategy by which the regulated user may retain control of system data”, and agree the process for releasing new versions and the user’s “possibility to test these prior to release”.⁴ These are draft; the Annex 11 in force is the January 2011 version.¹⁵
6How it runs in Seal.
Seal runs the approved master record as an executable workflow that checks materials, equipment, training, limits and signatures as the work happens. Exceptions open from the step where they occur, and review begins while the batch is still running; see electronic batch records. Manufacturing execution, laboratory, quality, training and inventory share one platform, and a process change is released as a new version with its own tests, while earlier batches keep the version they ran (manufacturing execution).
Where an existing MES, LIMS, QMS or ERP stays in place, Seal connects the records the job needs and you agree which system owns them. The MES and eBR comparison lists what to check when choosing, and each product’s own comparison sets out how it answers, with sources.
References
- 1ISA-95 Series of Standards: Enterprise-Control System Integration, International Society of Automation. https:/
/ www. isa. org/ standards- and- publications/ isa- standards/ isa- 95- standard (read 6 November 2026) - 2EudraLex Volume 4, Annex 11: Computerised Systems, European Commission, in operation from 30 June 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 3PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, PIC/S, 1 July 2021, section 9.3. https:/
/ picscheme. org/ docview/ 4234 (read 6 November 2026) - 4Annex 11: Computerised Systems, draft revision for joint consultation, European Commission and PIC/S, July 2025, sections 6.3 and 7.5. https:/
/ picscheme. org/ docview/ 9714 (read 6 November 2026) - 521 CFR 211.188, Batch production and control records, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- J/ section- 211. 188 (read 6 November 2026) - 621 CFR 211.186, Master production and control records, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- J/ section- 211. 186 (read 6 November 2026) - 721 CFR 11.10, Controls for closed systems, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 10 (read 6 November 2026) - 821 CFR 11.50, Signature manifestations, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 50 (read 6 November 2026) - 921 CFR 11.70, Signature/record linking, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 70 (read 6 November 2026) - 1021 CFR 211.68, Automatic, mechanical, and electronic equipment, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- D/ section- 211. 68 (read 6 November 2026) - 1121 CFR 211.192, Production record review, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- J/ section- 211. 192 (read 6 November 2026) - 12Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 13Computer Software Assurance for Production and Quality Management System Software, Guidance for Industry and FDA Staff, FDA, 3 February 2026. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ computer- software- assurance- production- and- quality- management- system- software (read 6 November 2026) - 14GAMP 5 Guide 2nd Edition, ISPE, July 2022. https:/
/ ispe. org/ publications/ guidance- documents/ gamp- 5- guide- 2nd- edition (read 6 November 2026) - 15EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026)
AQuestions and answers
What is the difference between an eBR and an MES?
An electronic batch record captures and checks the execution of each batch against its master record. An MES is the wider manufacturing operations layer, which can add scheduling, materials, equipment, weigh and dispense and links to control and business systems. Whatever a product is called, compare it by the scope you need: batch execution alone, or materials, equipment and scheduling too.
Do we need an MES if we already have an ERP?
In the ISA-95 model, ERP sits at level 4, business planning and logistics. Executing and recording each batch step is level 3 work, where an eBR or MES sits. If your batch records are on paper beside the ERP, the gap is at level 3.
Can a cloud eBR be used for GMP manufacturing?
Yes. The requirements are the same as for an installed system: validation for intended use, controlled access, audit trails and records available for the retention period. Add a written agreement with the provider covering responsibilities, changes and data return, and agree how its updates are assessed before they reach your validated processes.
How long does an eBR implementation take?
It depends on the number of master records, the interfaces, how much validation each workflow needs and training. Starting with one representative product proves the patterns and later products reuse them, so expect the first product to take the most effort.
What should we ask for in a demonstration?
Ask the supplier to run one of your own master records rather than a prepared demo, including a value out of limits, a wrong material, a correction, a deviation and an interrupted step. Then ask them to change a step and show how that change is tested and released.