1Why no product is compliant on its own.
Part 11 places its requirements on people, not on software. Its controls fall on “persons who use closed systems to create, modify, maintain, or transmit electronic records”, who “shall employ procedures and controls” to keep those records authentic and reliable.¹ Some of those controls are features a product can supply. Others only the organisation can carry out: determining that the people who develop, maintain or use the system have the education, training and experience for their tasks (11.10(i)); written policies that hold individuals accountable for actions under their electronic signatures (11.10(j)); verifying a person’s identity before issuing a signature (11.100(b)); and certifying to FDA that its electronic signatures are the legally binding equivalent of handwritten ones (11.100(c)).¹
European guidance says the same from the buyer’s side. Annex 11 expects regulated users to review the documentation supplied with commercial off-the-shelf products “to check that user requirements are fulfilled”, and to take all reasonable steps to ensure the system was developed under an appropriate quality management system.² The MHRA says accepting vendor-supplied validation data “in isolation of system configuration and users intended use is not acceptable”.³ FDA expects each CGMP workflow to be validated, and gives an example: qualifying a manufacturing execution system platform does not show that a master production record built in it contains the correct calculations.⁴
2What the software must provide.
These are the technical controls a buyer can test for, with the section of Part 11 and of EU GMP Annex 11 that states each one, where it does.¹²
| Control | 21 CFR Part 11 | EU GMP Annex 11 |
|---|---|---|
| Validated to show accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records | 11.10(a) | Section 4 |
| Accurate and complete copies, in human-readable and electronic form | 11.10(b) | Section 8 (printed copies) |
| Records protected so they can be retrieved throughout the retention period, with backups | 11.10(c) | Sections 7 and 17 |
| Access limited to authorised individuals, with access changes recorded | 11.10(d) | Section 12 |
| Secure, computer-generated, time-stamped audit trails that do not obscure earlier entries | 11.10(e) | Section 9 |
| Operational checks that enforce the permitted sequence of steps | 11.10(f) | Not stated separately |
| Authority checks on who can sign, alter a record or perform an operation | 11.10(g) | Sections 2 and 12 |
| Checks on the source of data input, and on data exchanged with other systems | 11.10(h) | Section 5 |
| Additional checks on critical data entered by hand | Not stated separately | Section 6 |
| Signatures showing the printed name, the date and time and the meaning | 11.50 | Section 14 (date and time only) |
| Signatures linked to their records so they cannot be copied or transferred | 11.70 | Section 14 |
| Signatures with at least two components, such as an ID and password, unless biometric | 11.200 | Not stated separately |
Annex 11 adds that the reason for a change or deletion of GMP-relevant data should be documented, and that for records supporting batch release it should be possible to print them showing whether any data has changed since it was first entered.²
3What your organisation must do.
The rest of compliance is procedure and evidence. Annex 11 bases the extent of validation and data integrity controls on “a justified and documented risk assessment”, keeps user requirements traceable through the lifecycle, and expects formal agreements with suppliers and service providers that state their responsibilities.² Once the system is live, configuration changes go through a defined procedure, the system is periodically evaluated to confirm it remains valid, incidents are reported and assessed, and business continuity arrangements are documented and tested.² For a cloud service, the MHRA expects the contract to give timely access to data, including metadata and audit trails, to define responsibility for archiving and continued readability, to allow the system to be restored to its validated state and to include tested business continuity arrangements.³
FDA’s data integrity guidance adds operating expectations. The system administrator role should sit with people independent of those responsible for the record content. Shared logins do not meet CGMP, because an action has to be attributable to one person. Audit trails are reviewed by the people who review the record, at the frequency the regulations set for that record, such as before batch release.⁴ Part 11 also requires controls on identification codes and passwords: each combination unique, issuance periodically checked, and lost or compromised tokens deauthorised.¹
4What GMP adds to Part 11.
For drug manufacturers, 21 CFR 211.68 applies to every “computer or related system” used in manufacture: it must be routinely checked under a written programme, changes to records may be made only by authorised personnel, input and output must be checked for accuracy, and backup data must be exact, complete and secure from alteration or loss.⁵ FDA reads “systems” broadly, as hardware, software, networks, cloud infrastructure, personnel and associated documents such as SOPs.⁴
FDA’s 2003 guidance narrowed how it enforces Part 11. It does not intend to take enforcement action on Part 11’s validation, audit trail, record retention and record copying requirements as the guidance explains them, but it enforces the predicate rules, and it continues to enforce the other controls: access limits, operational, authority and device checks, training, accountability policies, documentation controls and the electronic signature requirements.⁶ In practice, a GMP-compliant system is one whose records meet the predicate rules as well as Part 11. Annex 11 states the test plainly: where a computerised system replaces a manual operation, “there should be no resultant decrease in product quality, process control or quality assurance”.²
5How to check a vendor’s claim.
Ask for evidence rather than a statement. Annex 11 expects quality system and audit information about software suppliers to be available to inspectors on request.² FDA’s computer software assurance guidance for device manufacturers, issued on 3 February 2026, suggests manufacturers can start from the software development practices, validation work and electronic information the developer has already produced, and lists what a vendor assessment may cover: audits where feasible, certifications such as Service Organization Controls reports, development and testing practices, and the software’s data integrity controls, including copies, audit trails, access controls and electronic signatures.⁷ ISPE’s GAMP 5 Second Edition encourages regulated companies “to maximize supplier involvement to leverage knowledge, experience, and documentation where possible”.⁸
Then test the controls in your own configuration. In FDA’s nonconformance system example, the manufacturer assesses the supplier and installation, then runs scenario testing with users to show the electronic signature function meets its intended use.⁷
6How it runs in Seal.
Seal keeps version history, audit trails and role-based access with every record, and an electronic signature keeps the signer, the time and the meaning of the approval, linked to the record. The validation and AI assurance guide sets out what Seal provides, the platform controls, assurance capabilities and supplier evidence for the version in scope, and what your team owns: the intended use, risk acceptance and production approval, including qualification of integrations and migrated data, user procedures and training.
As the regulatory overview puts it, no software alone makes an operation compliant. On the Seal platform, each change to a configured process runs its tests before your team releases it, and earlier work keeps its version.
References
- 121 CFR Part 11, Electronic Records; Electronic Signatures, sections 11.10, 11.50, 11.70, 11.100, 11.200 and 11.300, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11 (read 6 November 2026) - 2EudraLex Volume 4, Annex 11: Computerised Systems, European Commission, in operation from 30 June 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 3‘GXP’ Data Integrity Guidance and Definitions, Revision 1, MHRA, March 2018, sections 4.5, 6.19 and 6.20. https:/
/ assets. publishing. service. gov. uk/ media/ 5aa2b9ede5274a3e391e37f3/ MHRA_ GxP_ data_ integrity_ guide_ March_ edited_ Final. pdf (read 6 November 2026) - 4Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018, questions 1.f, 3, 4, 5, 7 and 8. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 521 CFR 211.68, Automatic, mechanical, and electronic equipment, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 68 (read 6 November 2026) - 6Guidance for Industry: Part 11, Electronic Records; Electronic Signatures, Scope and Application, FDA, August 2003, sections I and III.A. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ part- 11- electronic- records- electronic- signatures- scope- and- application (read 6 November 2026) - 7Computer Software Assurance for Production and Quality Management System Software, Guidance for Industry and FDA Staff, FDA, 3 February 2026, section V.A.5 and Appendix A, Example 1. https:/
/ www. fda. gov/ media/ 188844/ download (read 6 November 2026) - 8ISPE GAMP 5 Guide: A Risk-Based Approach to Compliant GxP Computerized Systems, Second Edition, ISPE, July 2022. https:/
/ ispe. org/ publications/ guidance- documents/ gamp- 5- guide- 2nd- edition (read 6 November 2026)
AQuestions and answers
Can a vendor certify that its software is Part 11 compliant?
A vendor can show that its product provides the technical controls Part 11 describes and share its development and testing evidence. It cannot make your use compliant: validation for your intended use, training, accountability policies, signature certification to FDA and change control belong to your organisation. Treat a vendor’s claim as the start of your assessment.
Does every computer system in a GMP company need Part 11 controls?
No. Part 11 applies to records that FDA’s regulations require when they are kept electronically in place of paper, or kept both ways with the electronic version relied on. FDA’s own example is a word processor used only to write SOPs, which it says would not be important to validate. Computer systems used in drug manufacture still fall under 211.68.
Does a cloud or SaaS system change what is required?
No. The same controls apply, and the regulated company remains responsible. The written agreement with the provider should set out each party’s responsibilities, including access to data and audit trails, archiving, restoring the validated state and business continuity, and the provider’s evidence can be reused where your assessment supports it.
Is a validated system enough to be GMP compliant?
No. The records it holds must still meet the predicate rules, such as complete laboratory and batch records reviewed by the quality unit, and the procedures around the system must be followed. The MHRA notes that a validated system may lower data integrity risk but does not eliminate it.
What is the difference between Part 11 and Annex 11?
Part 11 is a US regulation for electronic records and signatures that FDA’s rules require. Annex 11 is part of the EU GMP guidelines and covers computerised systems used in GMP work. They overlap on validation, access, audit trails and signatures; Annex 11 also states expectations for risk management, suppliers, periodic evaluation, incidents and business continuity.