What is the difference between 21 CFR Part 11 and EU GMP Annex 11?

1One is a regulation, the other is GMP guidance.

Part 11 is a regulation in Title 21 of the US Code of Federal Regulations. It sets “the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records”. It applies to electronic records created, modified, maintained, archived, retrieved or transmitted under any records requirement in FDA’s regulations, and to electronic records submitted to FDA.¹

Annex 11 is part of the EU guidelines on good manufacturing practice, EudraLex Volume 4. It “provides guidance for the interpretation of the principles and guidelines” of GMP, and its legal basis is Article 47 of Directive 2001/83/EC.² The current text is revision 1, published in January 2011, with a deadline for coming into operation of 30 June 2011.²³ Guidance does not make it optional: Directive (EU) 2017/1572 says that manufacturers and competent authorities “shall take into account” those detailed guidelines when interpreting GMP.⁴

The scopes differ too. Part 11 is about records and signatures, wherever FDA requires a record. Annex 11 “applies to all forms of computerised systems used as part of a GMP regulated activities”, and is about how such a system is specified, validated, run and retired.¹²

2How the two compare.

3Where Part 11 says more.

Part 11 is detailed about signatures. A signed record shows the signer’s printed name, the date and time and the meaning of the signature, such as review or approval (11.50). The signature is linked to its record so it cannot be excised, copied or transferred to falsify a record (11.70). Each signature belongs to one person and is never reused or reassigned, and the organisation verifies the person’s identity before issuing it (11.100). A signature that is not biometric uses at least two components, such as an identification code and a password (11.200), and those codes and passwords are kept unique and periodically checked (11.300).¹ Before or when it starts using electronic signatures, an organisation certifies to FDA, in a certification signed by hand, that they are “intended to be the legally binding equivalent of traditional handwritten signatures”.¹

Part 11 also distinguishes closed systems, where access is controlled by the people responsible for the records, from open systems. An open system adds measures such as document encryption and digital signature standards (11.30).¹

FDA reads Part 11 through its 2003 guidance. It interprets the scope narrowly: Part 11 applies where a record a predicate rule requires is kept electronically instead of on paper, or kept both ways with the electronic version relied on. It exercises enforcement discretion on validation, audit trails, record retention and record copying, and on systems in use before 20 August 1997. It still enforces access limits, operational, authority and device checks, training, accountability for signatures, documentation controls and the signature requirements, and all predicate rules.⁵

4Where Annex 11 says more.

Annex 11 covers the system’s life, not only its records. It expects “close cooperation” between the process owner, system owner, Qualified Persons and IT.² It requires formal agreements with suppliers and service providers that set out their responsibilities, and bases the need for a supplier audit on risk.² It asks for an up-to-date inventory of systems and their GMP functionality, a system description for critical systems, and user requirements specifications based on a documented risk assessment.² When data is migrated, validation checks that values and meaning are not altered.²

In operation, Annex 11 expects a second check, by another person or by validated electronic means, for critical data entered by hand; regular backups whose restore is checked; printouts that show whether data supporting batch release has changed; change and configuration management; periodic evaluation that the system remains valid; incident management with root cause analysis; business continuity arrangements; and archived data that stays readable.² Where a system records batch certification, only Qualified Persons can certify release, using an electronic signature.² A system that replaces a manual operation should not reduce product quality, process control or quality assurance, or increase the overall risk of the process.²

5Where both apply, and what is changing.

Where a record falls under both, a system has to meet both texts. They share the core: validated systems, access limited to authorised people, a record of who entered or changed data and when, and electronic signatures permanently linked to their records.¹²

Annex 11 is being revised. The European Commission consulted on a draft, written by the EMA inspectors’ working group with PIC/S, from 7 July to 7 October 2025, alongside a revised Chapter 4 and a new Annex 22 on artificial intelligence.⁶ The draft would require an audit trail of all manual user interactions that records who, what, when and why, a full re-authentication when a user executes an electronic signature, and a displayed signature showing the signer’s full name, username, meaning, date and time.⁷ It is still a draft: EudraLex Volume 4 lists the January 2011 Annex 11 as of 6 November 2026.³ What the draft revision changes has the detail.

6How it runs in Seal.

Each record in Seal keeps its audit history and electronic signatures, with controls to support 21 CFR Part 11 and EU GMP Annex 11, as set out under Regulatory and validation. An electronic signature retains the signer, the time and the meaning of the approval, linked to the record. The validation guide sets out what qualification should demonstrate in your configured workflow: who created or changed a record and when, the required signatures and authority checks, and the effect of changing an approved record.

Each change runs its tests and earlier work keeps its version. On the platform, failures stay on the record and your team releases the version that passes. No software alone makes an operation compliant: your quality system, configuration, procedures and training remain part of the assessment.