Short answer
What 21 CFR Part 11 actually requires
21 CFR Part 11 is the US FDA regulation that sets the conditions under which electronic records and electronic signatures are treated as equivalent to paper records and handwritten signatures. It was published on 20 March 1997 and took effect on 20 August 1997.[1] It does not decide which records you must keep; the predicate rules do. It applies only when a record that another FDA rule already requires (a predicate rule, such as the drug CGMP rules in 21 CFR 211), or a record submitted to FDA, is created, kept or relied on in electronic form.[1][2]
Three points that are often missed:
- You must certify to FDA that your electronic signatures are the legally binding equivalent of handwritten ones, before or at the time of first use (11.100(c)). A 2023 amendment allows this certification to be sent electronically.[1]
- Since 2003, FDA has applied enforcement discretion to the Part 11 validation, audit-trail, copying and retention clauses. It still expects the same controls through the predicate rules, such as 21 CFR 211.68, and through its 2018 data integrity guidance.[2][3][4]
- The rule text never says “two-factor authentication”, “password complexity”, “session timeout” or “annual training”. Those are good practice, not Part 11 requirements.
Where Part 11 sits inside Title 21 CFR
“Title 21 CFR” is the whole Food and Drugs title of the US Code of Federal Regulations. It has three chapters: Chapter I (FDA), Chapter II (Drug Enforcement Administration) and Chapter III (Office of National Drug Control Policy).[5] “21 CFR compliance” therefore means nothing on its own. An Indian formulation plant exporting to the US usually deals with these FDA parts:
Scroll sideways to see the full table.
| Part | What it covers | Why an exporter meets it |
|---|---|---|
| Part 11 | Electronic Records; Electronic Signatures | Every computerised GMP record and e-signature that a predicate rule requires |
| Part 207 | Establishment registration and drug listing | Foreign sites must register and list the drugs they make for the US market |
| Parts 210, 211 | Current Good Manufacturing Practice (general; finished pharmaceuticals) | The main predicate rules behind most Part 11 records, including 211.68 on computer systems |
| Part 314 | Applications for FDA approval to market a new drug | NDA and ANDA requirements; an application can lead to a pre-approval inspection |
| Part 320 | Bioavailability and bioequivalence requirements | BE studies behind generic filings |
| Part 58 | Good Laboratory Practice for nonclinical laboratory studies | Nonclinical labs only; another predicate rule that brings in Part 11 |
| Part 820 | Quality Management System Regulation | Medical devices only. FDA’s Computer Software Assurance guidance is written for this part |
Does Part 11 apply to this record? A three-question check
Part 11 attaches to records, not to software. “Part 11 compliant software” only means the tool has the features. Whether Part 11 applies depends on which record you keep and how you rely on it. This check follows 11.1(b) and FDA’s 2003 scope guidance.[1][2]
1. Is the record required by an FDA predicate rule (e.g. 21 CFR 211), or submitted to FDA?
2. Which form of the record do you actually rely on?
3. How is the required signature applied?
Answer all three questions to see the verdict
The verdict names the Part 11 sections that apply and the control point an FDA investigator is likely to check first.
This is a screening aid, not a regulatory determination.
21 CFR Part 11, clause by clause: what the text says and what it does not
Each clause is summarised from the current eCFR text.[1] Clauses marked 2003 discretion are those where FDA’s 2003 guidance says it will exercise enforcement discretion under Part 11. They are still enforced through the predicate rules.[2]
11.1(a), (c), (d) Purpose
Sets the criteria for electronic records and signatures to be “trustworthy, reliable, and generally equivalent” to paper. Compliant e-signatures count as full handwritten signatures, and compliant electronic records may replace paper unless paper is specifically required.
11.1(b) What is covered
Electronic records created, modified, maintained, archived, retrieved or transmitted under any FDA records requirement, plus records submitted to FDA under the FD&C Act or PHS Act. It excludes paper records that are, or have been, transmitted electronically.
11.1(e) Inspection access
Hardware, software, controls and attendant documentation must be “readily available for, and subject to, FDA inspection”. This includes your CDS configuration, user lists and validation file.
11.2 Implementation
Records you keep but do not submit may be electronic if Part 11 is met. For submissions, the document type must be one that FDA lists as accepted in electronic form (public docket 92S-0251).
11.3 Definitions that decide the controls
Closed system: access is controlled by the people responsible for the record content. Open system: it is not. An electronic signature is any symbol or series of symbols adopted to be the legally binding equivalent of a handwritten signature. A digital signature is a cryptographic subtype.
Not in the text: any list of “Part 11 systems”. Clauses 11.1(f) to (p) carve out certain food-safety records; none of them concern drugs.
11.10 requires procedures and controls that ensure authenticity, integrity and, where appropriate, confidentiality, and that “the signer cannot readily repudiate the signed record as not genuine”.[1]
(a) Validation 2003 discretion
Validation for accuracy, reliability, consistent intended performance and “the ability to discern invalid or altered records”.
Still required by 211.68 and by FDA’s 2018 guidance, which treats a CGMP workflow as an intended use to be validated.[3][4] See how this fits a validation master plan under Schedule M and Annex 15.
(b) Accurate, complete copies 2003 discretion
Records must be producible in human-readable and electronic form for FDA review and copying.
(c) Record protection 2003 discretion
Accurate and ready retrieval throughout the retention period.
(d) Limited system access
Access limited to authorised individuals.
(e) Audit trail 2003 discretion
Secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify or delete records. Changes must not obscure earlier information. The audit trail is kept at least as long as the record and is available to FDA.
Not in the text: “reason for change”. That expectation comes from FDA’s 2018 guidance (change justification for reprocessing) and from EU Annex 11 clause 9.[4]
(f), (g), (h) Operational, authority and device checks
(f) enforce permitted sequencing of steps. (g) only authorised individuals can use the system, sign, access input/output devices, alter a record or perform the operation. (h) check the validity of the source of data input, as appropriate.
(i) Qualified people
People who develop, maintain or use the system must have the education, training and experience for their tasks.
Not in the text: “annual refresher training”. Frequency is your decision; documented competence is the requirement.
(j) Written accountability policy
A written policy that holds individuals responsible for actions under their electronic signatures, to deter falsification.
(k) Systems documentation (k)(2) 2003 discretion
(1) control the distribution, access and use of system operation and maintenance documentation. (2) revision and change control that leaves a time-sequenced audit trail of documentation changes.
11.30 Open systems
The 11.10 controls “as appropriate”, plus additional measures such as document encryption and digital signature standards, to protect the record from the point of creation to the point of receipt.
Encryption is named only here, for open systems. It is not a stated requirement for a closed system inside your plant network.
11.50 Signature manifestations
A signed record must show (1) the printed name of the signer, (2) the date and time of signing and (3) the meaning, such as review, approval, responsibility or authorship. All three must appear on any display or printout.
11.70 Signature/record linking
Electronic signatures, and handwritten signatures executed to electronic records, must be linked to their records so they cannot be excised, copied or transferred to falsify a record “by ordinary means”.
11.100(a), (b) Uniqueness and identity check
Each e-signature is unique to one person and never reused or reassigned. The organisation verifies the person’s identity before assigning it.
11.100(c) Certification to FDA
Before or at the time of first use, certify to FDA that your e-signatures are intended to be the legally binding equivalent of handwritten signatures. The certification is signed by hand and may be submitted electronically or on paper. This is the 2023 amendment, 88 FR 13018.[1] The rule points to FDA’s Letters of Non-Repudiation Agreement page, which now describes company-wide or individual letters submitted through the ESG NextGen portal.[6]
The earlier version of this page left this clause out entirely. Check that your SOP set covers it.
11.200(a) Non-biometric signatures
At least two distinct identification components, such as an ID code and a password. Within one continuous session, the first signing uses all components; later signings use at least one component known only to the signer. Signings outside a continuous session use all components every time. The signature may be used only by its owner. Misuse by anyone else must require the collaboration of two or more people.
Not in the text: “two-factor authentication” in the modern MFA sense, or “re-authenticate after N minutes”. A user ID plus password satisfies the component count.
11.200(b) Biometric signatures
Designed so that nobody other than the genuine owner can use them.
11.300 ID-code and password controls
(a) no two people share the same ID and password combination. (b) issuances are periodically checked, recalled or revised, for example for password aging. (c) loss management for lost or compromised tokens and cards. (d) transaction safeguards that detect unauthorised use and report it urgently to security and, as appropriate, to management. (e) initial and periodic testing of tokens and cards.
Not in the text: a password length, character mix or expiry period. Set and justify these in your SOP.
Enforcement discretion is not a loophole
FDA’s 2003 guidance, Part 11, Electronic Records; Electronic Signatures: Scope and Application, narrowed how FDA applies Part 11.[2] It says FDA intends to exercise enforcement discretion on validation (11.10(a)), audit trails (11.10(e), (k)(2)), record retention (11.10(c)) and record copying (11.10(b)). It applies the same discretion to all Part 11 requirements for legacy systems that were operational before 20 August 1997 and still meet the predicate rules. FDA continues to enforce access limits, operational, authority and device checks, training, the accountability policy, documentation controls and every electronic-signature requirement.[2]
What this means in a drug plant: 21 CFR 211.68(b) still requires controls so that only authorised personnel change master records, accuracy checks on computer input and output, and a backup file that is “exact and complete” and secure from alteration, erasure or loss.[3] A validation or audit-trail gap is cited under the predicate rule instead of Part 11. It is still a 483 observation.
The 2003 guidance also recommends deciding in advance, and recording in an SOP, whether the paper or the electronic version of each required record is the one relied on. If an electronic record is in fact used for regulated activities, FDA may treat it as the record even when a printout exists.[2]
Part 11 in an Indian QC lab: six points from FDA’s data integrity guidance
For a formulation exporter, most Part 11 exposure sits in the QC lab: chromatography data systems, UV and IR software, dissolution, balances that send data to a LIMS. FDA’s Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018) sets out FDA's current thinking on these points.[4] It applies the ALCOA principles; see how ALCOA, ALCOA+ and ALCOA++ differ by regulator.
1. No shared logins that can change data
With shared credentials “a unique individual cannot be identified”. Only shared read-only accounts are acceptable.
DI Q&A, Q5[4]
2. Audit trails reviewed with the record
Whoever reviews the record reviews its audit trail, at the frequency the CGMP rule sets for that data. Examples are each significant step (211.188(b)) and before batch release (211.22). Elsewhere, set the frequency by risk assessment.
DI Q&A, Q7 and Q8[4]. See the 20-point batch record review.
3. A chromatogram printout is not the original
A static printout “does not preserve the dynamic record format”. For HPLC and GC data the electronic record, with its metadata, must be kept.
DI Q&A, Q10[4]
4. No trial injections of actual samples
FDA calls it a violative practice to use an actual sample in test, prep or equilibration runs. System suitability should use a characterised secondary standard. If a sample is used, it must come from a different batch.
DI Q&A, Q13[4]
5. Backup means a true copy
A backup under 211.68(b) is a true copy kept securely for the retention period. “Temporary backup copies” made in case of a crash do not satisfy it.
6. E-signatures can replace “full signature, handwritten”
Electronic signatures with appropriate controls can be used where 211.186(a) asks for a handwritten signature on master records. The controls that identify the signer must be documented.
DI Q&A, Q11[4]
Part 11 vs EU Annex 11 vs Revised Schedule M
An Indian site supplying the US, the EU and the domestic market answers to all three. They overlap, but they are not the same document, and only Part 11 asks you to certify anything to the regulator.
Scroll sideways to see all three columns.
| Topic | 21 CFR Part 11 (US) | EU GMP Annex 11 (2011) | Revised Schedule M (India) |
|---|---|---|---|
| Legal form | Federal regulation, effective 20 Aug 1997[1] | EU GMP guideline, in operation since 30 Jun 2011[7]. A revised draft went to consultation from 7 Jul to 7 Oct 2025[8] | Schedule M under the Drugs Rules, 1945, substituted by G.S.R. 922(E) of 28 Dec 2023. Computerised systems are in Part I, section 20[9] |
| Validation | 11.10(a), under 2003 discretion; 211.68 still applies | Clause 4: risk-based, with a system inventory and user requirements | 20.1 to 20.3: validate; IQ and OQ; less testing for qualified commercial software; retrospective validation allowed for legacy systems |
| Audit trail | 11.10(e): computer-generated, time-stamped, retained as long as the record | Clause 9: built in “based on a risk assessment”; reason for a change or deletion documented | 20.4: a record of each change, the previous entry, who made it and when |
| Manual entry check | Not in Part 11; 211.68(b) requires input/output accuracy checks | Clause 6: an additional check for critical manual entries | 20.6: an additional accuracy check by a second operator or the system |
| Electronic signature | Subpart C in full detail, plus certification to FDA (11.100(c)) | Clause 14: same impact as handwritten within the company, permanently linked, with time and date | No dedicated clause; 17.3.9.3 allows “signature or electronic password” on batch packaging records |
| Backup | 11.10(c) retrieval; 211.68(b) backup file | Clause 7: regular backups, restore checked | 20.9: back-up so records are never permanently lost; 17.2.8 for electronic batch records |
| Periodic review | Not stated (11.300(b) covers password reissue only) | Clause 11: periodic evaluation | Not stated in section 20; 20.8 requires changes to keep the validated state |
| Suppliers and incidents | Not stated in Part 11 | Clause 3 (suppliers) and clause 13 (incidents, root cause, CAPA) | 20.3 (commercial software) and 20.7 (incidents recorded and investigated) |
| Certification to the regulator | Yes | No | No |
Status as at 17 Oct 2026. Revised Schedule M is in the enforcement phase. MSMEs that applied for an extension had until 31 Dec 2025, and in November 2025 the DCGI asked state regulators to plan inspections and report monthly.[10] Track it on the Revised Schedule M compliance dashboard. For EU Annex 11, the European Commission consultation page shows the 2025 revision (together with Chapter 4 and a new Annex 22 on AI) as closed, with no final adoption stated. Check before relying on the 2011 text for an EU inspection.[8] Two further data integrity references sit alongside these: WHO TRS 1033 Annex 4 (2021), and PIC/S PI 041-1 (in force 1 Jul 2021), which PIC/S wrote primarily for inspectors.[11][12]
What has changed, and what is often misreported
2023: certification can be electronic
88 FR 13018 amended 11.100(c) so that the signed certification can be submitted electronically or on paper.[1][6]
CSA guidance is for devices
FDA’s Computer Software Assurance for Production and Quality Management System Software was finalised on 24 Sep 2025 and reissued on 3 Feb 2026 to align with the QMSR. It is a CDRH/CBER guidance for 21 CFR 820. It does not cover drug CGMP under Part 211, and it does not amend Part 11.[13]
Clinical e-systems Q&A is final
Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations was finalised in October 2024, replacing the 2007 computerised-systems guidance. It covers IT service providers, including cloud, and recommends written agreements.[14]
AI guidance is a draft on model credibility
FDA’s January 2025 AI guidance for drugs and biologics is a draft. It sets a risk-based credibility framework for AI outputs used in regulatory decisions. It is not a Part 11 validation standard.[15]
We found no FDA “cloud computing guidance” for Part 11. The earlier version of this page cited one. The nearest real document is the IT service provider section of the 2024 clinical Q&A above.
When an investigator finds a Part 11 gap
For a foreign site, the consequence that matters most is commercial. A firm whose drugs are found not to meet drug GMPs can be placed on Import Alert 66-40, “Detention Without Physical Examination of Drugs From Firms Which Have Not Met Drug GMPs”.[16] FDA has said since September 2009 that it will generally allow 15 business days for a Form 483 response before a warning letter, and will not ordinarily delay a warning letter for a later response.[17] Use the 15-business-day Form 483 response checklist, and check your lab against the 10 most-cited 483 observations before the inspection.
FDA’s 2018 guidance (Q18) sets out what remediation of a data integrity failure should show: an investigation of scope and root cause, a scientifically sound risk assessment that includes the impact on submitted data, and a management strategy with a global corrective action plan.[4]
Next step: map Part 11 into your US filing plan
Part 11 readiness is one piece of a US filing plan that also covers DUNS, the US agent, site registration and the ANDA. The roadmap sets out that sequence for an Indian formulation plant.
Read the USFDA approval roadmap for Indian plants21 CFR Part 11: questions QA teams ask
Yes, if the site supplies the US and the chromatography data supports a CGMP decision such as release or stability. The data is required by 21 CFR 211, and FDA’s 2018 data integrity guidance says a printout does not preserve the dynamic electronic record, so the electronic record is kept and relied on. Standalone PCs need unique logins, an enabled audit trail and a validated backup, the same as networked systems.
Yes. Section 11.200(a)(1) requires at least two distinct identification components, such as an identification code and a password. In one continuous session the first signing uses both; later signings use at least one private component. The signature must also show the printed name, date and time, and meaning under 11.50, and must be linked to the record under 11.70.
Yes. Section 11.100(c) requires a certification to FDA, before or at the time of first use, that your electronic signatures are intended to be the legally binding equivalent of handwritten signatures. It is signed by hand and, since the 2023 amendment, may be sent electronically or on paper. The rule refers to FDA’s Letters of Non-Repudiation Agreement page for where to submit it.
Under Part 11 itself, FDA’s 2003 scope guidance says it intends to exercise enforcement discretion on validation, audit trails, record copying and retention. The same expectations are enforced through the predicate rules: 21 CFR 211.68 requires controls over computer systems, input and output checks and an exact backup, and FDA’s 2018 data integrity guidance expects validated workflows and audit-trail review.
Not directly. The CSA guidance, finalised in September 2025 and reissued in February 2026, is issued by CDRH and CBER for production and quality management system software under the device rule, 21 CFR 820. Drug plants may borrow its risk-based thinking, but their validation obligations still come from 21 CFR 211 and Part 11.
Partly. Part I, section 20 of Revised Schedule M (G.S.R. 922(E), 28 December 2023) covers computerised system validation, access control, a record of data changes, manual entry checks, incidents, change control and backup, and section 17.2.8 covers electronic documentation. It has no detailed electronic-signature subpart and no certification to the regulator, so a US-exporting site must meet Part 11 on top.
At least as long as the electronic record it relates to. Section 11.10(e) says audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records, and shall be available for FDA review and copying. The retention period itself comes from the predicate rule. For batch records under 21 CFR 211.180(a), that is at least one year after the batch expiry date.
Related on laafon.com
References
- U.S. Food and Drug Administration. 21 CFR Part 11 – Electronic Records; Electronic Signatures. 62 FR 13464, 20 Mar 1997, as amended including 88 FR 13018, 2 Mar 2023. Electronic Code of Federal Regulations, current to 14 Oct 2026. Available from: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11. Accessed Oct 2026.
- U.S. Food and Drug Administration. Guidance for Industry. Part 11, Electronic Records; Electronic Signatures – Scope and Application. Rockville (MD): FDA; Sep 2003. Docket FDA-2003-D-0143. Available from: https://www.fda.gov/media/75414/download. Accessed Oct 2026.
- U.S. Food and Drug Administration. 21 CFR 211.68 – Automatic, mechanical, and electronic equipment. Electronic Code of Federal Regulations. Available from: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-D/section-211.68. Accessed Oct 2026.
- U.S. Food and Drug Administration. Data Integrity and Compliance With Drug CGMP: Questions and Answers. Guidance for Industry. Silver Spring (MD): FDA; Dec 2018. Docket FDA-2018-D-3984. Available from: https://www.fda.gov/media/119267/download. Accessed Oct 2026.
- Office of the Federal Register. Title 21 – Food and Drugs. Electronic Code of Federal Regulations. Available from: https://www.ecfr.gov/current/title-21. Accessed Oct 2026.
- U.S. Food and Drug Administration. Letters of Non-Repudiation Agreement (ESG NextGen). Available from: https://www.fda.gov/industry/getting-started-esg-nextgen/letters-non-repudiation-agreement. Accessed Oct 2026.
- European Commission. EudraLex Volume 4, EU Guidelines for Good Manufacturing Practice, Annex 11: Computerised Systems. Brussels; 2011 (in operation 30 Jun 2011). Available from: https://health.ec.europa.eu/system/files/2016-11/annex11_01-2011_en_0.pdf. Accessed Oct 2026.
- European Commission. Stakeholders’ consultation on EudraLex Volume 4 – Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and new Annex 22. 7 Jul to 7 Oct 2025. Available from: https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en. Accessed Oct 2026.
- Ministry of Health and Family Welfare, Government of India. G.S.R. 922(E), 28 Dec 2023: Schedule M – Good Manufacturing Practices and Requirements of Premises, Plant and Equipment for Pharmaceutical Products, Part I sections 17 and 20. Gazette of India, Extraordinary. Listed at: https://cdsco.gov.in/opencms/opencms/en/Notifications/Gazette-Notifications. Text read from a reproduction of the notified gazette. Accessed Oct 2026.
- Business Standard. Pharma units likely to face action for Schedule M violations: Experts. 8 Nov 2025 (trade press, reporting the DCGI directive of 7 Nov 2025). Available from: https://www.business-standard.com/industry/news/cdsco-asks-state-units-to-start-inspections-under-schedule-m-norms-125110801170_1.html. Accessed Oct 2026.
- World Health Organization. Guideline on data integrity. WHO Technical Report Series, No. 1033, Annex 4. Geneva: WHO; 2021. Available from: https://www.who.int/publications/m/item/annex-4-trs-1033. Accessed Oct 2026.
- Pharmaceutical Inspection Co-operation Scheme. PI 041-1: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. Geneva: PIC/S; adopted 1 Jun 2021, in force 1 Jul 2021. Available from: https://picscheme.org/en/news/adoption-and-entry-into-force-of-pics-guidance-on-good-pract. Accessed Oct 2026.
- U.S. Food and Drug Administration (CDRH, CBER). Computer Software Assurance for Production and Quality Management System Software. Guidance for Industry and FDA Staff. Feb 2026 (supersedes the version of 24 Sep 2025). Available from: https://www.fda.gov/media/188844/download. Accessed Oct 2026.
- U.S. Food and Drug Administration. Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers. Guidance for Industry, Revision 1. Oct 2024. Docket FDA-2017-D-1105. Available from: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-systems-electronic-records-and-electronic-signatures-clinical-investigations-questions. Accessed Oct 2026.
- U.S. Food and Drug Administration. Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products. Draft Guidance for Industry. Jan 2025. Available from: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological. Accessed Oct 2026.
- U.S. Food and Drug Administration. Import Alert 66-40: Detention Without Physical Examination of Drugs From Firms Which Have Not Met Drug GMPs. Last published 1 Oct 2026. Available from: https://www.accessdata.fda.gov/cms_ia/importalert_189.html. Accessed Oct 2026.
- U.S. Food and Drug Administration. Notice on the review of post-inspection responses (Form 483). Federal Register. 2009 Aug 11;74(153). Document E9-19107. Available from: https://www.govinfo.gov/content/pkg/FR-2009-08-11/html/E9-19107.htm. Accessed Oct 2026.
This page is technical and educational content for pharmaceutical quality and regulatory professionals. It is not legal, medical or investment advice, and it is not a regulatory determination for any specific system. US regulations, FDA guidance, EU GMP annexes and Indian statutory instruments change frequently; confirm the current text with the issuing authority before acting on it.
