21 CFR Part 11 (Electronic Records; Electronic Signatures)

21 CFR Part 11 sets the criteria under which the FDA accepts electronic records and electronic signatures as equivalent to paper records and handwritten signatures, provided they are trustworthy, reliable, and compliant with applicable predicate rules (e.g., CGMP, GLP, GCP). It enables the use of electronic systems while ensuring data integrity through both technical and procedural controls.

In practice, 21 CFR Part 11 allows FDA-regulated firms to adopt electronic systems in place of paper, provided they validate systems, secure access, and maintain auditability to ensure electronic records and signatures are trustworthy and equivalent to traditional paper processes.

Scope: Applies when records required by FDA regulations (‘predicate rules’ such as cGMP, GLP, GCP) are maintained electronically in place of paper.

• Covers all electronic signatures intended as legal equivalents to handwritten signatures. FDA’s 2003 Guidance on Scope and Application clarified that enforcement focuses on records relied upon to meet FDA requirements (e.g., audit trails, validation, security), with enforcement discretion applied to other aspects.

Core Principle: Data Integrity: Part 11 aligns with industry’s ALCOA+ expectations (Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available), though these are drawn from broader GxP practice rather than codified directly in the rule.

Key Controls for Electronic Records (Subpart B)

• System Validation: Demonstrate reliable and consistent performance.
• Audit Trails: Secure, time-stamped, computer-generated logs of record creation, modification, or deletion.
• Access Controls: Limit system access to authorized individuals.
• Record Retrieval: Generate accurate, complete copies in both human-readable and electronic formats for FDA inspection.

Key Controls for Electronic Signatures (Subpart C)

• Uniqueness: One signature per individual, not reusable or transferable.
• Authentication: Typically two factors (username + password) or biometric identification.
• Linking: Signature permanently linked to its record; falsification must be detectable.
• Meaning: Include name, date/time, and purpose (e.g., approval, review).