Guidance is Modernizing, Not Replacing Part 11: The core regulations from 1997 remain in place. This new guidance is designed to clarify how to apply those rules to modern technologies that didn’t exist then, like cloud computing, real-world data sources, and digital health tech.
Focus on a Risk-Based Approach: The FDA repeatedly emphasizes that companies should focus their validation and compliance efforts on systems and data that have the highest impact on product quality, patient safety, and data integrity. Not all systems require the same level of rigorous control.
Sponsors are Ultimately Responsible: Even when using third-party vendors for cloud hosting, e-signature services, or data capture, the clinical trial sponsor is ultimately responsible for ensuring those systems and the data within them are Part 11 compliant.
Real-World Data (RWD) is Addressed: The guidance acknowledges that data from sources like Electronic Health Records (EHRs) won’t be Part 11 compliant from the start. Sponsors using this data must still ensure its quality and integrity for regulatory submissions.
Digital Health Technologies (DHTs) are a Key Focus: For data collected directly from patients via phones or smartwatches, the audit trail must be robust. However, the FDA states they do not intend to inspect individual patient devices, but rather the secure, centralized repository where the data is sent.
Clarification on Signatures: A signature drawn on a screen with a stylus or finger is considered a handwritten signature, not an electronic one subject to Part 11’s specific controls (e.g., username/password). True electronic signatures are computer data compilations linked to the record.
Inspection Readiness: During inspections, the FDA will focus on validation documentation, access controls, audit trails, and training. They prefer direct access to electronic systems but will accept certified copies if they contain all the necessary metadata and audit trail information.
