What is 21 CFR Part 11, and what does it require?

21 CFR Part 11 is the FDA regulation that establishes criteria for the trustworthiness and reliability of electronic records and electronic signatures used in FDA-regulated activities. Its practical requirements include appropriate system controls, record integrity, access management, audit trails, and safeguards for electronic signatures. Exactly which controls apply depends on the underlying recordkeeping rules and how the organization actually uses the records. [1]

This guide explains Part 11 for quality, operations, maintenance, calibration, and validation teams. It also discusses hybrid workflows in which the official detailed calibration record is retained on paper while a computerized maintenance management system (CMMS) schedules work and tracks outcomes. Such an approach can avoid unnecessary duplicate data entry, but it requires a defensible assessment of the electronic information that remains important to GxP decisions.

Who and which records does 21 CFR Part 11 apply to?

Part 11 applies to persons who choose to use electronic records or signatures within the regulation's scope. The starting point is the predicate rule: the applicable FDA law or regulation that requires a record or signature. Part 11 generally covers required records maintained electronically instead of on paper, required records maintained electronically alongside paper when the electronic version is relied on to perform regulated activities, qualifying electronic submissions to FDA, and electronic signatures used in place of required handwritten signatures. [2]

Not every item stored in a computer is automatically a Part 11 record. Conversely, calling a paper copy the “official record” does not take an electronic record out of scope when personnel actually rely on the electronic version for a regulated decision. The FDA recommends documenting which version of each required record the organization intends to rely upon. Paper and electronic record components can coexist if the applicable predicate requirements are satisfied and the record's content and meaning are preserved. [2]

Recordkeeping arrangement	Part 11 consideration
Official electronic calibration measurements and approval	Evaluate the electronic results, related changes, and any electronic signings against applicable Part 11 requirements.
Complete official paper calibration record; electronic copy kept only for reference	The reference copy does not automatically become a Part 11 record. Confirm that personnel actually rely on the paper record to meet the predicate rule.
Paper measurements with electronic Pass/Fail or equipment status	Assess the electronic outcome and status separately, particularly if they are relied upon to authorize equipment use.

For each record type, identify the predicate requirement, the official record, the point of approval, the retained original or acceptable true copy, and the information used to make GxP decisions.

What counts as an electronic record and an electronic signature under Part 11?

Under § 11.3, an electronic record is information in digital form created, modified, maintained, archived, retrieved, or distributed by a computer system. Part 11 applicability is narrower than that broad technical definition: the record must also fall within the regulatory scope described above. [1]

An electronic signature is a computer data compilation of symbols executed, adopted, or authorized by an individual as the legally binding equivalent of a handwritten signature. A login, saved username, audit-trail entry, or routine data entry is not automatically an electronic signature. The signing action must have a defined purpose and satisfy the applicable signature controls. [1]

Example	What to establish
Electronic calibration result	Whether it is the regulated result of record or merely a secondary reference.
Electronic approval of a work order	Whether that action replaces a required handwritten signature and what the approval means.
Scanned signed paper certificate	Whether the original paper is retained and relied upon, or the scan is maintained as an official electronic record.
User identified in a change history	Whether the entry merely establishes attribution or documents an intentional, legally significant signing.

What does Part 11 require for closed and open systems?

A closed system is one in which system access is controlled by the persons responsible for the content of the electronic records. Section 11.10 establishes controls for applicable closed systems, including validation, accurate copies, record protection and retrieval, access restrictions, audit trails, operational checks, authority checks, appropriate device checks, qualified personnel, signature-accountability policies, and controlled system documentation. [3]

An open system is one where access is not controlled by the persons responsible for the electronic-record content. Section 11.30 calls for controls corresponding to those for closed systems plus additional safeguards, such as document encryption and appropriate digital-signature standards, as necessary to protect authenticity, integrity, and confidentiality. [10]

Cloud hosting does not automatically make a system “open.” The distinction depends on the actual control of access and responsibility for the records, not simply whether the servers are located at a supplier's site. In either arrangement, the customer and software provider should document their respective responsibilities for account administration, backups, incidents, configuration changes, data retrieval, and system exit.

Control area	Practical evaluation question
Authorized access and authority checks	Who may create, modify, approve, or release GxP-relevant records and statuses?
Record protection and retrieval	Can required records, context, and history be retained and retrieved throughout the required period?
Operational controls	Does the configured workflow enforce necessary sequencing and prevent inappropriate actions?
Supplier and customer responsibilities	Which party administers access, tests changes, manages backups, and supports recovery?

What are the 21 CFR Part 11 audit trail requirements?

Section 11.10(e) describes secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify, or delete in-scope electronic records. Changes must not obscure previously recorded information, and applicable audit-trail documentation must be retained at least as long as the associated electronic record and be available for FDA review and copying. [3]

A useful test is to correct a record and then retrieve its history. The reviewer should be able to distinguish the earlier information from the correction and understand who took the action and when. For higher-risk changes, procedures may also require a documented reason and independent review. FDA's drug CGMP data-integrity guidance discusses expectations for reconstructing significant events and assessing audit-trail information. [4]

Part 11 does not set one universal audit-trail review frequency. Define review responsibilities and timing based on the predicate rules, intended use, and risk. The FDA's 2003 Part 11 guidance describes enforcement discretion for specified audit-trail provisions, but this does not eliminate predicate-rule or data-integrity obligations. [2]

In a hybrid calibration process, distinguish corrections made to the official signed paper record from changes to the CMMS's electronic Pass/Fail outcome or equipment status. If electronic status drives release decisions, its history warrants particular attention even when the individual measurements are on paper.

What are the Part 11 requirements for electronic signatures?

When an electronic signature replaces a signing required by an applicable predicate rule, evaluate the complete signing process—not just the presence of a username and password.

Identity and uniqueness (§ 11.100): each electronic signature must be unique to one person; identity must be verified before authorization; and the organization must provide the specified certification to FDA that its electronic signatures are intended as legally binding equivalents of handwritten signatures. [5]
Visible meaning (§ 11.50): signed electronic records must show the signer's printed name, signing date and time, and meaning (such as review or approval) in human-readable displays and printouts. [6]
Execution controls (§ 11.200): non-biometric signatures must employ at least two distinct identification components and comply with applicable controls for first and subsequent signings and signature ownership. These requirements should not be confused with a universal requirement for a particular modern multifactor-authentication method. [7]
Credentials (§ 11.300): identification codes and passwords require specified uniqueness, maintenance, loss management, and safeguards against unauthorized use. [8]
Record linkage (§ 11.70): signatures must be linked to their records so they cannot be removed, copied, or transferred by ordinary means to falsify a record. [9]

If the required approval is signed by hand on an official paper record, scanning that signed page into a CMMS for reference does not, by itself, turn the handwritten signature into a Part 11 electronic signature. However, a separate electronic approval used to fulfill a regulated signing requirement must be assessed independently.

How does Part 11 relate to data integrity and ALCOA+?

Part 11 provides controls for certain electronic records and signatures; data integrity is broader and applies to records and information used in regulated work, whether electronic, paper, or hybrid. FDA's drug CGMP guidance defines data integrity in terms of completeness, consistency, and accuracy and describes the ALCOA principles. [4]

ALCOA+ characteristic	Practical meaning
Attributable	The person or system responsible for a recorded action can be identified.
Legible	Information remains understandable and retrievable.
Contemporaneous	Events are recorded when they occur, not reconstructed later without justification.
Original	Original information or a justified true copy is preserved.
Accurate	Recorded information correctly reflects the activity and any corrections are controlled.
Complete, Consistent, Enduring, Available	The commonly used “+” principles emphasize the full record, logical chronology, durable retention, and access when needed.

ALCOA+ is an industry shorthand for good data-integrity practice, not a separate section of Part 11. For instance, a signed paper calibration worksheet can be the authoritative record of individual measurements while an electronic Pass/Fail summary is used for scheduling and status. Both parts of that workflow still need appropriate controls against loss, mistaken entry, untraceable corrections, and inconsistent conclusions.

How is a 21 CFR Part 11 compliant system validated?

Validation should establish, using documented evidence, that a computerized system performs its intended GxP functions reliably in the customer's actual configuration and process. Section 11.10(a) calls for validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. FDA's 2003 guidance states enforcement discretion concerning this specific Part 11 provision while emphasizing applicable predicate-rule validation obligations and a justified, risk-based approach. [3] [2]

A practical validation lifecycle generally covers the following activities:

Define intended use: identify GxP-relevant workflows, predicate rules, record types, users, interfaces, and decisions.
Assess risk: determine where failures could affect product quality, patient safety, record integrity, or equipment disposition.
Specify and configure: document applicable user requirements, roles, workflows, and system settings.
Gather supplier evidence: assess available development, testing, change-control, security, and support documentation for the system.
Verify the implementation: test high-risk scenarios, permissions, electronic record changes, relevant audit trails, approvals, retrieval, and exception handling.
Maintain the validated state: control changes, train users, manage incidents, and periodically review the implementation according to risk.

For a CMMS, representative tests might include entering and correcting a calibration Pass/Fail result, restricting who can change equipment status, retrieving an attachment or original record, and verifying that failed equipment cannot be released contrary to the documented process. A supplier's software qualification package can support—but does not replace—the customer's intended-use assessment and implementation evidence.

How does the FDA enforce Part 11 today?

Part 11 remains in effect. FDA's September 2003 scope-and-application guidance explains a narrow interpretation of the regulation and identifies enforcement discretion for specified Part 11 provisions addressing validation, audit trails, record retention, record copying, and certain legacy-system circumstances. The guidance also states that FDA expects compliance with other applicable Part 11 requirements and will continue to enforce predicate rules. [2]

Therefore, enforcement discretion should not be presented as a blanket exemption from Part 11, validation, record security, or data integrity. FDA inspectors may assess whether required records are complete, accurate, readily available, properly authorized, and supported by the relevant GxP controls. FDA's separate drug CGMP data-integrity guidance remains important when electronic systems influence manufacturing or quality decisions. [4]

For inspection readiness, retain the rationale for record-of-record designations, the system's intended use, supporting validation or qualification, SOPs, training, change history, and a practical way to retrieve original records and required supporting information. This article describes the FDA guidance available as of November 2026; it does not substitute for checking the applicable predicate rules for a particular operation.

What is the difference between 21 CFR Part 11 and EU Annex 11?

Both address trustworthy computerized GxP processes, but they arise from different regulatory frameworks. 21 CFR Part 11 is an FDA regulation centered on electronic records and electronic signatures within its defined scope. EU GMP Annex 11 is part of the European Union's GMP guidance for computerized systems used in GMP activities; it addresses broader system lifecycle topics such as personnel, suppliers, validation, data management, security, periodic evaluation, and business continuity. [1] [13]

Topic	21 CFR Part 11	EU GMP Annex 11
Primary emphasis	Criteria for electronic records and signatures used within FDA regulatory scope.	Risk-based management of computerized systems supporting EU GMP activities.
Validation	System validation provisions, read with FDA's stated enforcement discretion and any predicate-rule duties.	Lifecycle validation, appropriate risk management, and documented suitability for intended use.
Suppliers and operations	Relevant controls and documentation are required or evaluated according to scope and predicate rules.	Express expectations for supplier/service provider assessment, periodic evaluation, incident management, and continuity.
Signatures and records	Specific electronic signature identity, execution, manifestation, and record-linkage provisions.	GMP expectations for electronic signatures and the integrity, availability, and management of records.

Current-version note: The European Commission's official EudraLex Volume 4 page still lists the January 2011 Annex 11 as the applicable version. A substantially revised Annex 11 was issued for public consultation in 2025, but the consultation draft should not be represented as the final effective text. Multinational organizations should monitor the official EU publication and assess each applicable framework rather than assuming compliance with one automatically establishes compliance with the other. [13] [14]

What does a 21 CFR Part 11 compliance checklist include?

A useful checklist begins with applicability and then tests the actual workflow. The following questions are an assessment aid, not a substitute for reading the regulation and the applicable predicate requirements.

Assessment item	Evidence or question to resolve
Record scope	Which FDA rule requires each record? Is the official version paper, electronic, or hybrid? What is actually relied upon?
Intended use and validation	Are GxP functions, risks, requirements, configuration, tests, and changes documented?
Access and authority	Do individual credentials and role permissions prevent unauthorized entry, modification, or approval?
Record integrity and audit history	Are applicable original entries and corrections attributable, protected, and retrievable?
Electronic signatures	If used for regulated signings, are identity, manifestation, execution, credential, and linkage requirements addressed?
Retention, copying, and recovery	Can complete records and required metadata be retained, restored, inspected, and exported for the predicate-rule retention period?
Procedures and training	Do SOPs cover record ownership, correction, review, administration, incidents, and user accountability?
Supplier oversight and changes	Are responsibilities, service changes, backup arrangements, and exit provisions understood?

The strongest checklist follows one representative record from creation through correction, review, use, retention, and retrieval. A system feature list or vendor claim of “Part 11 compliance” is not proof that the customer's configured process meets every applicable requirement.

How does Part 11 apply to maintenance and calibration records?

For maintenance and calibration, the distinction between detailed official records and electronic workflow information can materially affect the compliance scope. A system that captures original calibration readings, tolerances, adjustments, and approvals electronically is a different case from a system that retains the signed measurements on paper and electronically tracks the activity's completion and outcome.

GxPReady hybrid calibration example. A technician performs a balance calibration and documents individual measurements, acceptance criteria, any corrections, and required handwritten review or approval in the official hardcopy record. In GxPReady, the technician records the calibration result as Pass or Fail; individual calibration measurements are not entered into GxPReady. A scan of the signed record can be attached for convenient reference. This avoids re-entering the measurements and can make routine updates faster. [11]

If the complete paper record meets the predicate rule and personnel genuinely rely upon it for regulated decisions, the scan used solely as a reference does not automatically become an in-scope Part 11 record. However, GxPReady's electronic Pass/Fail result, equipment status, or approval may still be GxP-critical. Each requires a separate intended-use assessment, particularly if equipment is released, withheld, or scheduled based on that information. Merely labeling the paper copy “official” is not enough if actual practice relies on electronic results. [2]

The same principle applies to maintenance: determine where the official work performed, findings, parts or adjustments, disposition, and approvals are recorded. If maintenance work orders, completion records, or equipment availability are maintained and relied upon electronically under applicable predicate requirements, assess those records and functions accordingly. A documented paper-based process may have a different Part 11 scope, but it does not eliminate the need for appropriate controls over GxP-relevant electronic status.

GxPReady supports equipment inventory, calibration, maintenance, validation, and regulated workflow tracking. Its Quality & Trust Center describes security, audit-trail, and record-management features. Its Flash Validation methodology can help support qualification of a configured implementation; customer-specific intended use, procedures, and verification remain necessary. For details, see GxPReady's Part 11 software guidance or contact GxPReady. [11] [12]

References

What is 21CFR11 and What Does it Require?