21 CFR Part 11 on one page, and what the popular infographics get wrong

Every few weeks a Part 11 poster does the rounds on professional networks: a few bold lines, a list of six qualities, thousands of reposts. Most of it is roughly right. Four or five lines are wrong in ways that matter the day you write a user requirement, argue with a supplier or answer an inspector.

Here is the rule itself on one page, followed by the claims that keep circulating, set against what the text says. When Part 11 applies at all (the predicate-rule question) is a separate subject, left aside here.

Where Part 11 sits in the rulebook

The Code of Federal Regulations (CFR) has 50 titles. Title 21, Food and Drugs, holds three chapters. Chapter I is the US Food and Drug Administration (FDA), parts 1 to 1299; chapter II the Drug Enforcement Administration (DEA), parts 1300 to 1399; chapter III the Office of National Drug Control Policy, parts 1400 to 1499.

FDA’s chapter is not “the pharmaceutical and medical device title”. Its subchapters run from food and colour additives to drugs, animal drugs and feed, biologics, cosmetics, devices, radiological health and tobacco.

Part 11 sits in Subchapter A, General, and that position is the point. It is a horizontal rule that applies across every product area FDA regulates, except the food-safety records that §11.1(f) to (p) excluded between 2004 and 2021.

Two habits are worth correcting. The citation is 21 CFR Part 11, or 21 CFR 11.10 for a section, title number first. And an Act is not a regulation. The Federal Food, Drug, and Cosmetic Act (FD&C Act), whose section 505 governs new drug applications, and the Public Health Service Act, whose section 351 governs biologics, are laws passed by Congress. The CFR parts implement them, and a guidance only explains how FDA reads them.

Part 11 on one page

The rule was published on 20 March 1997 (62 FR 13430) and took effect on 20 August 1997. Three subparts, ten sections.

The controls have not been rewritten since 1997. Only two things moved. §11.1 gained the food-record exclusions (f) to (p) between 2004 and 2021, and §11.100(c)(1) was updated on 2 March 2023 (88 FR 13018), so the certification letter may now be sent electronically or on paper.

The ten sections in plain words

§11.1 Scope. Sets the criteria under which FDA considers electronic records, electronic signatures and handwritten signatures executed to electronic records “trustworthy, reliable, and generally equivalent” to paper. It covers records kept under an FDA records requirement and records submitted to the agency. Paragraph (e) adds that computer systems, controls and documentation are “readily available for, and subject to, FDA inspection”.

§11.2 Implementation. For records you keep, electronic may replace paper if Part 11 is met. For records you submit, the same, and the document type must be listed in public docket No. 92S-0251 as one FDA accepts electronically.

§11.3 Definitions. Nine terms: the Act, the agency, biometrics, closed system, digital signature, electronic record, electronic signature, handwritten signature and open system. An electronic signature is “a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual’s handwritten signature”. A digital signature is narrower: an electronic signature based on cryptographic methods.

§11.10 Controls for closed systems. The eleven controls listed further down, all aimed at authenticity, integrity and, when appropriate, confidentiality, and at making sure “the signer cannot readily repudiate the signed record as not genuine”.

§11.30 Controls for open systems. The same aims, from the point of creation to the point of receipt, using the §11.10 controls as appropriate plus measures such as document encryption and appropriate digital signature standards.

§11.50 Signature manifestations. A signed record shows the printed name of the signer, the date and time of signing, and the meaning of the signature, in every human-readable form of the record, on screen and on paper.

§11.70 Signature/record linking. Signatures are linked to their records so that they cannot be “excised, copied, or otherwise transferred” to falsify a record by ordinary means.

§11.100, §11.200, §11.300. Signatures unique to one person and never reassigned, with identity verified before issue and a certification letter to FDA; at least two distinct components, with the continuous-session rule; the controls on identification codes and passwords. These three are a subject of their own, and they are where most signature findings start.

The eleven controls of §11.10, and what each one means on site

• (a) Validation: accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
• (b) Copies: accurate and complete copies, in human-readable and electronic form, for FDA inspection, review and copying.
• (c) Protection of records: accurate and ready retrieval throughout the retention period. The retention period itself comes from the predicate rule.
• (d) Access limited to authorised individuals. This is where shared logins fail.
• (e) Audit trails: secure, computer-generated, time-stamped, recording the date and time of operator entries and actions that create, modify or delete records. Changes must not obscure what was recorded before, and the audit trail is kept at least as long as the record.
• (f) Operational system checks: the system enforces the permitted sequence of steps and events, rather than a procedure taped to the side of the screen.
• (g) Authority checks: only authorised people can use the system, sign, access an input or output device, alter a record, or perform the operation at hand.
• (h) Device checks: the validity of the source of a data input or an operational instruction, where appropriate. Which terminal, which instrument, which interface.
• (i) Education, training and experience of the people who develop, maintain or use the systems.
• (j) Written policies that hold people accountable for actions taken under their electronic signatures, “in order to deter record and signature falsification”.
• (k) System documentation controls: distribution, access and use of the operating and maintenance documentation, and revision and change control with a time-sequenced audit trail of that documentation.

The words the rule uses, and the ones it does not

Posters usually list six qualities in a row: authenticity, reliability, integrity, confidentiality, accuracy, trustworthiness. The text keeps them apart, and the distinction has consequences.

• Trustworthy, reliable and generally equivalent to paper records and handwritten signatures is the purpose of the rule (§11.1(a)). Equivalence is its legal effect: it is what lets an electronic signature stand in for a full handwritten one.
• Authenticity, integrity and (“when appropriate”) confidentiality are the aims of the closed-system controls (§11.10). Confidentiality is conditional. Write it into a requirement as absolute and you will spend meetings arguing about encrypting batch records, which the rule never asked for.
• Non-repudiation sits in the same sentence and is usually missing from the posters: the controls must ensure “that the signer cannot readily repudiate the signed record as not genuine”.
• Accuracy and reliability are what validation must deliver (§11.10(a)), together with consistent intended performance and the ability to discern invalid or altered records.

Closed and open is not about the network

A closed system is “an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system” (§11.3(b)(4)). An open system is the same sentence with not in it.

What decides is who controls access, not where the server stands. A hosted application whose accounts the regulated company creates, reviews and removes is not automatically open. A machine in your own building with a supplier account nobody manages is not automatically closed. Open systems carry the §11.10 controls plus encryption and digital signature standards as appropriate, from creation to receipt, so the classification belongs in the validation plan, with its reasoning.

What FDA enforces, and where it uses discretion

The August 2003 guidance Part 11, Electronic Records; Electronic Signatures — Scope and Application narrowed both the scope of the rule and the enforcement of some controls. It is still the operative interpretation.

Discretion is not permission. FDA recommends basing decisions on validation and audit trails on “a justified and documented risk assessment” and on the system’s potential effect on product quality, safety and record integrity. For legacy systems, discretion covers all Part 11 requirements when four criteria are met: the system was operational before 20 August 1997, it met the predicate rules then, it meets them now, and there is documented evidence that it is fit for its intended use, including an acceptable level of record security and integrity.

Eight claims, and what the text says

Three ways to use the section numbers

In the user requirement specification. Turn §11.10(a) to (k) into requirement lines that carry the section number, so the traceability matrix shows which test covers which control. “The system shall have an audit trail” cannot be traced. “§11.10(e): the audit trail records creation, modification and deletion with date, time and user, and cannot be switched off” can.

In questions to suppliers. Ask which sections the product covers by configuration, which by procedure, and which not at all. A supplier who answers with section numbers has read the rule; one who sends the brochure again has not.

In answers to inspectors. Quote the section, then show the configuration and the record that satisfies it. Section numbers keep the discussion on the text instead of the poster.

What Part 11 is not

• A record-keeping rule. It adds controls to records another rule already requires.
• A certificate. No product is “Part 11 certified”, because FDA certifies nothing. Your configuration, validation and procedures carry the compliance.
• A data integrity programme. The findings inspectors write are about behaviour and configuration, not about the wording of the rule.
• The European rule. EU GMP Annex 11 (2011) covers computerised systems used in GMP activities, with different wording and no predicate-rule gate. Its revision has been in preparation since a concept paper put out for consultation in November 2022.

Six qualities on a poster are easy to repost. Ten sections with numbers are what you put in a specification, a test script and an answer to an inspector.

References

• US 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR); final rule 62 FR 13430, 20 March 1997 (effective 20 August 1997); 88 FR 13018, 2 March 2023 (§11.100(c)(1)).
• FDA, *Part 11, Electronic Records; Electronic Signatures — Scope and Application* (August 2003).
• FDA, *Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers* (October 2024), question 28.
• PIC/S, *Concept paper on the revision of EU-PIC/S GMP Annex 11 (Computerised Systems)*, consultation from 16 November 2022 to 16 January 2023.