No predicate rule, no Part 11: which of your electronic records the FDA actually regulates

Twenty minutes into the kick-off meeting for a new process historian, the inevitable question comes up: “Is it Part 11?” The integrator says yes, because the brochure says “Part 11 compliant”. IT says no, because it only stores process values. Quality assurance (QA) needs an answer for the validation plan. All three are answering the wrong question.

Part 11 does not apply to systems. It applies to records, and only to records that another FDA regulation already requires. Find that requirement and the answer for the historian, the manufacturing execution system (MES) or the maintenance system follows in a few minutes.

Part 11 adds controls, not records

21 CFR Part 11 has applied since 20 August 1997. It sets the criteria under which the US Food and Drug Administration (FDA) considers electronic records and electronic signatures “trustworthy, reliable, and generally equivalent” to paper records and handwritten signatures (§11.1(a)). It does not require you to keep a single record.

Its scope is in §11.1(b): records in electronic form kept “under any records requirements set forth in agency regulations”, plus records submitted to FDA under the Federal Food, Drug, and Cosmetic Act or the Public Health Service Act, even when no regulation names them. A paper record sent by fax is not an electronic record.

The rule that requires the record in the first place is the predicate rule. FDA’s 2003 guidance defines predicate rules as the underlying requirements in those Acts and in FDA regulations other than Part 11. For a drug plant that mostly means 21 CFR Part 211, good manufacturing practice (GMP) for finished pharmaceuticals; for non-clinical laboratory studies, Part 58; for medical devices, Part 820.

The 2003 reading: four situations

In August 2003 FDA published Part 11, Electronic Records; Electronic Signatures — Scope and Application, which narrowed how the agency reads the rule. Part 11 applies to:

• records required by a predicate rule and kept electronically in place of paper;
• records kept both on paper and electronically, when the electronic record is relied on to perform regulated activities;
• records submitted to FDA in electronic form;
• electronic signatures intended to be the equivalent of handwritten signatures, initials or other signings that a predicate rule requires.

The same guidance announced enforcement discretion on some Part 11 controls, such as validation and audit trails. It gave none on the predicate rules: a Part 211 requirement stays enforced even where FDA is lenient on the matching Part 11 control. The discretion is detailed in 21 CFR Part 11 on one page.

Four questions, asked per record

1. Does an FDA rule require this record or signature, or will it be submitted to FDA? If the honest answer is no, because the data only serve energy reporting or maintenance planning, the record is outside Part 11. Ask again when the use changes. FDA’s 2018 questions-and-answers guidance on data integrity (the 2018 Q&A) is blunt: “When generated to satisfy a CGMP requirement, all data become a CGMP record” (CGMP: current good manufacturing practice). A temperature trend used to accept a sterilisation cycle is required data, whatever the historian was bought for.
2. Is the record created, kept or sent in electronic form? Today, almost always.
3. Do you rely on the electronic version? If the printout meets every requirement of the predicate rule and you rely only on the paper, FDA would generally not consider you to be using electronic records in lieu of paper. If reviewers still work on screen, reprocess data or trend from the database, the electronic record is the one you rely on, and Part 11 applies. Decide this per record type and write it down; the 2003 guidance suggests a standard operating procedure (SOP) or a specification.
4. Does the rule require a signature or initials? Then the electronic signature also falls under Subpart C: manifestation, linking, uniqueness, components and password controls. How to configure and test those is covered in Electronic signatures an inspector accepts.

Most arguments happen at question 3. Printing a dynamic record does not make it static. The 2018 Q&A (question 10) takes the example of an infrared spectrometer’s spectral file: it can be reprocessed, so a printout does not preserve the original, and keeping only the printout does not meet the requirement to retain original records.

Write the four answers per record type into the system inventory or the validation plan. They become the scope of the validation, and the answer ready for the next person who asks “is it Part 11?”.

Where Part 211 already speaks about computers

Part 211 dates from 1978. Only §211.68 was written with automation in mind, but several other clauses bite as soon as a record is electronic. These are the predicate rules for your computerised systems.

• §211.68(a): automatic, mechanical or electronic equipment, “including computers”, may be used if it performs satisfactorily. It is routinely calibrated, inspected or checked under a written programme, and the checks are recorded.
• §211.68(b): changes to master production and control records “or other records” only by authorised personnel; input and output checked for accuracy as often as the system’s complexity and reliability require; backups “exact and complete” and secure from “alteration, inadvertent erasures, or loss”. Translated to today: role-based access under change control, risk-based interface testing, and a restore you have actually performed (see A backup is a hypothesis).
• §211.100(b) and §211.160(a): procedures are followed and “documented at the time of performance”. On a computer, that means time-stamped entries from a correct clock, which is a reason to know where your servers and PLCs get their time from.
• §211.180(c) and (d): records that can be retrieved immediately by computer from another location count as “readily available”; true copies are allowed.
• §211.186(a): the master production record is signed “(full signature, handwritten)” by one person and checked and signed by a second. The 2018 Q&A (question 11) confirms that an electronic signature with appropriate controls meets this, and §11.1(c) makes a compliant electronic signature equivalent to a full handwritten one.
• §211.194(a)(4): laboratory records include “all graphs, charts, and spectra from laboratory instrumentation”; for a chromatography system, every injection.

One machine and one checker instead of two people

Part 211 asks for two people, one who performs and one who checks, for component charge-in (§211.101(c) and (d)), yield calculation (§211.103), the equipment cleaning and use log (§211.182) and significant batch-record steps (§211.188(b)(11)). Since the amendment of 8 September 2008 (73 FR 51919, in force 8 December 2008), §211.68(c) lets automated equipment replace the performer on two conditions: the equipment is used in conformity with §211.68, and one person checks that it “properly performed the operation”.

In the 2008 preamble FDA wrote that some degree of human oversight remains necessary, even with validated systems. On an MES the checker verifies the equipment’s result rather than the operator’s work: the weighed quantity against the recipe limits, the scale identifier and its calibration status, the exceptions the system raised. A “verified by” field the system fills in by itself removes the one human check the rule keeps. We still find them.

The records Part 211 requires, and where Part 11 attaches

The table maps the usual records to the systems that hold them (computerised maintenance management system (CMMS), laboratory information management system (LIMS), chromatography data system (CDS), enterprise resource planning (ERP), quality management system (QMS), programmable logic controller (PLC)), and to the Part 11 controls that attach.

Four systems where the answer is “partly”

Historian. Part 11 attaches to the tags and reports that feed a batch record or a release decision (a sterilisation or freeze-drying cycle, a critical hold temperature). The thousands of tags used for optimisation stay outside. List the ones inside: they carry the validation and audit-trail effort.

Environmental monitoring system (EMS) and building management system (BMS). Aseptic areas need a system to monitor environmental conditions (§211.42(c)(10)(iv)). If a validated EMS holds that record, the BMS driving the air handling units is often outside Part 11, as long as nobody reports GMP values from it. That condition is the one that slips: someone exports a BMS trend for a deviation report, and the boundary has moved.

Maintenance system. Calibration results (§211.68(a), §211.160(b)(4)) and equipment logs (§211.182) are required records. Work-order costs and spare-part stock are not.

ERP. Component records, lot status and distribution records are predicate-rule records (§§211.80(d), 211.184, 211.196). Purchasing and finance data are not.

Whether a system is GxP at all, and how much validation it needs, is an earlier and broader question that this triage does not replace.

“Part 11 compliant” on a datasheet

FDA does not certify systems. Its 2024 Q&A on electronic systems in clinical investigations says so in as many words (question 28): “FDA does not certify electronic systems and methods used to obtain electronic signatures.” A supplier’s claim means the product has the features: audit trail, signature dialogs, access roles. Compliance comes from your configuration, validation and procedures. Shared accounts and disabled audit trails, the findings inspectors write most often, happen on “compliant” software; see Data integrity findings are rarely a software problem.

The EU asks a different question

European GMP starts from the system. EU GMP Annex 11 (2011) applies to all computerised systems used as part of GMP-regulated activities, with no predicate-rule gate. A site supplying both markets validates the historian as a GMP system and applies Part 11 controls to the records Part 211 requires.

The mistakes we see most often

• “The whole system is Part 11.” Every tag, screen and report gets the same effort, so the records that matter get less. Scope by record.
• “We print it, so it is paper.” The printout is filed, but reviewers approve on screen and the database remains the source. Part 11 applies to what you rely on, and nobody wrote down which one that is.
• Quoting an old printout of the regulation. Part 211 changed on 18 December 2025, when medical gases moved to a new Part 213 (89 FR 51738). Quote the electronic Code of Federal Regulations (eCFR), not a PDF saved years ago.

Part 11 never asks whether a system is important. It asks whether a record is required, and whether you rely on the electronic copy of it.

References

• US 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR), §§11.1 to 11.3; final rule 62 FR 13430 (20 March 1997), effective 20 August 1997.
• FDA, *Part 11, Electronic Records; Electronic Signatures — Scope and Application*, guidance for industry (August 2003).
• US 21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals (eCFR); amended by 73 FR 51919 (8 September 2008) and 89 FR 51738 (18 June 2024, effective 18 December 2025).
• FDA, *Data Integrity and Compliance With Drug CGMP: Questions and Answers* (December 2018), questions 10 and 11.
• FDA, *Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers* (October 2024), question 28.