What Part 11 covers
Part 11 applies to records that other FDA regulations (the "predicate rules", such as the drug CGMPs in 21 CFR 210 and 211) require, when those records are kept electronically. FDA's 2003 guidance Part 11, Electronic Records; Electronic Signatures - Scope and Application explains how the agency applies it, and focuses enforcement on records that matter for product quality and safety.
The key requirements, in plain language
| Section | What it asks | What to check in software |
|---|---|---|
| 11.10(a) | Validation of systems | Validated for its intended use, with evidence (URS, risk assessment, IQ/OQ/PQ). |
| 11.10(b), (c) | Accurate copies; records protected for their retention period | Readable exports and printouts; backups that are restored and tested. |
| 11.10(d) | Access limited to authorised individuals | Personal logins, role-based access, password policy. |
| 11.10(e) | Secure, computer-generated, time-stamped audit trails | Who, when, old and new value - and no way for a user to edit or delete it. |
| 11.10(f), (g) | Operational checks (sequence) and authority checks | Steps in a fixed order; only the right roles can approve; the author cannot approve their own record. |
| 11.10(i)-(k) | Training, written policies, documentation control | Trained users, accountable policies, controlled system documentation. |
| 11.50 | Signature manifestations | The signed record shows the printed name, date and time, and meaning (review, approval, responsibility). |
| 11.70 | Signature/record linking | A signature cannot be copied or moved to another record. |
| 11.100, 11.200 | Unique signatures; two distinct identification components | One person, one signature; signing uses the user ID and password (re-entered as required). |
| 11.300 | Controls for identification codes and passwords | Unique IDs, periodic checks, lockout and handling of lost credentials. |
EU GMP Annex 11
Annex 11 to the EU GMP Guide covers computerised systems used in GMP activities. Its expectations line up closely with Part 11: a risk-based approach and validation (§1, §4), data and accuracy checks (§5, §6), data storage and backup (§7), printouts (§8), audit trails (§9), change and configuration management (§10), periodic evaluation (§11), security (§12), incident management (§13) and electronic signatures (§14).
The point people miss
No software is "Part 11 compliant" on its own. Software provides controls; compliance comes from validating the system for your use and operating it under your procedures. When a vendor says "compliant", ask which controls the system provides and how they would be shown in validation.
This article is general information, not regulatory advice. Read the regulation and guidance in full: 21 CFR Part 11 (eCFR), FDA guidance "Part 11, Electronic Records; Electronic Signatures - Scope and Application" (2003), and EudraLex Volume 4, Annex 11.