The requirements of 21 CFR Part 11 apply whenever an FDA-regulated organization keeps records or captures signatures electronically that another FDA rule already requires it to maintain. In practice, meeting Part 11 means validating your computer systems, restricting and logging access, generating tamper-evident audit trails, linking electronic signatures to the records they approve, using at least two authentication components for non-biometric signatures, managing passwords and ID codes under formal controls, training everyone who touches the system, and certifying to the FDA in a signed letter that your electronic signatures carry the same legal weight as handwritten ones.1GovInfo. 21 CFR Part 11 – Electronic Records; Electronic Signatures
When Part 11 Applies to Your Records
Part 11 does not stand alone. It attaches to a “predicate rule” — another FDA regulation that already requires you to create, maintain, or submit the record in question. Predicate rules include Current Good Manufacturing Practice regulations, the Quality System regulation for medical devices, and Good Laboratory Practice standards for nonclinical studies.2Food and Drug Administration. Part 11, Electronic Records; Electronic Signatures – Scope and Application If a predicate rule requires a batch production record and you keep it in a database, Part 11 applies. If no predicate rule requires the record, Part 11 does not apply, even if you store the information on a computer.
The regulation defines an electronic record as any digital representation of information (text, graphics, data, audio, or images) created, maintained, retrieved, or distributed by a computer system, and an electronic signature as a computer-based compilation of symbols that a person executes, adopts, or authorizes as the legal equivalent of a handwritten signature.3eCFR. 21 CFR 11.3 – Definitions
Part 11 also distinguishes closed systems, where the organization responsible for the records controls access, from open systems, where it does not (data transmitted across the public internet, for example). Open systems face additional requirements because the organization cannot police every access point.
What the FDA Actively Enforces
A 2003 guidance document narrowed how the FDA enforces certain provisions. The agency said it would exercise enforcement discretion over the validation, audit trail, record retention, and record copying requirements of Part 11 standing alone.2Food and Drug Administration. Part 11, Electronic Records; Electronic Signatures – Scope and Application That is not a waiver. It means the FDA will not cite you for a Part 11 audit trail violation by itself, but it will cite you if the underlying predicate rule independently requires an audit trail or validated system — and many predicate rules do exactly that.
The provisions the FDA continues to enforce directly under Part 11 include:
- Access controls limiting system use to authorized individuals
- Operational checks that enforce the correct sequence of steps
- Authority checks confirming only permitted users can sign, alter data, or reach specific functions
- Device checks verifying the source of data input
- Confirmation that personnel have the education, training, and experience for their roles
- Written accountability policies for actions taken under an electronic signature
- Controls over how systems documentation is distributed, accessed, and revised
- Every electronic signature provision, including signature display, record linking, certification, components, and password controls
Controls Required for Closed Systems
Most FDA-regulated electronic systems are closed. Section 11.10 sets the baseline.4eCFR. 21 CFR 11.10 – Controls for Closed Systems
Systems must be validated so that they produce accurate, reliable results and can identify records that have been altered or corrupted. They must generate complete, accurate copies of records in both human-readable form and electronic form suitable for FDA review. Records must be protected so they can be retrieved accurately for their entire retention period. Access must be limited to authorized users, authority checks must control who can sign or modify data, operational checks must enforce step sequencing (a batch record cannot be marked approved before the review step happens), and device checks must confirm data comes from a legitimate input source.
Audit Trails
Closed systems must maintain secure, computer-generated, time-stamped audit trails that independently record the date and time of every action that creates, changes, or deletes an electronic record.5eCFR. 21 CFR 11.10 – Controls for Closed Systems Changes cannot overwrite or obscure earlier information; the original must remain visible. Audit logs must be retained at least as long as the underlying records and be available to FDA inspectors. Retrofitting field-level, tamper-proof logging into a legacy database that was not designed for it is where compliance budgets tend to disappear.
Systems Documentation
Organizations must control how documentation about the system — user manuals, configuration records, maintenance logs — is distributed and accessed. Revision and change control procedures must generate their own audit trail showing how that documentation has changed over time.4eCFR. 21 CFR 11.10 – Controls for Closed Systems
Additional Controls for Open Systems
Every closed-system control still applies to open systems, plus more. Section 11.30 requires additional measures such as document encryption and appropriate digital signature standards to preserve record authenticity, integrity, and confidentiality from creation through receipt.6eCFR. 21 CFR 11.30 – Controls for Open Systems The rule does not prescribe specific algorithms, leaving the choice to the organization based on risk.
Electronic Signature Requirements
Signature Components
Non-biometric electronic signatures must use at least two distinct identification components, typically a user ID and a password.7eCFR. 21 CFR 11.200 – Electronic Signature Components and Controls The first signing during a single continuous session requires both components. Later signings in that same session require at least one component that only the signer can execute. If the signer logs out and returns later, every signing must again use all components.
Biometric signatures must be designed so that only the genuine owner can use them.7eCFR. 21 CFR 11.200 – Electronic Signature Components and Controls
Password and ID Code Management
Section 11.300 layers administrative controls on top. No two individuals can share the same ID-and-password combination. Passwords must be periodically checked, recalled, or revised to address aging.8eCFR. 21 CFR 11.300 – Controls for Identification Codes/Passwords Lost or stolen tokens, cards, or other credential-carrying devices must be electronically deauthorized immediately and replaced under rigorous controls. Systems must detect and urgently report unauthorized attempts to use someone else’s credentials.
Signature Display and Record Linking
Every signed electronic record must clearly show the printed name of the signer, the date and time the signature was executed, and the meaning of the signature — whether the person signed as author, reviewer, approver, or in some other role.9eCFR. 21 CFR 11.50 – Signature Manifestations That information must appear in any human-readable version of the record, on screen or printed.
Signatures must also be linked to their records so that they cannot be cut, copied, or moved to another document.10eCFR. 21 CFR 11.70 – Signature/Record Linking If a record is changed after signing, the system must make clear that the earlier signature applies only to the earlier version.
Certifying Electronic Signatures to the FDA
Before an organization can use electronic signatures for FDA-regulated purposes, it must certify to the agency that those signatures are intended to be the legally binding equivalent of handwritten ones.11eCFR. 21 CFR 11.100 – General Requirements This is the Letter of Non-Repudiation Agreement. It must itself be signed by hand and may be submitted electronically or on paper.
The FDA provides template language. An individual letter names specific employees authorized to use electronic signatures; a company-wide letter covers all employees, agents, and representatives. Both versions must state the company name and confirm that the organization’s electronic signatures are legally equivalent to handwritten signatures.12Food and Drug Administration. Letters of Non-Repudiation Agreement The preferred submission route is now electronic through the FDA’s Unified Submission Portal during ESG NextGen account registration.13Food and Drug Administration. Electronic Submissions Gateway Next Generation (ESG NextGen) Paper copies can be mailed to the FDA’s Electronic Submissions Gateway office in Rockville, Maryland. Keep a copy; inspectors ask for it.
Training and Written Accountability Policies
Part 11 requires organizations to confirm that everyone who develops, maintains, or uses electronic record and signature systems has the education, training, and experience appropriate for their role.4eCFR. 21 CFR 11.10 – Controls for Closed Systems A one-time onboarding session does not satisfy this. Deploy a new electronic quality management system, and the people using it need documented training specific to that system.
Organizations must also establish and follow written policies holding individuals accountable for actions taken under their electronic signature.4eCFR. 21 CFR 11.10 – Controls for Closed Systems The point is deterrence: when people know they will be held responsible for anything signed with their credentials, password sharing and rubber-stamp approvals become far less common. An informal understanding does not meet the requirement; inspectors will ask to see the written policy.
Cloud and SaaS Systems
Part 11 predates cloud computing, but the FDA expects the same controls no matter where the data lives. Responsibility does not transfer to the vendor. If you use a cloud-based or SaaS platform for regulated records, your organization owns compliance.
The FDA finalized guidance in February 2026 on computer software assurance for production and quality management system software, including a specific example covering a SaaS product lifecycle management system.14Food and Drug Administration. Computer Software Assurance for Production and Quality Management System Software The approach is risk-based: the depth of testing and documentation should scale with the software’s impact on product quality and patient safety.
In practical terms, you need a written agreement with the provider covering system validation, data security, audit trail integrity, and inspection support. Your provider must give you (and the FDA on request) access to audit logs. Keep your own validation documentation, audit the provider periodically, and file cloud-specific training records alongside the rest of your Part 11 training documentation. When the inspector arrives, they are asking you.
What Noncompliance Costs
Part 11 problems usually surface during FDA inspections. If an investigator observes conditions that may violate the Federal Food, Drug, and Cosmetic Act, they issue an FDA Form 483 listing specific observations.15Food and Drug Administration. FDA Form 483 Frequently Asked Questions A Form 483 is not a final determination, but it demands a response. Unresolved issues can escalate to a public Warning Letter, and further along the path lie product seizure, injunctions against manufacturing or distribution, and criminal prosecution. Criminal penalties under the Act reach up to one year of imprisonment and a $1,000 fine for a first offense, and up to three years and $10,000 for a repeat offense or one involving intent to defraud.16Office of the Law Revision Counsel. 21 USC 333 – Penalties Organizational fines under the general federal sentencing statute can reach $500,000 for a felony conviction.17Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
The direct fines are rarely the worst outcome. A data integrity Warning Letter can delay product approvals, trigger import alerts, and force costly remediation across entire electronic systems.