21 CFR Part 11 compliance means meeting the FDA’s rules for treating electronic records and electronic signatures as the legal equivalent of paper and ink. If your company falls under FDA oversight and you keep required records on a computer or sign them electronically, Part 11 governs how those systems must be built, controlled, and documented. It applies to drug manufacturers, medical device firms, contract labs, and any domestic or foreign company marketing FDA-regulated products in the United States.
The practical compliance picture has two layers: what the regulation says on paper, and what the FDA actually enforces after its 2003 guidance narrowed the agency’s approach. Both matter, because predicate rules still demand most of the controls the FDA stopped enforcing under Part 11 itself.
When Part 11 Actually Applies to Your Records
Part 11 does not cover every file on every computer in your building. It applies only when another FDA regulation already requires you to create or keep a record, and you choose to do so electronically instead of on paper. Those underlying rules are called predicate rules, and they include requirements from the Federal Food, Drug, and Cosmetic Act, the Public Health Service Act, and other FDA regulations.1Food and Drug Administration. Part 11, Electronic Records; Electronic Signatures – Scope and Application Common ones include Current Good Manufacturing Practice (cGMP), Good Laboratory Practice (21 CFR Part 58), and Good Clinical Practice regulations at 21 CFR Parts 50, 56, and 312.2Food and Drug Administration. Regulations: Good Clinical Practice and Clinical Trials
Section 11.1 covers records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any FDA recordkeeping requirement, plus any electronic signature intended to replace a handwritten one.3eCFR. 21 CFR 11.1 – Scope
The FDA’s 2003 guidance narrowed this considerably. If you use a computer only to generate paper printouts and then rely on those printouts for your regulated activities, the agency generally does not treat you as using electronic records in lieu of paper, and Part 11 does not apply to that system. If you keep both paper and electronic versions but rely on the electronic version for regulated work, Part 11 does apply. One early compliance task is documenting which of your systems produce Part 11 records and which do not, based on your predicate rule obligations.
Controls Your Systems Need
The regulation splits computing environments into two types. A closed system is one where the people responsible for the record content control access to it. An open system is one where they do not.4eCFR. 21 CFR 11.3 – Definitions Most internal networks, LIMS platforms, and enterprise systems are closed. Cloud-hosted environments where a third party controls the infrastructure often are not.
Section 11.10 sets the controls for closed systems.5eCFR. 21 CFR 11.10 – Controls for Closed Systems Only authorized individuals may access the system, and permissions must match each user’s role so that, for example, a line operator cannot approve a batch record. The system must generate secure, computer-generated, time-stamped audit trails that independently record who made each entry and when, covering modifications and deletions, without overwriting previous entries. Where the order of operations matters, the software must enforce that sequence. Authority checks must confirm that anyone signing a record or altering data has the credentials to do so, and device checks must verify the source of any input from instruments or terminals. Records must be protected for accurate and ready retrieval throughout their entire retention period, and the system must be able to produce accurate and complete copies in both human-readable and electronic form for FDA review. Audit trail documentation must be retained at least as long as the underlying record.
Open systems must meet all of those controls plus additional measures to ensure record authenticity, integrity, and confidentiality from creation through receipt. Section 11.30 specifically names document encryption and appropriate digital signature standards as examples.6eCFR. 21 CFR 11.30 – Controls for Open Systems Cloud arrangements sit in this territory. Even when a vendor runs the infrastructure, the regulated entity remains accountable, so contracts need to cover data ownership, access control, validation responsibility, and how the provider will support an FDA inspection.
The audit trail is where inspections often live or die. Inspectors expect to reconstruct exactly how a data point reached its current state, which means every entry must be attributable to a specific person, recorded at the time the activity happened, and available in its original form rather than as a summary. Reviewing audit trails before releasing final data is a standard expectation, and companies that skip this step tend to collect Form 483 observations.
Electronic Signature Requirements
Part 11 defines an electronic signature as a computer data compilation that a person executes, adopts, or authorizes as the legally binding equivalent of a handwritten signature.4eCFR. 21 CFR 11.3 – Definitions Several rules keep those signatures trustworthy.
Each signature must be unique to one individual and cannot be reused by or reassigned to anyone else.7eCFR. 21 CFR Part 11 Subpart C – Electronic Signatures Signatures must be linked to their records so they cannot be lifted and applied to a different record. Every signed electronic record must display the signer’s printed name, the date and time of signing, and the meaning of the signature, such as review, approval, or authorship, whenever the record is displayed or printed.8eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures
Non-biometric signatures must use at least two distinct identification components, typically an ID code and a password. If someone signs multiple records during a single, continuous session, the first signing requires both components, and subsequent signings in that same session may use only one component as long as that component is executable only by the signer. Signings that are not part of a continuous session always require both.9eCFR. 21 CFR 11.200 – Electronic Signature Components and Controls
Biometric signatures, such as fingerprint or retinal scans, must be designed so that no one other than the genuine owner can use them.10eCFR. 21 CFR 11.200 – Electronic Signature Components and Controls Regardless of method, any attempt to use another person’s electronic signature must require the collaboration of two or more people.
Password and ID Code Safeguards
Section 11.300 adds specific controls for organizations using ID code and password combinations.11eCFR. 21 CFR 11.300 – Controls for Identification Codes/Passwords No two individuals may share the same combination. Issuances must be periodically checked, recalled, or revised, which covers routine password aging. Lost, stolen, or compromised tokens or cards must be electronically deauthorized and replaced through rigorous controls. The system must prevent unauthorized use of passwords, detect any attempts, and report them immediately to the security unit and, where appropriate, to management. Tokens and cards that generate identification information must be tested initially and periodically to confirm they still work and have not been tampered with.
The Certification Letter to the FDA
Before using electronic signatures for regulated records, your organization must certify to the FDA that its electronic signatures are intended to be the legally binding equivalent of handwritten signatures. The certification itself must be signed with a traditional handwritten signature and can be submitted in electronic or paper form.12eCFR. 21 CFR 11.100 – General Requirements Skipping this step is easy and undermines the legal standing of every electronic signature your organization goes on to execute.
System Validation, SOPs, and the CSA Approach
Section 11.10 requires that computerized systems used for Part 11 records be validated to ensure they perform accurately, reliably, and consistently for their intended use. That means testing the software and hardware under real conditions, documenting the results, and keeping the documentation accessible for inspection. A system that works perfectly but lacks validation documentation will still draw a finding.
Standard operating procedures round this out. You need written SOPs covering data entry, password management, system failure handling, and audit trail review. Personnel need documented training on those SOPs, and the training records themselves are auditable. Regular internal audits catch drift before an inspector does.
The FDA finalized its Computer Software Assurance (CSA) guidance in February 2026 for software used in production or quality management systems.13Food and Drug Administration. Computer Software Assurance for Production and Quality Management System Software CSA is a risk-based alternative to traditional validation. High-risk software that directly affects product quality or patient safety still warrants rigorous scripted testing with detailed documentation. Lower-risk software supporting quality systems can be assured with less formal methods such as exploratory or ad-hoc testing. If you move from traditional validation to CSA, document the risk assessments carefully, because those classifications drive which testing approach is defensible.
What the FDA Actually Enforces
In 2003, the FDA announced it would exercise enforcement discretion over several Part 11 provisions after concluding that some requirements were being read so broadly that compliance costs outweighed public health benefits. The agency stated it does not intend to enforce compliance with the following, provided predicate rule requirements are still met:14Food and Drug Administration. Guidance for Industry: Part 11, Electronic Records; Electronic Signatures – Scope and Application
- The Part 11 validation requirement at § 11.10(a), although predicate rules like cGMP still require validation.
- The Part 11 audit trail requirement at § 11.10(e), although predicate rules may independently require documentation of changes.
- The record copy requirements at § 11.10(b) for producing records in human-readable and electronic form.
- The record retention protection requirements at § 11.10(c).
- All Part 11 requirements for legacy systems that were operational before August 20, 1997, under certain circumstances.
None of this makes those controls optional. It means the FDA evaluates them under the predicate rules instead of under Part 11 specifically. A cGMP-regulated manufacturer still needs audit trails and validated systems because cGMP requires them. The practical takeaway is to focus first on your predicate rule obligations, then apply Part 11 controls where the regulation clearly applies, rather than treating every electronic file as a full Part 11 record.
What Non-Compliance Costs
Part 11 problems usually surface during FDA facility inspections. The first step is typically a Form 483 observation, a written notice describing a specific condition that may violate FDA regulations. If the company does not address the observations, the FDA can escalate to a warning letter demanding corrective action within a set timeframe.
Criminal penalties sit in 21 U.S.C. 331, which prohibits failure to establish or maintain required records, and 21 U.S.C. 333, which sets the punishment.15Office of the Law Revision Counsel. 21 USC 331 – Prohibited Acts A first-offense violation is a misdemeanor carrying up to one year in prison and a fine of up to $1,000. A repeat violation, or one committed with intent to defraud, can bring up to three years in prison and a fine of up to $10,000.16Office of the Law Revision Counsel. 21 USC 333 – Penalties
The more common consequence is commercial. A warning letter citing data integrity failures can effectively freeze a pending drug or device application until the company shows it has fixed the problem, because the FDA will not approve a submission built on data it cannot trust.