21 CFR Part 11, in Plain English
What electronic records and e-signatures actually have to prove.
21 CFR Part 11, in Plain English
What electronic records and e-signatures actually have to prove.
What Part 11 is actually about
21 CFR Part 11 is the FDA regulation governing electronic records and electronic signatures — it exists so that a digital record can carry the same legal and evidentiary weight as a signed paper one. The core question it's built around is simple: if this record were challenged in an audit or investigation, can you prove it's authentic, complete, and hasn't been altered?
Audit trails: the requirement that catches the most systems out
Part 11 requires a secure, computer-generated, time-stamped audit trail that records who changed what, when, and (for critical fields) why — and crucially, this trail has to be independent of the user, meaning a regular user account can't turn it off or edit it. A system that just overwrites the old value when a field is edited, with no history, does not meet this bar no matter how good its other features are.
Electronic signatures need to mean something
An e-signature under Part 11 has to be uniquely linked to one individual, require that individual's own credentials to apply (not a shared login), and be permanently bound to the specific record it signed — so the signature can't later be copied onto a different record or reused. This is why "the manager clicked approve" isn't automatically a compliant signature; it depends entirely on how the system implements identity and binding underneath that click.
Access controls and system validation
Part 11 also expects that only authorized individuals can access or modify records in the first place, which means role-based access control, not just a login screen. And because this is all resting on a computerized system, that system itself needs to be validated (see our CSV article) — Part 11 compliance isn't a checkbox feature, it's a property of a properly validated, properly controlled system.
What this means practically when evaluating software
When evaluating any system that will hold GxP records — an LMS, a DMS, a QMS, a custom ERP module — ask specifically: can I see a full audit trail for any record, including who and when? Can a signature be traced to one specific, authenticated individual? Can access be restricted by role? If a vendor can't answer these concretely, the burden of proving compliance shifts onto you during your next audit.