21 CFR Part 11

What the rule is for

Part 11 does not require anyone to go electronic. It states what must be true if you do. Its purpose is narrow and worth stating precisely: to give the FDA the same confidence in an electronic record that it has in a signed paper one — that it is attributable, unaltered, and reconstructible years later.

The core requirements

Audit trails. Secure, computer-generated, time-stamped, and independent of the user. They must capture creation, modification and deletion, record the prior value, and never be disableable by the people whose work they record. Retained at least as long as the record itself.

Access control. Unique individual accounts. Shared logins defeat attributability and are among the most frequently cited findings.

System validation. The system must be shown to do what it is specified to do, consistently. This is where Part 11 meets GAMP 5 and CSA.

Copies and retention. The agency must be able to obtain complete, readable copies in a usable form for the full retention period — a real constraint when the originating software is a decade out of support.

Electronic signatures. Two distinct identification components. Signature manifestations must show the signer's printed name, date and time, and the meaning of the signing. Signatures must be linked to their records so they cannot be transplanted.

Open vs closed systems

A closed system is one where access is controlled by the people responsible for the record content. An open system is not, and carries additional requirements — typically encryption and digital signature standards. Most regulated firms design deliberately toward closed systems, and the distinction has become live again as validated workloads move into multi-tenant cloud services.

The scope narrowing that still causes confusion

Part 11 as issued in 1997 was read so broadly that it discouraged the electronic adoption it was meant to enable. In 2003 the FDA issued a guidance announcing enforcement discretion over parts of the rule and a narrowed scope, pending re-examination.

Two things follow, and both are routinely misread:

1. Enforcement discretion is not repeal. The regulation stands as written.
2. The narrowing concerns which records are Part 11 records — essentially, records required by a predicate rule (the underlying GxP regulation) that you choose to keep electronically. It does not weaken the requirements for records that are in scope.

Why data integrity absorbed it

In practice Part 11 findings now arrive inside broader data integrity citations framed against ALCOA+ — attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring and available. Part 11 supplies the technical controls; ALCOA+ supplies the principles inspectors reason with. A system can satisfy Part 11's checklist and still fail a data integrity inspection if the surrounding procedures and behaviour do not hold.