What does 21 CFR Part 11 actually require of a system?
Start with the question most teams skip: does Part 11 apply to your records at all?
Answered in short
6 things that decide this
- 01Part 11 covers records in electronic form that are created, changed, kept, archived, retrieved or sent under a records requirement set out in another FDA regulation.
- 02That other regulation is the predicate rule. Without one, Part 11 has nothing to attach to. Paper records sent by electronic means sit outside it.
- 03The audit trail in 11.10(e) must be secure, computer-generated and time-stamped. It records the date and time of operator entries and actions. And record changes may not obscure what was recorded before.
- 04That audit trail must be kept at least as long as the records it covers, and be available for FDA review and copying.
- 05A signed electronic record must show the printed name of the signer, the date and time of signing, and what the signature means. That applies in any human-readable form of the record.
- 06An electronic signature not based on biometrics needs at least two distinct parts, such as an identification code and a password.
Part 11 is not a general software rule
Teams ask us to make a system Part 11 compliant, as though it were a badge the software earns. It is not. Part 11 sets the conditions under which FDA will treat an electronic record as trustworthy in place of a paper one.
So ask first which FDA regulation already requires you to keep this record. That is the predicate rule. With one, Part 11 tells you what your electronic version must do. Without one, Part 11 has nothing to attach to.
This is not a technicality. It decides which of your systems are in scope. That is the gap between an audit trail on three tables and one on everything, forever.
What the sections actually say
Checked 11 August 2026 against the current eCFR text of 21 CFR Part 11.
| Section | Requirement | What it means for a build |
|---|---|---|
| 11.10(a) | Validation of systems for accuracy, reliability and consistent intended performance, and the ability to discern invalid or altered records | Documented testing, and a way to detect tampering |
| 11.10(b) | Generate accurate and complete copies in human readable and electronic form | Export that an inspector can actually read |
| 11.10(d) | Limiting system access to authorised individuals | Real access control, per role |
| 11.10(e) | Secure, computer-generated, time-stamped audit trails; changes must not obscure previous information; retained as long as the record | Append-only history, never an overwrite |
| 11.10(g) | Authority checks, so only authorised people use the system, sign, access devices or alter a record | Permission checked at the action, not the screen |
| 11.50 | Signed records show printed name, date and time, and the meaning of the signature | Visible on screen and in print, not only in a database |
| 11.70 | Signatures linked to their records so they cannot be excised, copied or transferred by ordinary means | The signature travels with the record |
| 11.200(a) | At least two distinct identification components for a non-biometric signature | Identification code plus password, at minimum |
Enforcement discretion is narrower than the internet suggests
FDA's 2003 guidance says it will read Part 11 narrowly. It also says FDA does not intend to take enforcement action on the validation, audit trail, record retention and record copying rules, as explained in that document. People quote that a great deal, usually without the sentences around it.
The same guidance states plainly that Part 11 remains in effect. The discretion applies only as set out there. It also says FDA intends to enforce all the other parts. Among them: limiting system access, operational system checks, authority checks, device checks, training and written accountability policies.
On audit trails it is blunter still. You must still meet predicate rule requirements about recording date, time and the order of events. And any requirement that changes to records do not obscure earlier entries. The discretion moves where the duty comes from. It does not remove the duty.
- 01FDA made its guidance on electronic systems, records and signatures in clinical investigations final on 2 October 2024. It replaced the 2007 computerised systems guidance.
- 02Open systems under 11.30 need the 11.10 controls, plus extra measures such as document encryption and suitable digital signature standards.
- Find the predicateWhich rule requires this record?
- Control accessAuthorised individuals only.
- Check authorityAt the action, not the screen.
- Write, never overwriteHistory that cannot obscure the past.
- Sign properlyName, time, meaning, linked to the record.
- Export itHuman-readable and electronic, on request.
The fourth station is the one that decides everything. A schema where an update replaces the old value cannot satisfy 11.10(e) afterwards, and retrofitting append-only history into a live system is the expensive version of this work.
Systems built around an audit trail
Related questions
01Can we buy a Part 11 compliant system?
You can buy software with the features Part 11 asks for. Compliance, though, depends on how you use it. The rule covers procedures and controls as well as technology. That includes written policies holding people accountable for actions taken under their electronic signatures. A vendor supplies the mechanism. Your organisation supplies the rest.
02Does an ordinary application log count as an audit trail?
Rarely, because logs can usually be edited, are incomplete, and get rotated away. 11.10(e) asks for something secure, computer-generated and time-stamped. It must be kept at least as long as the record, and be available for FDA to review and copy. A log file that ages out after thirty days meets none of that.
03What has to appear on a signed record?
Three things. The printed name of the signer. The date and time the signature was made. The meaning of that signature, such as review, approval, responsibility or authorship. 11.50(b) requires those in any human-readable form of the record. A screen or a printout has to show them, not hide them in a table.
04Do electronic signatures need two factors?
Two distinct identification parts, which is not the same as modern two-factor authentication. 11.200(a) gives an identification code and password as the example. Within one continuous session, later signings may use just one part, provided only that individual can use it.
Related
- When does my software become a regulated medical device →The other FDA question a clinical build raises.
- How do you build HIPAA compliant AI →The privacy regime that usually sits alongside this.
- PHI →What counts as protected health information.
- Healthcare software development →Where we build under these constraints.
- Custom software development →Systems designed append-only from the start.
