Framework · 21 CFR Part 11 – Electronic records and electronic signatures
21 CFR Part 11: Records you can back up
Anyone who keeps or signs records for the FDA electronically must show that they are trustworthy. Complass guides you from the predicate rules through validation to the inspection.
What does 21 CFR Part 11 cover?
21 CFR Part 11 "Electronic Records; Electronic Signatures" is a regulation of the US Food and Drug Administration (FDA) from 1997. It sets out the conditions under which electronic records and electronic signatures are considered trustworthy, reliable and equivalent to paper records and handwritten signatures. Subpart B requires controls for closed and open systems such as validation, audit trails, access control and training; Subpart C covers electronic signatures. Which records you must keep is not stated in Part 11 but in the predicate rules, such as the GMP regulations for drugs or the Quality Management System Regulation for medical devices.
Content as of:
Does it apply to me?
Part 11 applies to all companies that keep records required by the FDA in electronic form or submit them to the FDA electronically: pharma and biotech, medical devices, contract research organisations and laboratories, including those based in Europe that manufacture or test for the US market.
Software, SaaS and IT service providers are affected indirectly. Responsibility stays with the regulated company; the FDA expects it to assess its IT service providers and to secure access to, copies of and retention of the records by contract.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
- 21 CFR 11.1§ 11.1 21 CFR 11 Scope(a) The regulations in this part set forth the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper. (b) This part applies to records in electronic form that are created, modified, maintained, archived, retrieved, …Open original (eCFR (inoffiziell), Stand 07.10.2026) ↗Scope
- 21 CFR 11.3§ 11.3 21 CFR 11 Definitions(a) The definitions and interpretations of terms contained in section 201 of the act apply to those terms when used in this part. (b) The following definitions of terms also apply to this part: (1) Act means the Federal Food, Drug, and Cosmetic Act (secs. 201-903 (21 U.S.C. 321-393)). (2) Agency means the Food and Drug Administration. (3) Biometrics means a method of verifying an individual's identity based on …Open original (eCFR (inoffiziell), Stand 07.10.2026) ↗Definitions, including closed and open system
- 21 CFR 11.10§ 11.10 21 CFR 11 Controls for closed systemsPersons who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine. Such procedures and controls shall include the following: (a) Validation of systems to …Open original (eCFR (inoffiziell), Stand 07.10.2026) ↗Controls for closed systems
- 21 CFR 11.30§ 11.30 21 CFR 11 Controls for open systemsPersons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt. Such procedures and controls shall include those identified in § 11.10, as appropriate, and additional measures such …Open original (eCFR (inoffiziell), Stand 07.10.2026) ↗Controls for open systems
- 21 CFR 11.50§ 11.50 21 CFR 11 Signature manifestations(a) Signed electronic records shall contain information associated with the signing that clearly indicates all of the following: (1) The printed name of the signer; (2) The date and time when the signature was executed; and (3) The meaning (such as review, approval, responsibility, or authorship) associated with the signature. (b) The items identified in paragraphs (a)(1), (a)(2), and (a)(3) of this section shall be …Open original (eCFR (inoffiziell), Stand 07.10.2026) ↗Signature manifestations
- 21 CFR 11.100§ 11.100 21 CFR 11 General requirements(a) Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else. (b) Before an organization establishes, assigns, certifies, or otherwise sanctions an individual's electronic signature, or any element of such electronic signature, the organization shall verify the identity of the individual. (c) Persons using electronic signatures shall, prior to or at the …Open original (eCFR (inoffiziell), Stand 07.10.2026) ↗General requirements and certification to the FDA
- 21 CFR 11.300§ 11.300 21 CFR 11 Controls for identification codes/passwordsPersons who use electronic signatures based upon use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include: (a) Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password. (b) Ensuring that identification code and …Open original (eCFR (inoffiziell), Stand 07.10.2026) ↗Controls for identification codes and passwords
Regulation and FDA guidance
-
21 CFR Part 11 in force, published in the Federal Register on 20 March 1997.
62 FR 13430
-
August 2003
Guidance "Scope and Application": narrow interpretation of the scope, enforcement discretion for validation, audit trails, retention, copies and legacy systems.
-
October 2024
Guidance with questions and answers on electronic systems in clinical investigations, with its own section on IT service providers and cloud services.
-
Computer Software Assurance guidance in a new version, aligned with the Quality Management System Regulation for medical devices.
Part 11 itself no longer has transition periods. Before the first use of electronic signatures, your company certifies to the FDA that they are the legally binding equivalent of handwritten signatures (§ 11.100(c)). The guidance documents are not binding, but they show how the FDA inspects.
How Complass helps
- 8phases
- 25guided steps
- 14document templates
- 27requirements in the catalogue
Guided project in eight phases
From the scope and the predicate rules through the system inventory, risk-based validation and suppliers including SaaS to operational controls, electronic signatures, retention and inspection readiness.
Requirements catalogue in the original text
The requirements of §§ 11.10 to 11.300 in the original text with explanations in our own words, status, justification and evidence per item.
Templates up to the certification
Validation master plan, system inventory, risk assessment, supplier assessment, user requirements specification, test and validation report, audit trail review, access concept, change procedure, retention, electronic signature policy and the certification to the FDA.
Evidence once, use it several times
Shared controls connect Part 11 with EU GMP Annex 11, ISO/IEC 27001 and NIS2. You assess suppliers in Supplier Management and risks in Risk Management.
The phases in the module
- Scope and GxP relevance
- System inventory and risk-based validation approach
- Suppliers and service providers, including SaaS and cloud
- Validation
- Operation: controls for electronic records
- Electronic signatures
- Retention, archiving and business continuity
- Inspection readiness
Catalogue: 21 CFR Part 11 requirements
Frequently asked questions
Is Complass validated under Part 11?
No. Complass is not your GxP system and makes no statement of conformity with Part 11. It helps you plan, document and evidence the implementation. You continue to keep records required by the FDA and electronic signatures in your validated systems.
Does Part 11 apply to every system we use?
No. Part 11 applies to records required by a predicate rule that you keep in electronic form or submit to the FDA electronically. Complass first guides you through this scoping and derives the system inventory from it.
We are based in the EU and also supply the USA. What do we need?
In the EU, EU GMP Annex 11 applies; for records required by the FDA, Part 11 applies as well. In Complass both frameworks have the same phases and templates. You book them separately or together; the "GxP and life sciences" industry template in the configurator preselects both with Supplier Management and Risk Management.
Is the legal text available in German?
The text of Part 11 is shown in the original English, as the FDA applies it. The explanations, steps and templates are available in German and English.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.