21 CFR Part 11 Explained: Complete Guide to FDA Electronic Records & Signatures (2026)
By PharmaShare CSV Team | Data Integrity | August 2026
1. What is 21 CFR Part 11?
Title 21, Code of Federal Regulations, Part 11 – Issued in 1997, enforced from 1997. It says:
When does it apply? Only if you have predicate rule requiring records. e.g., 21 CFR 211.68 (auto equipment), 211.160 (lab controls), 211.188 (batch records). If predicate rule says “record it”, and you record electronically, Part 11 applies.
Applies to: All GxP – GMP, GLP, GCP, PV. Systems like LIMS, HPLC, MES, SCADA, DMS, QMS, ERP, Excel sheets used for GMP calculation.
2. Structure of Part 11 – 3 Subparts
| Subpart | Section | What it Says |
|---|---|---|
| A – General | 11.1, 11.2, 11.3 | Scope, implementation, definitions (closed vs open system, audit trail etc.) |
| B – Electronic Records | 11.10, 11.30, 11.50, 11.70 | Controls for records – Validation, Audit Trail, Copies, Retention, System Access |
| C – Electronic Signatures | 11.100, 11.200, 11.300 | How e-signature must be – Unique, Verified, 2 components, Controls |
3. The 11 Core Requirements of Part 11 – FDA Auditor Checklist
1. Validation – 11.10(a)
System must be validated for accuracy, reliability, consistent performance. Needs IQ/OQ/PQ + GAMP 5 approach. Risk-based CSV. Every GxP system must have validation docs.
2. Audit Trail – 11.10(e) – MOST CITED 483
Secure, computer-generated, time-stamped audit trail to independently record date/time of operator entries and actions that create, modify, or delete records. Must record OLD value + NEW value + Reason for change. Must be reviewed. Cannot be disabled. Audit trail must be retained as long as record.
FDA Finding Example: “Your HPLC system does not have audit trail enabled. Users can delete injections without trace.”
3. Copies of Records – 11.10(b)
Ability to generate accurate and complete copies in human-readable and electronic form for FDA inspection. PDF + Raw data both needed. Metadata must be included.
4. Record Retention – 11.10(c)
Secure retention for period required by predicate rule. Backup & Archival. For GMP, typically data retention = 1 year past expiry.
5. System Access – 11.10(d) & (g)
Limit access to authorized individuals only. Use of role-based access. No shared logins. No generic ADMIN account. Authority checks.
6. Electronic Signature – 11.50, 11.70, 11.100-300
Must contain: Printed name of signer, Date/time of signing, Meaning of signing (e.g., Review, Approval, Author). Must be unique to one person, not reused. Must have two components for signing (User ID + Password).
Two Types:
– Non-biometric: ID + Password
– Biometric: Fingerprint, Iris
For non-biometric: First signing in session needs both components, subsequent signings within session need at least 1 component.
7. Device Checks – 11.10(h)
System must check source of data – valid source check. e.g., Weighing balance ID check before data transfer to MES.
8. Education, Training, Experience – 11.10(i)
Personnel must have required training for developing, maintaining, using e-systems.
9. Accountability – 11.10(j)
Written policies for holding individuals accountable for e-sig actions. e-Sig statement in SOP that e-sig = handwritten.
10. Change Control – 11.10(k)
Controlled documentation for system changes, re-validation.
4. Open vs Closed System – Critical Definition
| Type | Meaning | Extra Control |
|---|---|---|
| Closed – 11.10 | Access controlled by same org who owns records (Most pharma systems) | 11.10 controls only |
| Open – 11.30 | Access controlled by outsiders – e.g., Cloud, Internet, CRO system | All 11.10 + Extra: Encryption, Digital Signature, Access control |
5. Part 11 vs Annex 11 vs ALCOA+
Part 11 = US FDA rule (1997) for ERES. Legally binding in US.
EU Annex 11 = EU counterpart (2011 revision). More detailed, requires more IT controls, Supplier audit.
ALCOA+ = Data integrity principles from MHRA/FDA guidance (2015-2022) – Attributable, Legible, Contemporaneous, Original, Accurate + Complete, Consistent, Enduring, Available. ALCOA is HOW you implement Part 11.
2026 Reality: FDA does not audit Part 11 word-by-word. FDA audits Data Integrity per ALCOA+. If ALCOA fails, they cite 211.68(b) + Part 11.
6. Top 5 Data Integrity Failures Leading to 483 / Warning Letter
- Shared Login: Lab uses common Analyst ID for HPLC – 11.300 violation
- Audit Trail Off: Empower audit trail disabled, users can delete injections – 11.10(e)
- Time Stamp Manipulation: System admin can change Windows date/time – No time sync
- Excel Uncontrolled: Calculation in uncontrolled Excel without validation – 11.10(a)
- No Review of Audit Trail: Audit trail exists but no one reviews it during batch release – FDA guidance 2018 says audit trail review must be part of routine review
7. How to Make System Part 11 Compliant – Checklist
☐ GAMP 5 Validation (URS → FS → DS → IQ/OQ/PQ)
☐ Audit Trail enabled, cannot be edited/deleted, includes old/new value, reason, user, date/time
☐ Time sync via NTP server, only IT admin can change time, audit for time change
☐ Unique User ID + No shared password + Password expiry 60-90 days + Auto-lock after 3 fails
☐ Role based access – Analyst, Reviewer, Approver, Admin separate
☐ Two-component e-signature: Username + Password at signing
☐ Secure backup + Restore tested + Archival policy
☐ Audit Trail Review SOP – Who reviews, when, what evidence
☐ Printer attached? If e-records also printed, print must say exact copy + include audit trail + e-sig info
☐ Periodic Review – Annual GxP system review for Part 11 compliance
8. Part 11 for Excel Sheets – FDA Hot Topic
Most pharma still uses Excel for GMP calc. FDA says Excel = Part 11 system if used for GxP.
Compliant Excel Needs: Controlled template stored in DMS with version, Locked cells for formulas, Audit trail via VBA or third-party tool (e.g., Ofni Excel Lock), Access control via folder, Validation of formula, E-signature workflow. Uncontrolled Excel on desktop = Direct 483.
Conclusion
21 CFR Part 11 is not about software features. It is about Trust. Can FDA trust your electronic data as much as signed paper? If your system allows deletion without trace, shared login, or no audit trail – answer is NO.
In 2026, with FDA’s new Data Integrity guidance and remote audits, audit trail review and unique login are #1 focus. Validate, lock down admin rights, enable audit trail, and review it.
⚠️ Disclaimer
For educational purpose only. Refer official 21 CFR Part 11, FDA Part 11 Guidance (2003, Narrow Scope), FDA Data Integrity Guidance 2018, EU Annex 11. Not legal advice. Information as of Aug 2026.
About the Author
Mahummed Asif is a experienced pharmaceutical Quality Assurance professional and publisher of Pharmashare. He has worked with leading Pharmaceutical organizations and has developed extensive expertise in Quality Assurance, deviation management, investigations, CAPA, QMS, Product Life Cycle Management, change control, risk management, validation, product complaints, product recalls, and regulatory compliance. He is passionate about sharing practical pharmaceutical knowledge with professionals, students, and quality practitioners across the industry.