Knowledge
21 CFR Part 11 and your control system
Part 11 governs certain electronic records and electronic signatures used to satisfy FDA requirements. Applicability depends on the underlying regulation, any exemption, and how the records are used.
When does it apply?
Assess Part 11 applicability with your quality team for each record type. Records maintained electronically in place of required paper records may fall within scope. Electronic records maintained solely under 21 CFR Part 117 (FSMA preventive controls) are expressly exempt; records required by another applicable regulation, such as drug cGMP or the medical device quality system regulation, may still be subject to Part 11. Customers may also specify comparable controls contractually.
Part 11 remains in effect. FDA's scope guidance describes enforcement discretion for specified Part 11 provisions concerning validation, audit trails, retention and copying, and for qualifying legacy systems. Applicable predicate-rule requirements remain enforceable. Define the controls using those requirements and a documented assessment of product and record-integrity risks.
What it asks for, translated
| Requirement | What it means on the plant floor |
|---|---|
| Validation | The system is shown to do what it is supposed to do, accurately and consistently, and changes are controlled. |
| Secure, computer-generated audit trails | Secure, computer-generated, time-stamped records of actions that create, modify or delete regulated electronic records. Changes must not obscure earlier information. Capture additional details, such as reasons, where the applicable requirements or procedures call for them. |
| Access control | Individual user accounts and role-based permissions. No shared logins. |
| Record protection and retention | Protect records throughout the required retention period and provide accurate, complete copies in human-readable and electronic form suitable for inspection. |
| Electronic signatures | Signatures are unique to a person, linked to the record, and show the signer's name, date, time and meaning (for example "approved"). |
| Operational checks | Enforce the permitted sequence of steps where appropriate; for example, require recipe approval before execution when specified by the quality system. |
No system is "Part 11 compliant" out of the box
Software can provide the technical controls: audit trails, user management, signatures. Compliance also depends on how the system is configured and validated, and on your procedures: account administration, training, backup, change control and record review. We configure the technical controls and supply the documentation. Your quality organization owns the procedures and the validation.
How we approach it
- Define, with your QA team, which records are regulated and where they are created.
- Configure user roles, audit trail and signature points in the control system and batch software to match.
- Synchronize time across controllers, servers and workstations, so audit trails line up.
- Provide specifications and test records that feed your validation (IQ/OQ/PQ), following a risk-based GAMP 5 approach.