21 CFR Part 11

21 CFR Part 11 is the United States Food and Drug Administration (FDA) regulation that sets out the conditions under which electronic records and electronic signatures are considered trustworthy, reliable and equivalent to paper records with handwritten signatures. It applies to companies in FDA-regulated sectors such as pharmaceuticals, medical devices, biotechnology and food, including European manufacturers that export to the US market. The rule shapes how software systems must handle data integrity, access control, audit logging and signature workflows. For DACH organisations it is often addressed alongside European GxP validation requirements rather than in isolation.

What 21 CFR Part 11 governs

Part 11 sits within Title 21 of the US Code of Federal Regulations, which covers food and drugs. It does not define what data must be collected; instead it defines the controls that make electronic records and electronic signatures acceptable to the FDA. The regulation distinguishes between closed systems (where access is controlled by the people responsible for the records) and open systems, and it requires that organisations be able to demonstrate the authenticity, integrity and, where appropriate, the confidentiality of their electronic records throughout the retention period.

Core technical and procedural controls

The regulation translates into a recognisable set of system capabilities and organisational procedures. Software used in scope typically has to provide:

• A secure, computer-generated, time-stamped audit trail that records who created, modified or deleted a record, and when, without overwriting earlier entries.
• Access controls that limit system use to authorised individuals, supported by unique user identities and authentication.
• Electronic signatures that are uniquely linked to one person, cannot be reused or transferred, and are bound to their associated record.
• The ability to generate accurate and complete copies of records in human-readable and electronic form for inspection.
• Operational checks that enforce permitted sequencing of steps and validate data inputs.

Beyond the software itself, Part 11 expects documented procedures: training records, change control, and validation evidence showing that the system performs as intended.

Relationship to validation and EU context

Part 11 is closely tied to computerised system validation. Demonstrating compliance usually forms part of a broader GxP validation exercise covering good manufacturing, laboratory and distribution practice. For European companies the regulation does not replace EU rules; instead it runs in parallel with Annex 11 of the EU GMP guidelines, which addresses similar themes of data integrity and computerised systems. Many DACH manufacturers therefore design their ERP and quality systems to satisfy both frameworks at once. Where personal data is involved, obligations under GDPR apply independently and must be reconciled with long record-retention expectations.

What it means for ERP and quality systems

In practice, Part 11 influences how features such as batch traceability, electronic batch records and quality management within CAQ or ERP software are configured. Vendors may state that a product is technically capable of supporting Part 11, but compliance is never a property of software alone: it depends on validated configuration, controlled procedures and the way the regulated organisation operates the system. The regulation is principle-based, so two compliant implementations can look quite different. Buyers should evaluate documented evidence rather than relying on marketing claims, and should keep validation current whenever the system changes.

Related Topics

• GxP validation
• ERP for pharma
• Audit trail