21 CFR Part 11 - Electronic Records and Electronic Signatures

What it says

Electronic records and electronic signatures used in place of paper records must be trustworthy, reliable and equivalent to paper records, requiring validated systems, secure and time-stamped audit trails that record operator entries and actions, and controls ensuring electronic signatures are linked to their respective records and cannot be repudiated.

Paraphrased for plain-language clarity. Always verify against the current published regulation text.

What it means in practice

• Audit trail functionality must be enabled, secure and actually reviewed - simply having the technical capability to generate an audit trail does not satisfy the requirement if nobody examines it as part of routine data review.
• System validation for Part 11 compliance is not a one-time IT project; it must be maintained through the system's operational life, including managing the impact of updates, patches and configuration changes.
• Electronic signatures must be uniquely tied to an individual, and the controls preventing signature sharing or delegation are as much a compliance matter as the technical signature mechanism itself.

What FDA inspectors look for

• Whether audit trails for critical data are actually reviewed as part of routine record review, not merely available for retrieval upon request.
• Whether user access controls prevent shared logins or credential sharing that would undermine the integrity of electronic signatures.
• Whether changes to validated computerised systems, including software updates, go through documented change control before implementation.

Related regulations