21 CFR Part 11 is a U.S. regulation governing electronic records and electronic signatures. It establishes the criteria under which the FDA recognizes such records and signatures as equivalent to paper-based records and handwritten signatures under certain circumstances. Its scope is tied to the underlying statutory and regulatory record-keeping requirements.
Scope in Relation to Underlying Rules
Part 11 applies to electronic records that are created, modified, maintained, archived, retrieved, or transmitted under FDA regulations. The FDA refers to the obligations arising from statutes and other FDA rules outside Part 11 as “predicate rules.” Part 11 therefore does not itself create the obligation to retain a particular study report or data set, but rather governs the requirements for its electronic maintenance and signature.
The FDA guidance on application clarifies that its interpretation affects all FDA program areas. Electronic records may also fall within scope when they are maintained in addition to paper and are used to perform regulated activities. Whether a specific clinical system falls under Part 11 consequently depends on function, record-keeping obligation, and actual use, not solely on the product name of the software.
Controls for Closed Systems
For closed systems, 21 CFR 11.10 requires, among other things, procedures and controls that ensure the authenticity, integrity, and, where appropriate, confidentiality of electronic records. This includes validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to detect invalid or altered records. The regulation combines technical controls with documented procedures and roles.
Particularly significant is the secure, computer-generated, time-stamped audit trail. It must independently record when operator actions to create, modify, or delete occurred, and must not obscure previous information. The audit trail must be retained for at least as long as the associated electronic record. Additional requirements include access restrictions, training, and controls over system documentation.
Distinction from Audit Trail and System Validation
21 CFR Part 11 is a regulation, not a validation project or a single software function. An audit trail is one of the controls to be implemented in a system, provided the specific requirements apply. Computerized system validation is the process by which the suitability of a system for its intended use is demonstrated; Part 11, on the other hand, defines the regulatory framework on which certain expectations for electronic records are based.
The presence of an audit trail therefore does not automatically mean Part 11 compliance. Likewise, validation evidence may be insufficient if the trail is not independent, time-stamped, or available for a sufficient period. The assessment must include all relevant controls and the underlying record-keeping obligations.
Electronic signatures have their own regulatory area within Part 11. The regulation addresses, among other things, the linkage of the signature to the associated record and controls for unique identification. In a study process, this may involve, for example, the electronic confirmation of a review, release, or approval. The system configuration must therefore distinguish between a mere user action and a legally or quality-relevant signature, rather than treating every button as equivalent evidence.
For globally conducted studies, it is also important to note that Part 11 is not understood as a general substitute for European or national requirements. A system may be prepared for FDA-relevant use and still need to meet additional data protection, GCP, or archiving obligations. The applicable regulations should be assessed separately according to data flow and submission region.
Relevance for clinical trials
For studies with U.S. submission relevance, Part 11 frequently affects EDC, ePRO, eTMF, electronic signatures, and systems that manage regulatory-required information. During system selection, it should already be clarified which records will be maintained electronically, which signature actions are planned, and how audit trails for data changes and user rights will be demonstrated. Subsequent modifications to authentication or archiving can trigger substantial revalidation effort.
Full-service CROs such as Mediconomics support Part 11-related system assessment, user requirements for audit trails and electronic signatures, and compilation of validation and supplier evidence. They can review data flow between investigational sites, EDC, and eTMF, document role-based access, and coordinate the evidence relevant to U.S. study operations with quality management and regulatory affairs.
Frequently Asked Questions (FAQ)
Does 21 CFR Part 11 automatically apply to every electronic study tool?
No. Determining factors include whether it is used to maintain or transmit records required under the underlying FDA requirements, and how the system is used in the regulated activity.
What does “closed system” mean in this context?
Part 11 distinguishes systems in which persons responsible for the content of electronic records control access from open systems. For closed systems, § 11.10 specifies concrete controls.
Does Part 11 replace the requirements of ICH E6(R3)?
No. Part 11 is a U.S. regulation for electronic records and signatures. ICH E6(R3) governs Good Clinical Practice and data governance in clinical trials from a different perspective.
Regulatory References
- 21 CFR Part 11, Electronic Records; Electronic Signatures – contains the U.S. requirements for electronic records and signatures.
- FDA, Part 11 Scope and Application – explains the relationship to the underlying record-keeping obligations.
- FDA Study Data Technical Conformance Guide – describes technical expectations for standardized electronic study data at CDER and CBER.
