What Is 21 CFR Part 11? Requirements & Compliance Guide

What Is 21 CFR Part 11?

21 CFR Part 11 is the FDA regulation that sets the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records and handwritten signatures. The name is the citation: Title 21 of the Code of Federal Regulations, Part 11.

FDA 21 CFR Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any FDA records requirement. Those underlying requirements (Good Manufacturing Practices [GMP], Good Laboratory Practices [GLP], and clinical rules that say a record must exist) are known as predicate rules, and FDA's Part 11 guidance uses them to define the regulation's scope.

The regulation has 3 subparts: general provisions that define scope and terms, controls for electronic records, and controls for electronic signatures.

{{callout1}}

Why Does 21 CFR Part 11 Matter?

The FDA issued 21 CFR Part 11 in 1997, when most regulated manufacturers still ran production on clipboards and paper batch records. The regulation answered a question that computers had made urgent: When can an electronic record be trusted as much as a signed piece of paper?

Nearly 30 years later, that answer still determines how manufacturers are regulated to digitize their operations. The premise hasn't changed since then: If the FDA can't trust your records, it can't trust your product.

If your electronic systems fall short of Part 11, the FDA can treat the records they keep as unreliable, and every batch those records support becomes suspect. Data integrity findings are a fixture of FDA warning letters, and inspectors routinely pull audit trails before they ask their first question. The pressure is climbing considering Center for Drug Evaluation and Research (CDER) warning letters rose 50% in FY2025, with about 35% of those letters tied to manufacturing facilities that failed GMP standards.

Compliance done well works in your favor, though. Electronic records outperform paper on the exact points regulators test. You can trace a batch in minutes instead of digging through binders, and investigations that previously took days now close in hours. As manufacturing production digitizes, from electronic batch records to continuous manufacturing, Part 11 is the standard that keeps that data defensible.

The workload is growing either way. In Kneat's 2026 State of Validation report, 80% of organizations said their validation workload increased over the past year, and 45% called the increase significant. Paper still carries much of that critical documentation, and it doesn't scale; the same respondents pointed to digital transformation as the single biggest opportunity to make validation more efficient.

Who Does 21 CFR Part 11 Apply To?

Part 11 applies to any organization that uses electronic records or signatures to satisfy an FDA records requirement under the Federal Food, Drug, and Cosmetic Act or the Public Health Service Act. That is a wide net; products regulated by the FDA account for about 21 cents of every dollar US consumers spend, per the agency's FDA at a Glance fact sheet. 

In practice, Part 11 covers electronic records kept by:

• Pharmaceutical and biotech manufacturers: Batch records, lab data, and deviation and corrective and preventive actions (CAPA) documentation
• Medical device manufacturers: Device history records, design controls, and complaint files
• Biologics, blood, and tissue establishments: Donor, processing, and distribution records
• Food manufacturers under FDA regulation: Food safety plan and GMP compliance records
• Contract research and manufacturing organizations: Records they create or maintain on behalf of regulated clients

Part 11 is triggered by format, not company size. Required records kept on paper stay outside the rule. Move one of those records to an electronic system, and the controls come with it.

{{callout2}}

<H2> 21 CFR Part 11 Requirements

Subpart B sets the controls for electronic records and Subpart C sets the controls for electronic signatures. Four of them carry the most inspection weight: system validation, access controls, audit trails, and signature-record linking.

• Access controls*: Limit system access to authorized individuals. Each user needs unique credentials; shared logins violate the rule.
• Accurate copies and retention: Produce complete, human-readable copies of records for FDA inspection and protect them for the full retention period.
• Audit trails*: Keep secure, computer-generated, time-stamped records of who created, changed, or deleted data. 
• Operational checks: Force workflow steps to happen in the required sequence, so a batch cannot be approved before it is reviewed.
• Signature components: Ensure electronic signatures have 2 distinct components, such as a user ID plus a password or a biometric.
• Signature manifestation: Show the signer's printed name, the date and time, and the meaning of the signature (review, approval, authorship) on each signed record.
• Signature-record linking*: Bind signatures to their records, so they cannot be copied, moved, or reused elsewhere.
• System validation*: Prove each system does what it is supposed to do, reliably and repeatably, with documented evidence.
• Training: Document that people who develop, maintain, or use these systems have the required education, training, and experience for the task.

* These are the highest priority controls for auditors.

One caveat: FDA narrowed its enforcement of Part 11 in 2003 guidance (which remains the agency's current position) to apply discretion to certain validation, audit trail, and copying provisions. Discretion is not the same as exemption! Inspectors still expect a documented, risk-based justification for any control you scale back.

How To Digitize Compliance Procedures Properly

Most Part 11 failures are not software failures. They happen when a plant digitizes the paperwork without digitizing the discipline around it. These 5 steps keep the move from paper defensible:

1. Inventory your predicate-rule records first: List each record an FDA regulation requires you to keep (e.g., GMP, GLP), then decide which ones move to electronic systems. Treating every file on the network as a Part 11 record multiplies validation work without adding compliance.
2. Validate on risk rather than volume: Follow a risk-based framework such as ISPE's GAMP 5. Systems that touch product quality earn deep validation; low-risk tools get a lighter, documented rationale. Validation is a lifecycle and should be revalidated when the system changes.
3. Give each user a unique identity: Consider unique logins, role-based permissions, session timeouts, and prompt deactivation when someone leaves. Shared credentials remain among the most-cited Part 11 failures in warning letters.
4. Make audit trails automatic: If operators must remember to log a change, the trail will have gaps. The system should capture who, what, when, and the prior value on its own.
5. Refuse “paper on glass”: If the digital form works exactly like the paper one did, you've bought a more expensive version of the same risk. A good system blocks skipped steps and catches out-of-range entries, then writes the results straight into your quality management system while the work happens.

The Bottom Line

Part 11 is approaching its 30th year, and inspectors still cite the same failures they cited a decade ago: shared logins, unreviewed audit trails, and validation documents that no longer match the running system. None of those are software problems. They show up months after go-live, when the discipline that got the system through validation lapses. 

See how Redzone's Compliance software keeps quality checks, signatures, and audit trails inspection-ready in real time.