Regulatory Requirements

21 CFR Part 11 and Electronic Signatures: Requirements, Scope and Implementation

Last updated: 5 November 2026

Short answer: 21 CFR Part 11 sets out the criteria under which the US Food and Drug Administration (FDA) considers electronic records and electronic signatures to be trustworthy, reliable and generally equivalent to paper records with handwritten signatures.[1] It applies only to records required by another FDA regulation (a predicate rule) or submitted to the FDA electronically.[1][2] Compliance is not a property of software: the FDA does not certify systems, and accountability stays with the regulated company, its validated system, its procedures and its trained staff.[3]

What does 21 CFR Part 11 regulate and which records does it cover?

Part 11 has three subparts: Subpart A (general provisions and definitions), Subpart B (Electronic Records, §§ 11.10–11.70) and Subpart C (Electronic Signatures, §§ 11.100–11.300).[1] The rule was published on 20 March 1997 and took effect on 20 August 1997.[1]

The link to the predicate rules is decisive, that is, the underlying GxP regulations such as 21 CFR 211 (GMP), 21 CFR 312 (investigational new drugs) or 21 CFR 58 (GLP). Part 11 applies to electronic records that must be kept under those rules and to records submitted to the FDA in electronic form.[1] In its guidance “Part 11, Electronic Records; Electronic Signatures – Scope and Application” (August 2003), the FDA announced a narrow interpretation of Part 11.[2] It exercises enforcement discretion over the requirements for validation, audit trails, record retention and record copying, and over legacy systems in operation before 20 August 1997.[2] The predicate rules themselves and the remaining Part 11 requirements, such as access controls and all signature provisions, continue to be enforced.[2] For the European GMP context, see the info-pharma article on Good Manufacturing Practice (GMP).

What are the requirements for electronic records?

For closed systems, where access is controlled by those responsible for the records, § 11.10 requires controls including:[1]

  • Validation to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records (§ 11.10(a)).
  • Copies for inspection: accurate and complete copies in human-readable and electronic form (§ 11.10(b)).
  • Protection of records throughout the retention period so that they remain accurate and readily retrievable (§ 11.10(c)).
  • Access control limited to authorised individuals (§ 11.10(d)), plus authority, operational and device checks (§ 11.10(f)–(h)).
  • Audit trail: secure, computer-generated and time-stamped, independently recording the date and time of entries and actions that create, modify or delete records. Changes must not obscure previously recorded information, and the audit trail must be retained at least as long as the record (§ 11.10(e)).
  • Training, accountability and documentation control: qualified staff, written policies holding individuals accountable for actions under their signatures, and control of system documentation (§ 11.10(i)–(k)).

For open systems, where those responsible do not control access, § 11.30 requires additional measures such as document encryption and appropriate digital signature standards.[1]

What are the requirements for electronic signatures?

  • Signature manifestation (§ 11.50): signed records show the printed name, the date and time and the meaning of the signature (such as review, approval or responsibility), including in printouts and screen displays.[1]
  • Signature/record linking (§ 11.70): signatures must be linked to their records so that they cannot be excised, copied or transferred by ordinary means to falsify a record.[1]
  • Uniqueness (§ 11.100(a), (b)): each signature belongs to one individual only and is never reused or reassigned; identity must be verified before it is issued.[1]
  • Certification to the FDA (§ 11.100(c)): before or at the time of first use, the organisation certifies to the FDA in writing that its electronic signatures are intended to be the legally binding equivalent of handwritten signatures; the certification is submitted on paper with a handwritten signature.[1]
  • Two-component identification (§ 11.200(a)): non-biometric signatures use at least two distinct identification components, such as a user ID and a password. Within one continuous session, the first signing requires all components and later signings at least one; outside such a session, every signing requires all components.[1]
  • Biometric signatures (§ 11.200(b)): they must be designed so that they cannot be used by anyone other than their genuine owner.[1]
  • Controls for identification codes and passwords (§ 11.300): unique combinations, periodic review, loss management procedures, safeguards against unauthorised use and reporting of attempted misuse.[1]

How does Part 11 apply in clinical investigations?

For clinical research, the final FDA guidance “Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations – Questions and Answers” (October 2024) explains how Part 11 applies; its availability was announced in the Federal Register on 2 October 2024.[3][4] Addressed to sponsors, investigators, IRBs and CROs, it answers 29 questions on electronic records, electronic systems deployed by regulated entities, IT service providers, digital health technologies and electronic signatures.[3] Key points are a risk-based approach to validation, the regulated entity’s responsibility even when IT services are outsourced, and the principle that the FDA does not certify electronic systems or signature methods.[3] How Part 11 interacts with the trial master file in day-to-day trial work is covered in the article on TMF and eTMF; the wider framework is explained in the article on Good Clinical Practice.

How do Part 11, EU GMP Annex 11 and eIDAS differ?

EU GMP Annex 11 (Computerised Systems), in its 2011 version, has applied since 30 June 2011 to all computerised systems used in GMP-regulated activities.[5] Annex 11 requires audit trails based on a risk assessment and states that electronic signatures have the same impact as handwritten signatures within the company, are permanently linked to their record and include the date and time.[5] On 7 July 2025, the European Commission and PIC/S published a draft of a fully revised Annex 11, together with a new Annex 22 (artificial intelligence) and a revised Chapter 4; the consultation closed on 7 October 2025.[6] As of November 2026, the revision has not entered into force; the 2011 version remains applicable and the 2025 text is a draft.[6] In addition, the PIC/S documents PI 011 (computerised systems) and PI 041 (data management and integrity) describe inspectorate expectations.[9][10]

The eIDAS Regulation (EU) No 910/2014 distinguishes simple, advanced and qualified electronic signatures. An advanced signature is uniquely linked to and capable of identifying the signatory, is created using means under the signatory’s sole control and makes any subsequent change detectable (Article 26); only the qualified signature has the equivalent legal effect of a handwritten signature (Article 25(2)).[7] The amending Regulation (EU) 2024/1183 (eIDAS 2.0) entered into force on 20 May 2024 and introduces, among other things, the European Digital Identity Wallet.[8]

Overview: 21 CFR Part 11, EU GMP Annex 11 and eIDAS
Feature21 CFR Part 11EU GMP Annex 11eIDAS (Reg. 910/2014, 2024/1183)
Legal natureUS federal regulationGMP guideline (EudraLex Vol. 4)EU regulation, directly applicable
SubjectElectronic records and signatures under predicate rulesLife cycle of computerised systems in GMPElectronic identification and trust services
Signature conceptElectronic signature with manifestation, linking, two componentsElectronic signature with the same impact as handwritten within the companySimple, advanced, qualified signature
Audit trailRequired (§ 11.10(e)); enforcement discretion under 2003 guidanceBased on a risk assessmentNot regulated
ValidationRequired (§ 11.10(a))Required, life-cycle basedNot regulated; conformity assessment for qualified services
Current statusIn force since 19972011 version in force; revision in draft (July 2025)In force; eIDAS 2.0 since 20 May 2024

Which misconceptions and inspection findings are typical?

  • “The software is Part 11 certified.” The FDA does not certify electronic systems; what counts is validated use by the regulated company.[3]
  • “Part 11 applies to every electronic document.” Its scope is limited to records under predicate rules and electronic submissions.[1][2]
  • “Enforcement discretion means an audit trail is optional.” The predicate rules remain fully enforceable, and Annex 11 requires audit trails based on a risk assessment.[2][5]
  • “A qualified electronic signature automatically meets Part 11.” eIDAS governs the legal effect of a signature, not validation, audit trail or signature meaning as required by Part 11.[1][7]

In practice, the FDA mostly cites data integrity deficiencies under the predicate rules. Sakara Digital (Amie Harpe, 6 October 2026) reviewed the 96 CDER manufacturing-quality warning letters issued in 2026 and posted by 29 September. Of these, 24 letters cited data integrity (“one in four”), 8 of which included findings on system access, audit trails or electronic data retention; none of the 24 letters cited Part 11 itself.[11] In the Bioresearch Monitoring programme, 609 clinical investigator inspections received a final classification in fiscal year 2024: 484 NAI, 110 VAI and 15 OAI.[12]

Software solutions for Part 11 compliant electronic signatures

The following solutions are listed alphabetically and described without evaluation; all information is taken from the vendors.

Cygnature (Cygnet, CFR module): According to the vendor, the Cygnature CFR module is designed for 21 CFR Part 11, EU Annex 11 and GAMP 5.[13] Stated features include access for authorised individuals only, a computer-generated, time-stamped audit trail, a signature manifestation with name, date, time and reason, and signer authentication with an access code and password at signing.[13] The vendor states that signed documents are additionally protected against tampering using blockchain technology.[13]

DocuSign (Life Sciences Module): According to the vendor, the Part 11 Module is an enhancement of DocuSign eSignature for regulated life sciences processes.[14] It comprises a pre-packaged account configuration, signature-level credentialing, a signing reason, a signature manifestation with printed name, time stamp and reason, a detailed audit trail and a tamper-evident digital signature.[14] The vendor describes the module as part of an open system solution within the meaning of Part 11.[15]

Docuply: Docuply is an eQMS from a vendor based in Mannheim, Germany, whose electronic signature is designed for 21 CFR Part 11 and EU GMP Annex 11 according to the vendor.[16] The vendor cites an audit trail with chained entries and continuous pre-validation with included IQ/OQ documentation and a PQ/UAT template.[16] According to the vendor, hosting takes place in the EU (Germany).[16]

Note: Part 11 compliance depends on validated use by the regulated user, not on the tool alone. The intended-use assessment, validation in the user’s own process, SOPs, training, user administration and the certification under § 11.100(c) remain with the regulated company.[1][3]

Frequently asked questions (FAQ)

Is every electronic signature Part 11 compliant?

No. A signature meets Part 11 only if manifestation, linking to the record, uniqueness, identity verification, the identification component requirements and the certification to the FDA are in place and the system is operated in a validated state.[1]

Does Part 11 apply to European companies?

Yes, where they keep or submit records that fall under FDA regulations, for example as manufacturers supplying the US market or as sponsors or sites of a study conducted under an IND.[1][3]

What is the difference between Part 11 and Annex 11?

Part 11 is a US regulation for electronic records and signatures under predicate rules; Annex 11 is an EU GMP guideline covering the whole life cycle of computerised systems, and its revision currently exists as a draft.[1][5][6]

Does a Part 11 signature require two-factor authentication?

Part 11 requires at least two distinct identification components for non-biometric signatures, such as a user ID and a password; it does not explicitly mandate two-factor authentication in today’s sense.[1] The draft revised Annex 11, by contrast, provides for multi-factor authentication for remote access.[6]

Further reading

References

  1. 21 CFR Part 11 – Electronic Records; Electronic Signatures. eCFR. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11 (accessed 5 November 2026)
  2. FDA. Guidance for Industry: Part 11, Electronic Records; Electronic Signatures – Scope and Application. August 2003. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application (accessed 5 November 2026)
  3. FDA. Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers. Guidance for Industry, October 2024. https://www.fda.gov/media/166215/download (accessed 5 November 2026)
  4. Federal Register. Notice of availability, document 2024-22562, 2 October 2024. https://www.federalregister.gov/documents/2024/10/02/2024-22562/electronic-systems-electronic-records-and-electronic-signatures-in-clinical-investigations-questions (accessed 5 November 2026)
  5. European Commission. EudraLex Volume 4, Annex 11: Computerised Systems (2011). https://health.ec.europa.eu/system/files/2016-11/annex11_01-2011_en_0.pdf (accessed 5 November 2026)
  6. European Commission. EudraLex Volume 4 – Good Manufacturing Practice guidelines (including the consultation on draft Annex 11, Annex 22 and Chapter 4, July 2025). https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en (accessed 5 November 2026)
  7. Regulation (EU) No 910/2014 (eIDAS). https://eur-lex.europa.eu/eli/reg/2014/910/oj (accessed 5 November 2026)
  8. Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014. https://eur-lex.europa.eu/eli/reg/2024/1183/oj (accessed 5 November 2026)
  9. PIC/S. PI 011-3: Good Practices for Computerised Systems in Regulated “GxP” Environments. https://picscheme.org/en/publications (accessed 5 November 2026)
  10. PIC/S. PI 041-1: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. https://picscheme.org/en/publications (accessed 5 November 2026)
  11. Harpe A. Data Integrity Warning Letters in 2026: The Patterns Behind the Numbers. Sakara Digital, 6 October 2026. https://sakaradigital.com/blog/data-integrity-warning-letters-2026-patterns/ (accessed 5 November 2026)
  12. FDA. Bioresearch Monitoring (BIMO) Fiscal Year 2024 Metrics. https://www.fda.gov/media/192870/download (accessed 5 November 2026)
  13. Cygnet.One. Cygnature’s 21 CFR – How to stay compliant with 21 CFR part 11 regulation? https://www.cygnature.io/blog/cygnatures-21-cfr-how-to-stay-compliant-with-21-cfr-part-11-regulation/ (accessed 5 November 2026)
  14. Docusign. Docusign Part 11 Module Overview. https://support.docusign.com/s/document-item?bundleId=tja1628891649386&topicId=jku1583277398949.html (accessed 5 November 2026)
  15. Docusign. Contract Management and eSignature for Life Sciences. https://www.docusign.com/solutions/industries/life-sciences (accessed 5 November 2026)
  16. Docuply. 21 CFR Part 11 Electronic Signatures: Compliance Guide and Vendor Comparison 2026. https://docuply.io/en/21-cfr-part-11-electronic-signatures-guide/ (accessed 5 November 2026)