21 CFR Part 11: Electronic Records & Signatures

21 CFR Part 11 is the FDA regulation (Title 21, Code of Federal Regulations, Part 11) that sets out the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records and handwritten signatures for any record an FDA regulation (“predicate rule”) requires a regulated organization to create, modify, maintain, archive, retrieve, or transmit. It does not create new record-keeping obligations on its own — it governs the electronic form of records that some other FDA regulation (Good Clinical Practice, Good Manufacturing Practice, Good Laboratory Practice, or a specific reporting requirement) already requires. The rule took effect August 20, 1997 and sits in Subchapter A of Title 21, applying across FDA-regulated industries — drugs, biologics, medical devices, and food — not to clinical research alone.

What Part 11 covers: three subparts

The regulation is organized into three subparts:

• Subpart A — General Provisions (§§11.1–11.3): states the rule’s scope and defines its core terms, including “closed system” (access controlled by the people responsible for the system’s content) and “open system” (access not controlled by those people).
• Subpart B — Electronic Records (§§11.10–11.70): the controls a closed or open system must implement — validation, audit trails, access limitation, record retention/copying, and how a signature must be linked to its record.
• Subpart C — Electronic Signatures (§§11.100–11.300): the general requirements for electronic signatures and, for non-biometric signatures, the identification-code-and-password controls that make them legally attributable to a specific individual.

Core requirements at a glance

The most-cited provisions, per §11.10 (“Controls for closed systems”) and the electronic-signature subpart:

• Validation (§11.10(a)) — the system must be validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
• Audit trails (§11.10(e)) — secure, computer-generated, time-stamped audit trails that independently record the date, time, and content of operator entries and actions that create, modify, or delete an electronic record, without obscuring previously recorded information.
• Access limitation (§11.10(d)) — system access restricted to authorized individuals, with authority checks (§11.10(g)) confirming only authorized people can sign a record, alter data, or perform a given operation.
• Signature manifestations (§11.50) — a signed electronic record must display, in both the electronic and any printed form, the signer’s printed name, the date and time the signature was executed, and the meaning associated with it (e.g., review, approval, responsibility, authorship).
• Signature/record linking (§11.70) — an electronic signature must be linked to its record so it cannot be excised, copied, or otherwise transferred to falsify another record.
• Electronic signature components and controls (§11.200) — a non-biometric electronic signature must employ at least two distinct identification components (typically an identification code plus a password), used together only at the first signing of a session, with the identification code and password individually secured against use by anyone other than the genuine owner (§11.300).

Why it matters for clinical research specifically

Clinical trial data is almost always created and stored electronically today, and most of the systems that touch it are within Part 11’s reach because they hold records an FDA predicate rule (chiefly the Good Clinical Practice framework at 21 CFR Parts 50, 56, and 312) already requires sponsors and investigators to keep:

• Electronic Case Report Forms (eCRFs) in EDC systems — the data-capture layer of a clinical data management workflow. Part 11 is why an EDC platform needs a validated, audit-trailed change history for every field edit and a two-component login before a coordinator’s or investigator’s electronic signature on a completed CRF is legally attributable to them.
• Clinical Trial Management System (CTMS) records — operational trial data such as monitoring visit reports, site regulatory documents, and enrollment tracking held in a CTMS. Where a CTMS is used to satisfy a predicate record-keeping requirement (rather than purely as an internal planning tool), the same validation/audit-trail/access-control expectations apply.
• Electronic informed consent (eConsent) — a participant’s electronically captured signature on an IRB/REC-approved consent form must meet the same signature-manifestation and signature/record-linking requirements as any other Part 11 signature, in addition to satisfying the separate informed-consent requirements of ICH GCP and 21 CFR Part 50.

In practice, Part 11 compliance is one of the standard evaluation criteria research teams and IT/quality staff apply when selecting or validating EDC, CTMS, and eConsent platforms for FDA-regulated trials, alongside data-privacy and interoperability requirements.

The 2003 guidance: a genuinely narrower scope than the 1997 rule suggests

The 1997 rule, read literally, is broad enough to sweep in far more electronic records and signatures than FDA actually intended to police closely, and industry said so. In response, FDA issued a guidance document, “Part 11, Electronic Records; Electronic Signatures — Scope and Application” (September 2003), explaining its current thinking on how narrowly it interprets and enforces the rule. Two points from that guidance are frequently misunderstood or omitted in casual explanations of Part 11:

• A narrowed scope test. FDA stated it would interpret Part 11’s scope narrowly: it applies to a record only when (1) an existing predicate rule requires that record to be kept or submitted, and (2) the record is being maintained in electronic format in place of paper. A record kept on paper to satisfy the predicate requirement, with an electronic copy retained only as a convenience or backup, is not treated as a Part 11 record subject to the rule’s full electronic-record controls.
• Enforcement discretion on specific controls. For records that do fall within this narrowed scope, FDA said it did not intend to take enforcement action over the validation, audit trail, record-retention, and record-copying requirements of Part 11 — and, for systems that were already operational before the rule’s effective date (legacy systems), extended enforcement discretion to the electronic-signature requirements too, under conditions described in the guidance. Access controls (§11.10(d)) remained the part most consistently enforced in practice.

Critically, the guidance is FDA’s stated “current thinking,” not a change to the regulatory text itself, and it does not relax the predicate rule underneath it: whatever GCP, GMP, or GLP requirement created the record-keeping obligation in the first place still applies in full, and FDA can act on noncompliance with that predicate rule regardless of how the electronic-record question shakes out. In effect, the 2003 guidance narrows what triggers Part 11’s own additional layer of controls — it does not narrow GCP itself.

Applies beyond clinical trials: GLP and GMP laboratories

Part 11 is not a clinical-research-only rule. Any FDA-regulated laboratory activity governed by a predicate rule is in scope whenever its records are kept electronically in place of paper: nonclinical safety studies under Good Laboratory Practice (21 CFR Part 58), and manufacturing/quality records under Good Manufacturing Practice (21 CFR Parts 210-211). A GLP toxicology lab’s raw instrument data and a GMP quality-control lab’s batch-release testing records fall under the same validation, audit-trail, and signature-manifestation controls described above as an EDC or eConsent system does in a clinical trial. This is the reason Part 11 is a standard requirement when validating a laboratory information management system (LIMS) or an electronic lab notebook (ELN) for GxP use, not just clinical-trial software; the underlying computer system validation (CSV) lifecycle (installation, operational, and performance qualification, IQ/OQ/PQ) is the same regardless of which predicate rule triggers it.

How Part 11’s controls map to ALCOA+ data integrity principles

Part 11’s specific technical controls are the electronic-system implementation of a broader set of data integrity expectations that FDA and other regulators apply across all GxP records, commonly organized under the ALCOA+ mnemonic (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available). Each maps onto a concrete Part 11 requirement rather than standing apart from it:

• Attributable — delivered by §11.10(d)/(g) access limitation and authority checks, and by the two-component identification-code-and-password requirement of §11.200: every entry and every signature must be traceable to a specific, authenticated individual.
• Contemporaneous and Legible — delivered by the §11.10(e) audit trail, which time-stamps operator actions as they occur and keeps the record human-readable rather than obscuring what was originally entered.
• Original and Accurate — delivered by §11.10(a) validation (confirming the system reliably produces accurate, unaltered records) and §11.10(b), which requires the system to generate accurate and complete copies of records in both human-readable and electronic form.
• Complete, Consistent, and Enduring — delivered by §11.10(c) protection of records for their full retention period and by the audit trail’s prohibition on obscuring previously recorded information, so the record’s full history persists rather than being overwritten.
• Available — delivered by §11.10(b)’s requirement that records remain readily retrievable throughout the required retention period, including for inspection.

In practice, a Part 11 validation effort and an ALCOA+ data-integrity assessment are largely the same exercise viewed from two angles: Part 11 specifies the electronic-system controls; ALCOA+ is the data-quality outcome those controls exist to guarantee. An auditor citing an “ALCOA+ deficiency” in an electronic system is very often describing a gap traceable to a specific Part 11 subsection above.

Worked examples

• An EDC system used to capture eCRF data for an FDA-regulated interventional trial logs every field-level edit in a time-stamped audit trail and requires a coordinator to enter a unique username and password before an electronic signature approving a completed CRF becomes attributable to that individual — this is Part 11 operating as intended, on a record the GCP predicate rule requires the sponsor to keep.
• An eConsent platform captures a participant’s electronic signature on the current, IRB-approved version of a consent form. The signature manifestation displayed and stored includes the participant’s printed name, the date and time of signing, and the statement of consent it applies to, non-detachably linked to that specific document version.

Counter-example: A site scans a wet-ink-signed paper case report form and emails the PDF to the sponsor as a convenience copy, while the paper original remains the record retained to satisfy the predicate rule. Per the 2003 guidance’s scope test, that scanned image is not itself being used “in place of” the paper record, so it does not trigger Part 11’s full validation/audit-trail control set on its own — though the underlying GCP source-documentation requirements for the paper original still apply in full.

References

• 21 CFR Part 11 — Electronic Records; Electronic Signatures, eCFR/Cornell Legal Information Institute
• FDA Guidance for Industry, Part 11, Electronic Records; Electronic Signatures — Scope and Application (September 2003)
• ICH E6(R2) Good Clinical Practice — the GCP predicate rule most commonly paired with Part 11 in clinical trials
• 21 CFR Parts 50, 56, 312 — the clinical-trial record-keeping requirements Part 11’s electronic-record controls apply to when records are kept electronically

Frequently Asked Questions

What does 21 CFR 11.50 require for signature manifestations?

Per §11.50, a signed electronic record must display the signer’s printed name, the date and time the signature was executed, and the meaning associated with the signature — such as review, approval, responsibility, or authorship — in both the electronic and any printed form of the record.

When did 21 CFR Part 11 take effect?

The rule took effect August 20, 1997, and sits in Subchapter A of Title 21 of the Code of Federal Regulations, applying across FDA-regulated industries rather than to clinical research alone.

What is a “closed system” under 21 CFR Part 11?

Subpart A (§§11.1–11.3) defines a closed system as one where access is controlled by the people responsible for the content of the electronic records on that system, as distinct from an “open system,” where access is not controlled by those people.

Does 21 CFR Part 11 apply to EDC systems used for eCRFs?

Yes. Electronic Case Report Form data captured in an EDC system is a record that the GCP predicate rule (21 CFR Parts 50, 56, 312) already requires sponsors and investigators to keep, which is why an EDC platform needs a validated, audit-trailed change history for every field edit and a two-component login before an electronic signature on a completed CRF becomes legally attributable to the signer.

What does Subpart B of 21 CFR Part 11 cover?

Subpart B (§§11.10–11.70) sets out the controls a closed or open electronic-records system must implement: validation, audit trails, access limitation, record retention and copying, and how a signature must be linked to its record.

How long must records be retained under 21 CFR Part 11?

Part 11 itself does not set a retention period. Section 11.10(c) requires that records be protected so they remain available throughout whatever retention period the underlying predicate rule — GCP, GMP, or GLP — already specifies for that record.