21 CFR Part 11: Electronic Records & Signatures

21 CFR Part 11 is the FDA regulation (Title 21, Code of Federal Regulations, Part 11) that sets out the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records and handwritten signatures for any record an FDA regulation (“predicate rule”) requires a regulated organization to create, modify, maintain, archive, retrieve, or transmit. It does not create new record-keeping obligations on its own — it governs the electronic form of records that some other FDA regulation (Good Clinical Practice, Good Manufacturing Practice, Good Laboratory Practice, or a specific reporting requirement) already requires. The rule took effect August 20, 1997 and sits in Subchapter A of Title 21, applying across FDA-regulated industries — drugs, biologics, medical devices, and food — not to clinical research alone.

What Part 11 covers: three subparts

The regulation is organized into three subparts:

• Subpart A — General Provisions (§§11.1–11.3): states the rule’s scope and defines its core terms, including “closed system” (access controlled by the people responsible for the system’s content) and “open system” (access not controlled by those people).
• Subpart B — Electronic Records (§§11.10–11.70): the controls a closed or open system must implement — validation, audit trails, access limitation, record retention/copying, and how a signature must be linked to its record.
• Subpart C — Electronic Signatures (§§11.100–11.300): the general requirements for electronic signatures and, for non-biometric signatures, the identification-code-and-password controls that make them legally attributable to a specific individual.

Core requirements at a glance

The most-cited provisions, per §11.10 (“Controls for closed systems”) and the electronic-signature subpart:

• Validation (§11.10(a)) — the system must be validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
• Audit trails (§11.10(e)) — secure, computer-generated, time-stamped audit trails that independently record the date, time, and content of operator entries and actions that create, modify, or delete an electronic record, without obscuring previously recorded information.
• Access limitation (§11.10(d)) — system access restricted to authorized individuals, with authority checks (§11.10(g)) confirming only authorized people can sign a record, alter data, or perform a given operation.
• Signature manifestations (§11.50) — a signed electronic record must display, in both the electronic and any printed form, the signer’s printed name, the date and time the signature was executed, and the meaning associated with it (e.g., review, approval, responsibility, authorship).
• Signature/record linking (§11.70) — an electronic signature must be linked to its record so it cannot be excised, copied, or otherwise transferred to falsify another record.
• Electronic signature components and controls (§11.200) — a non-biometric electronic signature must employ at least two distinct identification components (typically an identification code plus a password), used together only at the first signing of a session, with the identification code and password individually secured against use by anyone other than the genuine owner (§11.300).

Why it matters for clinical research specifically

Clinical trial data is almost always created and stored electronically today, and most of the systems that touch it are within Part 11’s reach because they hold records an FDA predicate rule (chiefly the Good Clinical Practice framework at 21 CFR Parts 50, 56, and 312) already requires sponsors and investigators to keep:

• Electronic Case Report Forms (eCRFs) in EDC systems — the data-capture layer of a clinical data management workflow. Part 11 is why an EDC platform needs a validated, audit-trailed change history for every field edit and a two-component login before a coordinator’s or investigator’s electronic signature on a completed CRF is legally attributable to them.
• Clinical Trial Management System (CTMS) records — operational trial data such as monitoring visit reports, site regulatory documents, and enrollment tracking held in a CTMS. Where a CTMS is used to satisfy a predicate record-keeping requirement (rather than purely as an internal planning tool), the same validation/audit-trail/access-control expectations apply.
• Electronic informed consent (eConsent) — a participant’s electronically captured signature on an IRB/REC-approved consent form must meet the same signature-manifestation and signature/record-linking requirements as any other Part 11 signature, in addition to satisfying the separate informed-consent requirements of ICH GCP and 21 CFR Part 50.

In practice, Part 11 compliance is one of the standard evaluation criteria research teams and IT/quality staff apply when selecting or validating EDC, CTMS, and eConsent platforms for FDA-regulated trials, alongside data-privacy and interoperability requirements.

The 2003 guidance: a genuinely narrower scope than the 1997 rule suggests

The 1997 rule, read literally, is broad enough to sweep in far more electronic records and signatures than FDA actually intended to police closely, and industry said so. In response, FDA issued a guidance document, “Part 11, Electronic Records; Electronic Signatures — Scope and Application” (September 2003), explaining its current thinking on how narrowly it interprets and enforces the rule. Two points from that guidance are frequently misunderstood or omitted in casual explanations of Part 11:

• A narrowed scope test. FDA stated it would interpret Part 11’s scope narrowly: it applies to a record only when (1) an existing predicate rule requires that record to be kept or submitted, and (2) the record is being maintained in electronic format in place of paper. A record kept on paper to satisfy the predicate requirement, with an electronic copy retained only as a convenience or backup, is not treated as a Part 11 record subject to the rule’s full electronic-record controls.
• Enforcement discretion on specific controls. For records that do fall within this narrowed scope, FDA said it did not intend to take enforcement action over the validation, audit trail, record-retention, and record-copying requirements of Part 11 — and, for systems that were already operational before the rule’s effective date (legacy systems), extended enforcement discretion to the electronic-signature requirements too, under conditions described in the guidance. Access controls (§11.10(d)) remained the part most consistently enforced in practice.

Critically, the guidance is FDA’s stated “current thinking,” not a change to the regulatory text itself, and it does not relax the predicate rule underneath it: whatever GCP, GMP, or GLP requirement created the record-keeping obligation in the first place still applies in full, and FDA can act on noncompliance with that predicate rule regardless of how the electronic-record question shakes out. In effect, the 2003 guidance narrows what triggers Part 11’s own additional layer of controls — it does not narrow GCP itself.

Worked examples

• An EDC system used to capture eCRF data for an FDA-regulated interventional trial logs every field-level edit in a time-stamped audit trail and requires a coordinator to enter a unique username and password before an electronic signature approving a completed CRF becomes attributable to that individual — this is Part 11 operating as intended, on a record the GCP predicate rule requires the sponsor to keep.
• An eConsent platform captures a participant’s electronic signature on the current, IRB-approved version of a consent form. The signature manifestation displayed and stored includes the participant’s printed name, the date and time of signing, and the statement of consent it applies to, non-detachably linked to that specific document version.

Counter-example: A site scans a wet-ink-signed paper case report form and emails the PDF to the sponsor as a convenience copy, while the paper original remains the record retained to satisfy the predicate rule. Per the 2003 guidance’s scope test, that scanned image is not itself being used “in place of” the paper record, so it does not trigger Part 11’s full validation/audit-trail control set on its own — though the underlying GCP source-documentation requirements for the paper original still apply in full.

References

• 21 CFR Part 11 — Electronic Records; Electronic Signatures, eCFR/Cornell Legal Information Institute
• FDA Guidance for Industry, Part 11, Electronic Records; Electronic Signatures — Scope and Application (September 2003)
• ICH E6(R2) Good Clinical Practice — the GCP predicate rule most commonly paired with Part 11 in clinical trials
• 21 CFR Parts 50, 56, 312 — the clinical-trial record-keeping requirements Part 11’s electronic-record controls apply to when records are kept electronically