FDA Guidance on Electronic Systems, Records, and Signatures in Clinical Trials

The FDA guidance on electronic systems in clinical investigations—formally titled Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers — Guidance for Industry (Final Guidance, October 2024, read 2026-11-10 at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-systems-electronic-records-and-electronic-signatures-clinical-investigations-questions)—establishes the U.S. Food and Drug Administration’s modern inspection and computer system validation (CSV) framework under 21 CFR Part 11. Superseding the agency’s May 2007 Computerized Systems Used in Clinical Investigations guidance and complementing the September 2013 Electronic Source Data in Clinical Investigations guidance (read 2026-11-10 at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-source-data-clinical-investigations), the October 2024 Final Guidance uses 28 structured Questions and Answers (Q&As) to clarify how sponsors, clinical investigators, contract research organizations (CROs), and technology service providers must validate and govern electronic data capture (EDC), electronic clinical outcome assessment (eCOA), ePRO in clinical trials, electronic health records (EHRs), and digital health technologies (DHTs).

What does the FDA’s October 2024 Final Guidance on Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations require?

Organized into five thematic sections across 28 Q&As, the October 2024 Final Guidance defines a risk-based approach to validation, audit trails, data provenance, and electronic signatures under 21 CFR Part 11 (read 2026-11-10 at https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11) for clinical investigations of medical products (IND, IDE, NDA, BLA, 510(k), De Novo, and PMA submissions):

1. Section III.A — Electronic Health Records (EHRs) as Source (`Q1–Q5`): Clarifies when clinical trial sites use institutional EHRs to capture source data, how EHR-to-EDC interoperable pipelines must preserve source data attribution, and why clinical investigators must retain inspection-ready access to source records throughout the statutory retention period (`21 CFR §§ 312.62(c)` and `812.140(d)`).
2. Section III.B — Electronic Systems Owned or Managed by Sponsors, Clinical Sites, or Other Regulated Entities (`Q6–Q16`): Establishes risk-based Computer System Validation (`21 CFR § 11.10(a)`), user access management, change control, system decommissioning/archiving (`21 CFR § 11.10(b)–(c)`), and computer-generated, time-stamped audit trails (`21 CFR § 11.10(e)`) that capture the author, date/time (with time-zone normalization or UTC), original value, modified value, and reason for change without obscuring prior entries.
3. Section III.C — Information Technology Service Providers and Cloud Vendors (`Q17–Q19`): Specifies that when sponsors or clinical sites outsource cloud hosting, SaaS EDC, IRT/RTSM, or eCOA platforms to commercial IT service providers, the regulated entity retains ultimate regulatory responsibility and must execute written service agreements, verify vendor validation documentation, and ensure FDA inspection access.
4. Section III.D — Digital Health Technologies (`Q20–Q23`): Requires end-to-end data provenance from the originating wearable sensor or mobile application to the durable electronic repository, mandating attribution to the specific trial participant and preservation of the first durable electronic record.
5. Section III.E — Electronic Signatures (`Q24–Q28`): Operationalizes 21 CFR §§ 11.50, 11.70, 11.100, and 11.200, covering biometric signatures, multi-factor non-biometric electronic signatures (at least two distinct identification components such as user ID + password/token), identity verification prior to credential issuance, and commercially available electronic signature platforms (such as DocuSign or Adobe Sign configured for Part 11 compliance).

How does the FDA distinguish Sponsor vs. Clinical Site responsibilities for validating EDC, EHR, DHT, and IRT systems under 21 CFR Part 11?

A critical contribution of the October 2024 Final Guidance (`Q6–Q12`) is eliminating duplicated validation work between trial sponsors and clinical investigative sites by allocating validation ownership according to who deploys, configures, and controls the electronic system—and according to the criticality and risk of the trial records.

Electronic System Category	System Owner / Controller	Sponsor Validation & Oversight Responsibility	Clinical Site / Investigator Responsibility
Sponsor-Provided EDC, eCOA/ePRO, and IRT/RTSM Systems	Sponsor (or CRO / SaaS vendor contracted by Sponsor)	Perform full risk-based Part 11 validation (`21 CFR § 11.10(a)`), UAT of protocol-specific eCRF edit checks and randomization logic, vendor qualification (`Q17–Q19`), and lifecycle change control.	Site does not re-validate sponsor-provided systems; site ensures authorized personnel complete training, maintain individual login credentials, and review/sign eCRFs accurately.
Site-Owned CTMS, eISF (Electronic Investigator Site File), or Local Site eConsent	Clinical Site / Academic Medical Center	Before initiating the trial, Sponsor evaluates whether a site-deployed system that captures critical trial records is fit for purpose and compliant with Part 11 (`Q7`).	Site maintains validation documentation, role-based access controls, backup/recovery SOPs, and audit trails for its own local electronic systems.
Institutional Electronic Health Record (EHR) Used in Routine Care	Hospital / Healthcare Delivery Organization	Sponsor does not validate the hospital’s EHR; Sponsor verifies only the protocol-specific EHR-to-EDC integration software if automated transfer is used (`Q2–Q3`).	Investigator ensures FDA inspectors can view original EHR records (including EHR audit logs if needed to reconstruct clinical events) during BIMO inspections (`Q4–Q5`).
Digital Health Technologies (DHTs) & Mobile Apps (`Q20–Q23`)	Sponsor / Device Manufacturer (or Participant BYOD hardware)	Validate data transmission pipeline, cloud ingestion repository, timestamp synchronization, and algorithm lock (`Q20–Q23`), aligned with Digital Medicine Society V3 standards.	Train participants on device wear/use and verify participant identity linkage when assigning sensor serial numbers or provisioning app accounts.

Why are electronic health records (EHRs) generally exempt from 21 CFR Part 11 inspection while EHR-to-EDC eSource integration pipelines are not?

In Section III.A (`Q1–Q5`) of the October 2024 Final Guidance—building on the FDA’s July 2018 Use of Electronic Health Record Data in Clinical Investigations guidance and the September 2013 Electronic Source Data in Clinical Investigations (`eSource`) guidance—the FDA explicitly states that it does not intend to assess institutional EHR systems for compliance with 21 CFR Part 11. Because hospital and clinic EHRs are operational healthcare delivery systems regulated under ONC Health IT Certification criteria (`45 CFR Part 170`) and HIPAA Security Rule safeguards (`45 CFR Part 164 Subpart C`), subjecting every hospital EHR to pharmaceutical Part 11 computer system validation would paralyze site participation.

However, the Part 11 enforcement discretion ends at the boundary where EHR data enter the clinical investigation’s regulated data pipeline (`Q2–Q3`). When a trial utilizes EHR integration (such as HL7 FHIR R4 `US Core` queries or IHE Retrieve Form for Data Capture `RFD`) to auto-populate electronic case report forms (`eCRFs`), two distinct regulatory boundaries apply:

• The Originator and Source Record remain the EHR: Under the 2013 FDA `eSource` guidance, when laboratory values, vital signs, or concomitant medications are extracted from the hospital EHR into the eCRF, the EHR is the source. The electronic data element identifier must record the EHR as the originator and capture the exact date and time of the automated transfer into the eCRF.
• The EHR-to-EDC Integration Middleware and EDC Repository ARE Subject to `21 CFR Part 11`: Sponsors must validate the software interface or FHIR connector that extracts, maps, transforms (e.g., unit conversions or terminology mappings), and loads data from the EHR into the EDC system, ensuring that data are not altered or corrupted in transit and that the clinical investigator can review, modify (with an audited reason for change), and electronically sign the imported eCRF records.

Frequently Asked Questions

What does the FDA’s October 2024 Final Guidance on Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations require?

Published in October 2024 across 28 Q&As (superseding the May 2007 computerized systems guidance), it requires risk-based validation (`21 CFR § 11.10(a)`), immutable time-stamped audit trails (`§ 11.10(e)`), formal qualification and written agreements for cloud/SaaS IT service providers (`Q17–Q19`), end-to-end provenance from the first durable electronic record for DHTs (`Q20–Q23`), and identity-verified biometric or two-component electronic signatures (`Q24–Q28`).

How does the FDA distinguish Sponsor vs. Clinical Site responsibilities for validating EDC, EHR, DHT, and IRT systems under 21 CFR Part 11?

Validation responsibility follows system ownership and protocol configuration control: sponsors validate sponsor-provided EDC, eCOA, IRT, and DHT ingestion systems (sites do not re-validate them), while clinical sites validate site-owned systems (such as local eISF or eConsent systems) with sponsor pre-trial assessment of systems capturing critical trial records (`Q6–Q12`).

Why are electronic health records (EHRs) generally exempt from 21 CFR Part 11 inspection while EHR-to-EDC eSource integration pipelines are not?

Under `Q1–Q5` of the October 2024 guidance, the FDA exercises enforcement discretion and does not inspect hospital EHRs for `21 CFR Part 11` compliance because they are clinical care systems governed by ONC certification and HIPAA. However, any software connector or FHIR pipeline that transfers, transforms, or loads EHR data into the clinical trial’s EDC `eCRF` is a regulated trial system and must be validated for data integrity, provenance, and investigator review.