21 CFR Part 11: requirements, compliance checklist and how often FDA cites it

21 CFR Part 11 is the FDA regulation that sets the conditions under which electronic records and electronic signatures are treated as trustworthy, reliable and equivalent to paper records and handwritten signatures. It applies to records that FDA rules require a company to keep or submit, and it has been in force since August 20, 1997.

Most Part 11 guides stop at the rule text. This one adds what FDA investigators wrote on inspections closed from January 2025 to October 2026, from the FDA inspection citation records Atlas tracks (pulled October 21, 2026), so you can see where Part 11 risk turns into a Form 483.

Key facts:

• Part 11 has three subparts: general provisions (11.1 to 11.3), electronic records (11.10 to 11.70) and electronic signatures (11.100 to 11.300). It was published at 62 FR 13464 on March 20, 1997.
• FDA's August 2003 guidance, Part 11, Electronic Records; Electronic Signatures: Scope and Application, narrowed how FDA reads the rule and put the validation, audit trail, record retention and record copying requirements under enforcement discretion.
• Access controls, operational and authority checks, training, accountability, documentation controls and every electronic signature provision stayed enforceable.
• Of 7,377 FDA inspections with citations closed from January 2, 2025 to October 9, 2026, only 3 cited 21 CFR Part 11.
• In the same window, 196 of 774 drug inspections that cited Part 211 (25.3%) cited 21 CFR 211.68(b) or 211.194, the drug CGMP sections for computer controls and laboratory records.
• Electronic signature users must send FDA a signed certification that their electronic signatures are the legally binding equivalent of handwritten signatures, under 11.100(c).

What is 21 CFR Part 11?

21 CFR Part 11 is a short regulation, ten sections in three subparts, that tells FDA-regulated companies how to make electronic records and signatures as reliable as paper. Subpart B covers the records and Subpart C covers the signatures. The rule does not say which records you must keep; the predicate rules, such as 21 CFR Part 211 for drugs or Part 820 for devices, do that.

You can read the full text on eCFR, 21 CFR Part 11.

Who does 21 CFR Part 11 apply to?

21 CFR Part 11 applies to any company that keeps FDA-required records electronically or submits records to FDA electronically: drug and biologic manufacturers, device makers, contract laboratories, sponsors, CROs and clinical investigators. Section 11.1(b) ties the scope to "records requirements set forth in agency regulations", so Part 11 follows the predicate rule.

The 2003 Scope and Application guidance narrowed this further. FDA said it would apply Part 11 when a company keeps a predicate-rule record electronically in place of paper, or keeps both but relies on the electronic version for regulated work. It also applies to electronic records submitted to FDA and to electronic signatures meant to stand in for handwritten ones. A paper record that was only faxed or emailed is outside Part 11 under 11.1(b).

Sections 11.1(f) to (p) exempt some food records, such as those required only under Part 117 preventive controls or Part 112 produce safety.

What does 21 CFR 11.10 require?

21 CFR 11.10 requires eleven controls for closed systems, the systems where the company controls who gets access. Each control has a letter, and FDA's 2003 guidance treats four of them differently, so the last column below matters when you set priorities.

Enforcement discretion is narrower than it sounds. FDA said it would decide on audit trails case by case, and the drug CGMP rules still require complete laboratory data under 211.194(a) and controls over changes to master records under 211.68(b). An investigator who finds an audit trail switched off on a chromatography system will cite those sections. Our guide to OQ audit trail tests for computerized system validation lists the tests that prove 11.10(e) in practice.

Open systems, where outside parties control access, add the 11.30 measures, such as encryption and digital signature standards.

What are the electronic signature requirements in Part 11?

Part 11 electronic signature requirements sit in five sections: 11.50 and 11.70 in Subpart B, and 11.100, 11.200 and 11.300 in Subpart C. All five stayed enforceable after the 2003 guidance, so they are the part of the rule a company cannot relax.

1. Manifestation (11.50): every signed record shows the signer's printed name, the date and time, and the meaning of the signature, such as review, approval or authorship. The same details appear on screen and on printouts.
2. Linking (11.70): a signature is bound to its record so nobody can copy it to another record.
3. Uniqueness and identity (11.100(a) and (b)): each electronic signature belongs to one person, is never reused or reassigned, and the company verifies the person's identity before issuing it.
4. Certification (11.100(c)): before or when a company starts using electronic signatures, it certifies to FDA that they are the legally binding equivalent of handwritten signatures. The letter carries a handwritten signature, and FDA lists where to send it on its Letters of Non-Repudiation Agreement page.
5. Components (11.200): signatures not based on biometrics use at least two distinct components, such as an ID code and a password. In one continuous session, the first signing uses all components and later signings use at least one private component. Signatures outside a continuous session use all components every time.
6. Password and token controls (11.300): ID code and password pairs stay unique, are checked and revised periodically, are disabled when lost or compromised, and attempts at misuse are detected and reported.

Shared accounts break 11.100(a) and 11.300 at the same time. They are also the most common reason a drug investigator writes 211.68(b), because a shared login means the system cannot show who changed a record. Our analysis of data integrity citations on Form 483s breaks those findings down by section.

Is FDA still enforcing 21 CFR Part 11 after the 2003 guidance?

FDA still enforces 21 CFR Part 11. The 2003 Scope and Application guidance left the rule in force and limited enforcement discretion to four requirements: validation, audit trails, record retention and record copying. FDA also said it would use discretion for all Part 11 requirements on legacy systems, those in operation before August 20, 1997, under conditions the guidance sets out.

The guidance asked companies to base validation and audit trail decisions on a documented risk assessment and on what the predicate rule requires. That is the same reasoning behind risk-based computer software assurance; our comparison of CSA vs CSV shows how much evidence each system needs under that approach.

How often does FDA cite 21 CFR Part 11 on Form 483s?

FDA rarely cites 21 CFR Part 11 by number. In the FDA inspection citation records Atlas tracks, 22,208 citations from 7,377 inspections closed January 2, 2025 to October 9, 2026 (pulled October 21, 2026), only 3 inspections carried a Part 11 citation. Investigators write electronic record failures against the predicate rule instead.

The three Part 11 citations came from FDA's Part 11 Compliance program area, not from routine drug or device CGMP work. A contract testing laboratory, Intertek USA in Whitehouse, was cited in March 2025 for electronic records that did not meet audit trail requirements. Hacienda Mexican Foods was cited the same month for electronic records that were not trustworthy and reliable. APEXCM, a Tampa firm, received the broadest finding in September 2025, covering validation, access limits, system checks, accountability and signature controls.

Drug investigators reach for 211.68(b) instead. Of 134 citations under that paragraph, 104 used the observation title "Computer control of master formula records", 17 "input/output verification" and 10 a backup title. Recent examples with indexable records in the FDA Form 483 database:

The share held steady: 25.6% of Part 211 drug inspections in 2025 and 24.5% in January to October 2026 cited 211.68(b) or 211.194. Device software validation under 820.70(i) appeared only on 2025 inspections; from February 2, 2026, device inspections cite the QMSR, which reorganized Part 820 around ISO 13485. Our ALCOA principles guide maps each data integrity attribute to the section an investigator writes.

A Part 11 remediation plan is judged against 211.68(b), 211.194(a), 312.62 or the device equivalent, because those are the lines a 483 response has to answer. Before an inspection, check which of those sections the investigator assigned to your facility has cited elsewhere.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

21 CFR Part 11 compliance checklist: how do you check one system?

A Part 11 compliance check works system by system, starting from the predicate-rule records the system holds. Run these six steps on one GxP system, such as a chromatography data system or an electronic batch record, and repeat them for each system on your inventory.

1. Decide if Part 11 applies. List the predicate-rule records the system creates or holds, and whether the team relies on the electronic version or a signed printout. A hybrid record still needs the electronic raw data kept.
2. Validate for intended use. Scale the validation to risk and to the predicate rule, 211.68(b) for drug systems or the QMSR for device software, and keep the evidence where an investigator can see it.
3. Lock down access. Every user has a unique account, roles match job duties, administrators are separate from users, and leavers lose access the day they leave. This covers 11.10(d) and (g).
4. Prove the audit trail. Confirm the audit trail is on, cannot be disabled by users, records old and new values with a reason, and is reviewed before batch or data release under 11.10(e).
5. Control signatures. Check that signed records show name, date, time and meaning (11.50), that signing uses two components (11.200), and that the 11.100(c) certification letter is on file.
6. Back up and retrieve. Restore one backup to a test environment, then produce a three-year-old record with its audit trail in readable form, as 11.10(b) and (c) expect.

AI tools add a seventh question: whether a model's output becomes a regulated record. Our article on whether LLM-based quality systems can pass a Part 11 audit covers that case.

Part 11 findings tend to surface as predicate-rule observations on the next Form 483, and the digest below tracks new 483s and warning letters with 211.68(b) and 211.194 citations as FDA posts them.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe