21 CFR Part 11

No changes recorded yet — we are watching, and nothing has been published.

1. 2024-10-02 FDA finalised its Q&A guidance on electronic systems, records and signatures in clinical investigations
2. 1997-08-20 Part 11 took effect

1. 2023-03-02
   21 CFR part 11 (as amended March 2023) AmendmentCurrent text

   Technical amendment to section 11.100: updated where to send the certification of electronic signatures and added an option for electronic submission. source

2. 2021-12-03
   Laboratory Accreditation for Analyses of Foods final rule Amendment

   Added an exclusion to section 11.1 for records required under the food laboratory accreditation rule (part 1, subpart R); effective 1 February 2022. source

3. 2016-05-27
   Intentional Adulteration final rule Amendment

   Added an exclusion to section 11.1 for records required under part 121. source

4. 2016-04-06
   Sanitary Transportation of Human and Animal Food final rule Amendment

   Added an exclusion to section 11.1 for records required under part 1, subpart O. source

5. 2015-11-27
   FSVP, Produce Safety and Third-Party Certification final rules Amendment

   Added exclusions to section 11.1 for records required under part 112 and under subparts L and M of part 1. source

Applies whenever FDA-regulated records or signatures are kept in electronic form instead of on paper, with exclusions written into the rule.

Records in scope

Electronic records under any FDA records requirement, and electronic records submitted to FDA even if not named in its regulations; paper records sent electronically are not covered. source

Equivalence

Electronic signatures that meet part 11 are treated as equivalent to handwritten signatures, initials and other general signings required by FDA regulations. source

Exclusions

Part 11 does not apply to records required only under certain food rules, such as 21 CFR parts 112, 117, 121 and 507 and subparts of part 1. source

Closed-system controls

Closed systems need validation, readable copies for FDA, access limits, secure time-stamped audit trails, operational, authority and device checks, and trained staff. source

Signatures

Each electronic signature must be unique to one person, the person's identity verified first, and its use certified to FDA as legally binding. source

Narrow scope

FDA's 2003 guidance interprets part 11 narrowly: when paper printouts meet the predicate rules and are relied on, FDA generally does not treat the records as electronic records used in lieu of paper. source

Regulated firms validate and control their own systems, which remain open to FDA inspection.

Inspection

Computer systems (hardware and software), controls and documentation maintained under part 11 must be readily available for, and subject to, FDA inspection. source

Certification to FDA

Persons using electronic signatures must certify to FDA, with a handwritten signature, that they are the legally binding equivalent of handwritten signatures. source

Clinical investigations

FDA's October 2024 Q&A guidance gives recommendations on electronic systems, records and signatures for sponsors, investigators, IRBs and CROs. source

FDA enforces part 11 together with the underlying predicate rules, and states which part 11 requirements it applies enforcement discretion to.

Enforcement discretion

FDA does not intend to enforce the validation, audit trail, record retention and record copying requirements as explained in its 2003 guidance, but enforces other provisions. source

Predicate rules

Records must still meet the underlying predicate rules, and FDA can take regulatory action for noncompliance with them. source

Legacy systems

For systems operational before 20 August 1997, FDA does not intend to enforce any part 11 requirement under the circumstances its guidance describes. source

1. Law text 21 CFR part 11 – Electronic Records; Electronic Signatures
2. Guidance Part 11, Electronic Records; Electronic Signatures – Scope and Application (guidance, 2003)
3. FAQ Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations – Questions and Answers (October 2024)
4. Guidance Computer Software Assurance for Production and Quality Management System Software (February 2026)
5. Law text Electronic Records; Electronic Signatures final rule (20 March 1997)

1. HIPAA

   The HIPAA Security Rule protects electronic health information; part 11 decides when FDA-regulated electronic records and signatures can replace paper.

2. NIST SP 800-63

   NIST SP 800-63 is identity and authentication guidance; part 11 sets FDA's binding signature and identification-code controls for regulated records.

3. ISO 27001

   ISO/IEC 27001 is a certifiable information security management standard; part 11 is an FDA regulation enforced through FDA inspection.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to 21 CFR Part 11 (RSS)