Title 21 of the US Code of Federal Regulations, Part 11, applies to records that FDA predicate rules require you to keep — batch records, laboratory records, complaint files and so on — when you create, modify, maintain, archive, retrieve or transmit them electronically. It also applies to electronic signatures used in place of handwritten ones. Part 11 does not add new record-keeping duties; it governs how the records you already must keep are controlled once they are electronic.
Subpart B — electronic records
Section 11.10 lists the controls expected for closed systems. In summary: validation of systems to ensure accuracy, reliability and consistent intended performance (11.10(a)); the ability to produce accurate and complete copies in human-readable and electronic form (11.10(b)); protection of records so they can be retrieved accurately throughout the retention period (11.10(c)); limiting system access to authorised individuals (11.10(d)); secure, computer-generated, time-stamped audit trails that record the date and time of entries and actions that create, modify or delete records, without obscuring previously recorded information (11.10(e)); operational system checks to enforce the permitted sequencing of steps (11.10(f)); authority checks (11.10(g)); device checks (11.10(h)); training of the people who develop, maintain or use the system (11.10(i)); written policies that hold individuals accountable for actions under their signatures (11.10(j)); and controls over system documentation (11.10(k)).
Section 11.50 requires signed electronic records to show the printed name of the signer, the date and time of signing and the meaning of the signature — such as review, approval or responsibility. Section 11.70 requires signatures to be linked to their records so that they cannot be excised, copied or otherwise transferred to falsify a record.
Subpart C — electronic signatures
Section 11.100 requires each electronic signature to be unique to one individual and not reused by or reassigned to anyone else, and the organisation to verify a person’s identity before assigning one. Organisations must also certify to the FDA that their electronic signatures are intended to be the legally binding equivalent of handwritten signatures. Section 11.200 requires non-biometric signatures to use at least two distinct identification components, such as a user ID and a password. Section 11.300 covers controls for identification codes and passwords — uniqueness, periodic revision, handling of lost credentials and safeguards against unauthorised use.
How the FDA reads it today
The FDA’s 2003 guidance on Part 11 scope and application explains that the agency interprets the rule narrowly and applies enforcement discretion to some requirements — validation, audit trails, record retention and record copying — while still expecting predicate rules to be met and audit trails to be justified by risk. In practice, investigators expect controlled access, attributable actions, audit trails on GMP-relevant data and meaningful signatures. Data integrity findings remain a common theme in FDA Form 483 observations and warning letters.