21 CFR Part 11 is the FDA regulation on electronic records and electronic signatures. It applies when records required by other FDA regulations — the predicate rules, such as cGMP in 21 CFR 211 — are created, modified, maintained, archived, retrieved or transmitted electronically, and when electronic signatures are used in place of handwritten ones.
Subpart B covers electronic records. Section 11.10 lists controls for closed systems, including validation, the ability to generate accurate and complete copies, record protection, limiting access to authorised individuals, secure time-stamped audit trails, operational, authority and device checks, training and written policies. Section 11.50 covers signature manifestations and 11.70 the linking of signatures to records. Subpart C covers electronic signatures: uniqueness (11.100), components such as ID code and password (11.200) and controls for identification codes and passwords (11.300).
Why it matters in GMP
Any company supplying the US market with records kept electronically must meet Part 11. The FDA’s 2003 guidance on scope and application narrowed enforcement focus, but audit trails, access control, validation and electronic signatures remain central in inspections and data integrity warning letters.
- Validate the system for its intended use.
- Generate secure, time-stamped audit trails automatically.
- Link each e-signature to its record, with name, date, time and meaning.
How Swat iQua Suite handles it
Swat iQua Suite is designed to comply with 21 CFR Part 11. Every change is audit-trailed with user, time, old and new values and a reason; e-signatures re-authenticate the signer and show name, designation, meaning and time; access is role-based and site-scoped; and lockouts follow failed logins. Validation itself is performed by you for your intended use, supported by our CSA traceability register and implementation team.