An electronic signature lets a person approve, review, verify or release a GMP record in a computerised system with the same legal weight as a handwritten signature. Under 21 CFR Part 11, it must be unique to one individual and never reused or reassigned.
Part 11 sets out the key requirements. Section 11.50 requires the signed record to show the printed name of the signer, the date and time of signing, and the meaning of the signature (such as review, approval or authorship). Section 11.70 requires signatures to be linked to their records so they cannot be copied or transferred. Section 11.200 requires non-biometric signatures to use at least two distinct identification components, such as an ID code and a password. EU GMP Annex 11 carries similar expectations.
Why it matters in GMP
Electronic signatures replace wet-ink signatures on batch records, release decisions, specifications and investigations. If a signature can be applied without re-authenticating, applied by someone else, or detached from the record, the whole record loses its evidential value.
- Re-authenticate at the moment of signing, not just at login.
- Record the signer’s role at the time of signing, which may differ later.
- Keep signed records unchanged; changes should require a new signature.
How Swat iQua Suite handles it
Swat iQua Suite asks the signer to re-enter their password at the moment of signing, with stronger options such as password plus OTP configurable per module and per site — three e-signature levels in all. The signed record shows the signer’s name, designation at the time of signing, the meaning of the signature and a trusted time stamp, and it is printed in the historical signature block of controlled PDFs.