21 CFR Part 11 for software teams
What the FDA asks of software that keeps regulated records or takes electronic signatures, from audit trails and validation to how a signature is linked to its record.
What 21 CFR Part 11 is
Title 21 Code of Federal Regulations Part 11: Electronic Records; Electronic Signatures
21 CFR Part 11 is the US Food and Drug Administration (FDA) rule on electronic records and electronic signatures. It sets the conditions under which FDA treats an electronic record as trustworthy as paper, and an electronic signature as equal to a handwritten one.
It applies to records that other FDA rules already require you to keep, often called predicate rules. Examples are good manufacturing practice (GMP) batch records, good clinical practice (GCP) trial records and lab records. Part 11 does not say which records to keep. It says how to keep them when they are electronic.
Part 11 does not certify software. A system is not "Part 11 compliant" on its own. The company that uses it must validate it for its intended use and run it with the right procedures. Software makes that possible with audit trails, access control, signature controls and exportable records.
Who it applies to
Life sciences companies
Drug, biologic and device makers, contract research and manufacturing organisations, and labs that keep FDA-required records electronically or sign them electronically.
Clinical trial sponsors and sites
Electronic data capture, eConsent, trial master files and other systems that hold records from FDA-regulated clinical investigations.
Software vendors to those companies
Part 11 binds the regulated company, not the vendor. In practice buyers expect the vendor to supply the controls, the validation evidence and an audit of its own quality process.
Paper records sent electronically, such as a faxed form, are outside Part 11. FDA's 2003 guidance also reads its scope narrowly: records kept on paper, with the computer used only to produce them, are generally not in scope. The EU has a similar rule for GMP systems in Annex 11 of the EU GMP guidelines.
Key requirements, and what they mean for the build
Each row links the official text. Read the source for the exact wording before you rely on it.
Know if a record is in scope
Part 11 covers electronic records created, changed, kept, archived, retrieved or sent under FDA record rules, and electronic signatures on them. It defines closed and open systems.
List which records in the system are required by a predicate rule, and which users and systems control access to them.
Validation
Systems are validated to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records.
Written requirements, a risk assessment, test scripts traced to requirements and a validation report for every release that touches regulated records.
Copies and retention
Generate accurate and complete copies in human readable and electronic form for FDA, and protect records so they can be found and read for the whole retention period.
Exports to PDF and a structured format that include the audit trail and signatures, plus backups and format migrations that keep old records readable.
Access and authority checks
Limit system access to authorised people, and check that only authorised people can sign, change a record or run an operation.
Unique accounts, role-based permissions checked on the server for every action, and no shared logins.
Audit trails
Secure, computer-generated, time-stamped audit trails record the date and time of entries and actions that create, modify or delete records. Changes must not hide what was there before, and the trail is kept as long as the record.
An append-only audit log with old value, new value, user, time and reason for change, written by the system and not editable by any user.
Operational and device checks
Enforce the permitted order of steps and events, and check where input comes from where that matters.
Workflow states that block steps out of order, such as release before review, and device or instrument identity on data that comes from equipment.
Open systems
Where access is not controlled by the people responsible for the records, add measures such as document encryption and digital signature standards.
Encrypt records in transit and at rest, and use cryptographic signatures when records leave your controlled environment.
Signature meaning and linking
A signed record shows the signer's printed name, the date and time, and the meaning of the signature, such as review or approval. Signatures are linked to their records so they cannot be cut, copied or moved to another record.
Store the signature as part of the record version it signs, show name, time and meaning on screen and in exports, and invalidate it if the record changes.
Unique signatures and identity checks
Each electronic signature belongs to one person and is never reused or reassigned. The organisation verifies the person's identity first, and certifies to FDA that its electronic signatures are legally binding.
Never recycle user IDs, record how each user's identity was verified, and deactivate rather than delete accounts.
Signature components and password controls
Non-biometric signatures use at least two components, such as an ID and password. Within one continuous session the first signing uses all components and later ones at least one. ID and password pairs are unique, checked and revised over time, and attempted misuse is detected and reported.
Re-authenticate at the moment of signing, lock and alert on repeated failed attempts, and handle lost tokens with a recorded process.
Engineering controls for 21 CFR Part 11
How the rules change the way the software is designed.
- 01
Record map
Which records are regulated, which predicate rule requires them, and where each one lives. It sets the scope of validation.
- 02
Append-only audit trail
Every create, change and delete with old and new values, user, time and reason, kept as long as the record and shown in exports.
- 03
Signing ceremony
Re-enter credentials to sign, choose the meaning of the signature, and bind it to the exact record version.
- 04
Role-based access
Unique users, roles checked on the server, no shared accounts, and deactivation instead of deletion so history stays readable.
- 05
Workflow enforcement
States and transitions that stop steps from happening out of order, such as approving your own work or releasing before review.
- 06
Validation pack
Requirements, risk assessment, traceability to tests, test evidence and a release report, produced with every release.
- 07
Readable exports
Complete copies in PDF and a structured format, with metadata, audit trail and signatures, for inspections.
- 08
Time source
Server time from a trusted, synchronised source with the time zone recorded. Client clocks are never trusted for audit entries.
What to watch
Part 11 dates from 1997. In 2003 FDA said it would read the scope narrowly and use enforcement discretion on some parts, such as validation and audit trails, while still enforcing access, checks and signature controls. In October 2024 FDA issued a final Q&A guidance on electronic systems and signatures in clinical investigations. Check the FDA guidance pages for anything newer.
Checked against the official sources on 2026-10-25.
6 OceanLab product builds cite 21 CFR Part 11
Counted from our published case studies: a build counts when 21 CFR Part 11 is in the list of rules it was built for.
Kopiec - Clinical Trial Management System for Sites, Visits and Milestones
Designed and built a clickable clinical trial management system for a Warsaw contract research organisation running phase II and III trials in seven countries: a portfolio dashboard with CTIS notification deadlines, study timelines planned against actual, an 11-step site activation tracker and monitoring visit reports signed with a stated meaning.
Cuvette - GMP Laboratory System for Samples, Chain of Custody and Release Testing
Designed and built a clickable laboratory information management system for the quality control lab of an Irish biopharma manufacturing site: every sample from login to disposal with an unbroken chain of custody, second person review with electronic signatures, and the lab's own reagent and reference standard inventory, so no result is signed against an expired lot or an overdue instrument.
Tomoshibi - Trial Recruitment and eConsent Platform for a Japanese SMO
Designed and built a clickable recruitment and eConsent platform for a Japanese site management organisation: a pre-screen leads pipeline with contact SLAs, a consent status view against the current IRB-approved version, and a participant consent record with every signature, quiz result and question a monitor needs to see.
Vodilo - Digital Work Instructions That Build the Device History Record
Designed and built a clickable quality and supervisor console for a Bulgarian contract manufacturer of infusion pump and diagnostic analyser assemblies: a bilingual instruction library with revisions and effectivity, a live floor view of every cleanroom station, and a device history record queue that quality engineers review and release with an e-signature.
Dewel - Cold Chain Monitoring with Excursion Alerts and QA Release
Designed and built a clickable cold chain monitoring platform for an Addis Ababa logistics provider that stores and moves vaccines, biologics and fresh fish: live temperatures from cold rooms, reefer trucks and box loggers, excursions measured against each product's profile, escalating alerts, and a QA disposition signed electronically.
Batey - Sales Enablement Hub with Medical, Legal and Regulatory Review
Designed and built a clickable sales enablement hub for a San Juan medical device manufacturer: one library of approved sales material per product, market and language, a medical, legal and regulatory (MLR) review workspace with signed approvals, and expiry and IFU checks that pull outdated material before reps can use it.
Check your product
Other frameworks and industries
Build with 21 CFR Part 11 in mind from day one
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
21 CFR Part 11 questions
Can software be "Part 11 certified"?
No. FDA does not certify software. A vendor can build the controls Part 11 needs and supply validation evidence, but the regulated company must validate the system for its own use and run it under its own procedures.
Does Part 11 require audit trails on every field?
It requires audit trails for entries and actions that create, modify or delete regulated electronic records. FDA's 2003 guidance uses enforcement discretion on audit trails but still expects predicate rules to be met, so most teams log every change to regulated data.
Is a typed name or a checkbox an electronic signature?
Only if it meets Part 11: unique to one person, identity verified, at least two components such as ID and password, the meaning shown, and linked to the record so it cannot be moved. A checkbox on its own does not do that.
How does Part 11 relate to EU Annex 11?
They cover the same ground for computerised systems in regulated work. Annex 11 is part of the EU GMP guidelines. Systems used in both markets are usually built to meet both, with one validation approach.
How does OceanLab approach Part 11 on a build?
We map the regulated records first, then build the audit trail, signing step and role checks into the data model rather than adding them later, and produce validation evidence with each release. The builds below list 21 CFR Part 11 in the rules they were built for.
Official sources
- 21 CFR Part 11: electronic records and electronic signatures (eCFR)
- 21 CFR Part 11 Subpart A: scope and definitions
- 21 CFR Part 11 Subpart B: electronic records
- 21 CFR Part 11 Subpart C: electronic signatures
- FDA guidance: Part 11, Scope and Application (2003)
- FDA guidance: Electronic Systems, Records and Signatures in Clinical Investigations, Q&A (2024)
- European Commission: EudraLex Volume 4, EU GMP guidelines (Annex 11)
