21 CFR Part 11 requirements, section by section

Published 2026-10-23 19 min read

Chromolithograph of a row of thin binders held between an amber and a cobalt bottle — Eleven binders for the eleven controls of § 11.10, (a) to (k): most of the rule's weight sits there.

Part 11 runs from § 11.1 to § 11.300 in three subparts. This page takes every section in order: the words of the rule, what they mean in a lab of a few people, the evidence to have ready when an inspector asks, and the misreading that catches teams out. For what Part 11 is and whom it binds, start with 21 CFR Part 11: what it is and who it binds.

Part 11 on one sheet

Every section, what it asks, and the one piece of evidence that answers it. Filter by subpart or by how FDA's 2003 guidance treats it; each cite jumps to its full entry below.

20 of 20 entries shown

Scroll sideways for all columns

21 CFR Part 11 requirements by section, with the evidence to have ready
Section	What it asks	Have ready	2003 guidance
§ 11.1	Part 11 reaches electronic records kept under another FDA records rule, or submitted to FDA.	A system inventory naming the predicate rule behind each record.	Sets scope
§ 11.2	Kept records may go electronic once Part 11 is met; submissions only in the types FDA lists.	A written answer to which copy is the record: paper or electronic.	Sets scope
§ 11.3	Definitions: closed and open system, electronic and digital signature, biometrics.	The open or closed call for each system, with the reason.	Sets scope
§ 11.10(a)	Validate the system for accuracy, reliability and the ability to spot altered records.	Validation plan, requirements, test evidence and a signed report.	Enforcement discretion
§ 11.10(b)	Produce accurate, complete copies, human readable and electronic, for FDA.	A tested export of one full record with its trail and signatures.	Enforcement discretion
§ 11.10(c)	Protect records so they can be retrieved for the whole retention period.	Backup schedule, a restore test record, the archive plan.	Enforcement discretion
§ 11.10(d)	Only authorised people get into the system.	Current user list, access approvals, leaver removals.	Enforced
§ 11.10(e)	A secure, computer-generated, time-stamped audit trail that never hides the old value.	A sample trail entry showing who, when, old value and new value.	Enforcement discretion
§ 11.10(f)	The system enforces the permitted order of steps, where order matters.	Workflow configuration and a test of an out-of-order attempt.	Enforced
§ 11.10(g)	Authority checks on who may sign, alter a record or run an operation.	A role and permission matrix approved by QA, with tests.	Enforced
§ 11.10(h)	Device checks on where input comes from, as appropriate.	The instrument interface setup, or a written reason it does not apply.	Enforced
§ 11.10(i)	People who build, maintain or use the system are trained and qualified.	Training records for users and admins; the vendor's qualification.	Enforced
§ 11.10(j)	A written policy holding each person accountable for their e-signature.	The policy and each signer's dated acknowledgement.	Enforced
§ 11.10(k)	Control system documentation: who gets it, and change control that keeps a history.	Controlled admin manuals and configuration specs with version history.	Partly under discretion
§ 11.30	Open systems: the § 11.10 controls as appropriate, plus measures such as encryption and digital signatures.	The open-system assessment and how a record is checked on receipt.	Partly under discretion
§ 11.50	A signed record shows the printed name, date and time, and meaning of the signature.	A signed record on screen and on paper showing all three.	Enforced
§ 11.70	Signatures are linked to their records so they cannot be cut, copied or moved.	The vendor's account of the link and your test that tries to move one.	Enforced
§ 11.100	One signature per person, identity checked first, and a certification letter to FDA.	Identity checks, no reassigned accounts, a copy of your FDA letter.	Enforced
§ 11.200	Non-biometric signatures use two components, such as an ID code and a password.	Signing configuration and a test inside and outside one session.	Enforced
§ 11.300	Keep ID and password pairs unique, revised, and watched for misuse; manage lost tokens.	Password policy, lockout alerts, the lost-token procedure.	Enforced

2003 guidance: how FDA's Scope and Application guidance treats the Part 11 version of the requirement. Enforcement discretion never switches off the predicate rule behind the record.

Two things to know before the sections

Part 11 rides on a predicate rule. It adds controls to records that another FDA rule already requires (GLP Part 58, drug CGMP Part 211, the device QMSR in Part 820, and others) or that you submit to FDA. It does not create a record duty of its own, and it sets no retention period.

FDA enforces part of it with discretion. Since 2003, FDA has said it does not intend to take enforcement action on the Part 11 versions of four requirements: validation § 11.10(a), audit trail § 11.10(e) and (k)(2), copies § 11.10(b), and record retention § 11.10(c). It adds: We will enforce all predicate rule requirements, including predicate rule record and recordkeeping requirements. Everything else in Part 11, including every signature section, is enforced as written.

Takeaway

Read each section against the predicate rule behind your record. Where the guidance shows discretion, the same control usually comes back through that rule, so build it anyway.

Subpart A: scope, implementation and definitions (§§ 11.1 to 11.3)

The first three sections decide whether the rest applies, and in which form.

§ 11.1Scope

The text says: Part 11 “applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations”, and it “does not apply to paper records that are, or have been, transmitted by electronic means”.
In a small lab: Part 11 rides on another rule. A record is in scope because a predicate rule (Part 58 for GLP, Part 211 for drug CGMP, Part 820 for devices) requires it and you keep it electronically, or because you submit it to FDA. § 11.1(e) adds that the systems and their documentation are “readily available for, and subject to, FDA inspection”. Sections 11.1(f) to (p) carve out certain food-safety records. To test one record quickly, run it through the Part 11 applicability checker.
Have ready: An inventory of every computerised system that holds a regulated record, with the predicate rule named per record.
The SOP that records which records are Part 11 records. The 2003 guidance recommends you document this decision.
2003 guidance: Not a control, so the enforcement split does not apply. FDA says it will “narrowly interpret the scope of part 11”: a paper printout that meets the predicate rule and is the record you rely on does not trigger Part 11.

Common misreading

“Part 11 applies to every electronic record.” Only to records a predicate rule requires or that go to FDA. A spreadsheet of office supply orders is not a Part 11 record; an HPLC result behind a batch release is.

§ 11.2Implementation

The text says: For records kept but not submitted, “persons may use electronic records in lieu of paper records or electronic signatures in lieu of traditional signatures, in whole or in part, provided that the requirements of this part are met”.
In a small lab: Going electronic needs no permission from FDA for the records you keep. For records you submit, the document type must be one FDA lists in public docket No. 92S-0251 as accepted in electronic form. “In whole or in part” is what allows the hybrid record most small labs run: a printed chromatogram signed in ink beside the electronic raw data.
Have ready: For each hybrid record, a written answer to which copy is the official record and which is a convenience copy.
Where the paper copy is signed, the procedure that ties the ink signature to the right electronic data.
2003 guidance: Not a control. The guidance's point on relied-on paper printouts (see § 11.1) is what decides most hybrid cases.

Common misreading

“A hybrid record is outside Part 11 because someone signs the printout.” If the electronic data is also kept and relied on for a regulated activity, the 2003 guidance treats it as a Part 11 record. The signature on paper does not take the raw data out of scope.

§ 11.3Definitions

The text says: A closed system is “an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system”; an open system is one where access “is not controlled” by those persons.
In a small lab: Four definitions carry the rest of the rule. Closed or open turns on who controls access, not on where the server sits, so a hosted system can fall on either side and the reasoning belongs in writing (the open vs closed system check walks the question). An electronic signature is “a computer data compilation of any symbol or series of symbols” adopted as the legal equal of a handwritten one. A digital signature is narrower: one “based upon cryptographic methods of originator authentication”. A name signed on a stylus pad still counts as a handwritten signature.
Have ready: The open or closed classification for each system, with the reason, in its validation file.
Which signature type each system uses: ID code and password, biometric, or handwritten on a device.
2003 guidance: Not a control. The definitions decide whether § 11.30's extra measures apply.

Common misreading

“Electronic signature means digital signature.” Part 11 defines them separately. An ID code and password is a valid electronic signature; cryptographic digital signatures appear in the rule only as an example of the additional measures for open systems.

§ 11.10: controls for closed systems, (a) to (k)

The lead-in to § 11.10

“procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine”

Those procedures and controls “shall include” the eleven paragraphs below.

§ 11.10(a)Validation

The text says: “Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.”
In a small lab: You prove the system does what you use it for, configured the way you run it. The size of that proof follows risk: FDA's 2003 guidance asks for “a justified and documented risk assessment” and gives the example that “validation would not be important for a word processor used only to generate SOPs”. A small lab can run a lean plan; see computer system validation for small labs. The last clause is the one teams skip: the system must be able to show when a record is invalid or altered.
Have ready: A validation plan, user requirements, risk assessment, executed test evidence and a signed report.
The vendor's validation pack, filed as input to your own work, not in place of it.
A test that edits a record and shows the change is detectable.
2003 guidance: Enforcement discretion for the Part 11 validation requirement (and its § 11.30 counterpart). The predicate rule behind the record is still enforced in full.

Common misreading

“The vendor validated it, so we are covered.” § 11.10 binds the persons who use the system. A vendor's testing supports your validation; the claim that the system fits your intended use is yours.

§ 11.10(b)Accurate and complete copies

The text says: “The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency.”
In a small lab: An inspector asks for a record and you hand over all of it: the data, the metadata, the audit trail and the signature manifestations, as a readable copy and as an electronic one. Find out before an inspection whether the export drops the trail, the signature block or the units.
Have ready: A written export procedure for each system.
One full record exported both ways during validation, checked line by line against the screen.
2003 guidance: Enforcement discretion for the Part 11 record copying requirement (and its § 11.30 counterpart). The predicate rule behind the record is still enforced in full.

Common misreading

“A printout is enough.” The text asks for both human readable and electronic form. A printout that loses the audit trail or the signature meaning is not a complete copy.

§ 11.10(c)Protection and retrieval

The text says: “Protection of records to enable their accurate and ready retrieval throughout the records retention period.”
In a small lab: The record has to come back, readable and intact, for as long as the predicate rule says to keep it: through software upgrades, a server move or a vendor that stops trading. Part 11 sets no period itself. Drug CGMP records under § 211.180 are kept “at least 1 year after the expiration date of the batch”; GLP retention sits in § 58.195. FDA's data integrity Q&A calls a backup “a true copy of the original record that is maintained securely throughout the record retention period”.
Have ready: The backup schedule and the record of a restore test that brought a real record back.
An archive and data-migration plan for the day the system is retired.
2003 guidance: Enforcement discretion for the Part 11 record retention requirement (and its § 11.30 counterpart). The predicate rule behind the record is still enforced in full.

Common misreading

“Part 11 requires us to keep records for X years.” It sets no retention period. The period comes from the predicate rule; § 11.10(c) only says the record must survive it.

§ 11.10(d)Limiting system access

The text says: “Limiting system access to authorized individuals.”
In a small lab: Named accounts, granted on approval and removed when someone leaves. A shared bench login gets people in, but it breaks what the rest of the rule depends on: the audit trail can no longer name the operator, and a signature can no longer be unique to one person (§ 11.100(a)).
Have ready: The current user list with roles, matched against the staff list.
Access requests and approvals, and the dates leavers were disabled.
2003 guidance: Enforced. The guidance lists limiting access among the provisions FDA intends to enforce.

Common misreading

“A shared instrument login is fine because the room is locked.” A locked door limits who enters the room, not who acts in the system, and it leaves every entry in the trail unattributable.

§ 11.10(e)Audit trails

The text says: “secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records”. “Record changes shall not obscure previously recorded information.” The trail is “retained for a period at least as long as that required for the subject electronic records”.
In a small lab: The system writes the trail, not the user; users cannot switch it off or edit it; a change never hides the value it replaced; and the trail lives as long as the record. The 2003 guidance does not expect the signer's local time, but your documentation “should explain time zone references”. More on what a trail must capture: what is an audit trail in GxP.
Have ready: The audit trail configuration in the validation file, showing it cannot be disabled by users.
A sample trail entry for a changed result: who, when, old value, new value and, where the system asks, why.
The note that explains which time zone the time stamps use.
2003 guidance: Enforcement discretion for the Part 11 audit trail. The predicate rules still bite: GLP § 58.130(e) says changes to automated data “shall be made so as not to obscure the original entry”.

Common misreading

“Part 11 requires a monthly audit-trail review.” § 11.10(e) requires the trail, not a review cadence. “Regularly reviewed” comes from EU Annex 11 § 9. Set your cadence by risk with the audit trail review checklist.

§ 11.10(f)Operational system checks

The text says: “operational system checks to enforce permitted sequencing of steps and events, as appropriate”
In a small lab: Where the order of steps matters, the system holds it: a result cannot be approved before it is reviewed, a batch step cannot be signed before the one ahead of it, a sample cannot be tested before it is logged in. “As appropriate” means you decide where sequence matters and say so; it does not mean the clause is optional.
Have ready: The workflow configuration for each regulated process in the system.
A validation test that tries a step out of order and shows the system refuses it.
2003 guidance: Enforced. The guidance names operational system checks among the provisions FDA intends to enforce.

§ 11.10(g)Authority checks

The text says: “authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand”
In a small lab: § 11.10(d) decides who gets in; (g) decides what each person can do once inside. An analyst enters results, a reviewer approves them, an administrator configures the system, and the roles are kept apart. In a small lab one person may hold two roles; write down which, and why, before an inspector asks.
Have ready: A role and permission matrix, approved by QA, matching what the system is actually configured to allow.
Tests showing a user without the right cannot sign, edit or change settings.
2003 guidance: Enforced. The guidance names authority checks among the provisions FDA intends to enforce.

Common misreading

“Access control and authority checks are the same thing.” They are two clauses. A system with good logins and one all-powerful role meets (d) and fails (g).

§ 11.10(h)Device checks

The text says: “device (e.g., terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction”
In a small lab: Where it matters which instrument or terminal sent the data, the system checks it: the balance result arrives from the qualified balance, the plate reader file comes from the reader it claims to. For a stand-alone system with one connected instrument the check can be simple, but the reasoning still goes on file.
Have ready: The instrument interface configuration, showing how the source of each data feed is identified.
Where you judge (h) does not apply, the written reason.
2003 guidance: Enforced. The guidance names device checks among the provisions FDA intends to enforce.

Common misreading

“Not applicable” with no reason. “As appropriate” leaves the judgement to you, which is exactly why an inspector asks to see it.

§ 11.10(i)Education, training and experience

The text says: A determination that persons who develop, maintain, or use the systems “have the education, training, and experience to perform their assigned tasks”.
In a small lab: Three groups, not one: the people who use the system, the people who maintain it (your IT support or administrator), and the people who develop it (often the vendor). Users and admins get training records; the vendor's competence is covered by your supplier assessment.
Have ready: Training records for every user and admin, tied to the SOP version trained on (a training record template sets the fields).
The supplier assessment for the vendor and any outside IT support.
2003 guidance: Enforced. The guidance names § 11.10(i) among the provisions FDA intends to enforce.

Common misreading

“(i) is about end-user training.” The text names persons who develop and maintain the system as well as those who use it.

§ 11.10(j)Written accountability policy

The text says: “written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification”
In a small lab: A short policy every signer reads and acknowledges before their first electronic signature: the e-signature binds them as ink would, it is never shared, and misuse is a disciplinary matter. It is an internal document, separate from the letter to FDA under § 11.100(c).
Have ready: The policy, under document control.
A dated acknowledgement from each signer, earlier than their first signature in the system.
2003 guidance: Enforced. The guidance names accountability policies among the provisions FDA intends to enforce.

Common misreading

“Our certification letter to FDA covers this.” The letter certifies your signatures to the agency. (j) asks for a policy your own people are held to.

§ 11.10(k)Systems documentation controls

The text says: (1) “Adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance.” (2) “Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation.”
In a small lab: This is about documents describing the system, not the records in it: the admin manual, the configuration specification, the operating SOPs. Hand them out as controlled copies and run every revision through change control so the history is readable in order. A controlled SOP template gives each one a header that holds up.
Have ready: A list of system documents with their current versions and who holds copies.
Change records for the configuration specification since go-live.
2003 guidance: Split. The (k)(2) change-control trail falls under the audit-trail discretion; (k)(1) documentation controls are among the provisions FDA intends to enforce.

Takeaway

Score one system against all eleven paragraphs with the Part 11 compliance checklist, then close the gaps in (d), (f) to (j) and (k)(1) first: those paragraphs sit outside the 2003 discretion.

Chromolithograph of a taped records book stored in a clear archive box — § 11.10(c): a record is kept only if it comes back intact for the whole retention period.

§§ 11.30, 11.50 and 11.70: open systems and signed records

The rest of Subpart B covers systems you do not fully control, and what a signed record must show and hold on to.

§ 11.30Controls for open systems

The text says: Controls that protect records “from the point of their creation to the point of their receipt”, including those in § 11.10 as appropriate, and “additional measures such as document encryption and use of appropriate digital signature standards”.
In a small lab: When the people responsible for the records do not control who gets into the system, the record has to be protected on its whole journey, not only at rest. Encryption and digital signatures are named as examples (“such as”), not as a fixed list. Most small labs run closed systems; the work here is making that call in writing for each one.
Have ready: The open or closed assessment for each system (§ 11.3).
For an open system: how records are encrypted in transit and how the receiver confirms they arrived unaltered.
2003 guidance: Split. The § 11.30 counterparts of validation, audit trail, copies and retention fall under the discretion; the rest is among the provisions FDA intends to enforce.

Common misreading

“Part 11 requires PKI or digital signatures.” Digital signatures appear only here, as an example of extra measures for open systems. A closed system can sign with an ID code and password (§ 11.200).

§ 11.50Signature manifestations

The text says: A signed record shows “(1) The printed name of the signer; (2) The date and time when the signature was executed; and (3) The meaning (such as review, approval, responsibility, or authorship)”, and those items appear on “any human readable form of the electronic record (such as electronic display or printout)”.
In a small lab: Anyone reading the record, on screen or on paper, can see who signed, when, and what the signature meant. The meaning is the line most often missing: “Approved” or “Reviewed” has to be on the record, not only in the workflow behind it. Check one of your own with the signature manifestation check.
Have ready: A signed record on screen and the same record printed or exported, both showing name, date and time, and meaning.
The validation test that confirmed it.
2003 guidance: Enforced in full. The guidance keeps “requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)” outside the discretion.

Common misreading

“Time stamps must show the signer's local time.” The 2003 guidance says “we do not expect you to record the signer's local time”; document which time zone the stamp uses.

§ 11.70Signature and record linking

The text says: Signatures “linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means”.
In a small lab: A signature belongs to one record and cannot be lifted onto another with copy and paste, an export and re-import, or a file edit. The rule covers handwritten signatures executed to electronic records too, such as a name signed on a pad.
Have ready: The vendor's description of how a signature is bound to its record.
Your validation test that tries to copy or move a signature and fails.
2003 guidance: Enforced in full. The guidance keeps “requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)” outside the discretion.

Common misreading

“A signature image pasted into a PDF is a linked signature.” An image can be copied into any other file by ordinary means, which is exactly what § 11.70 rules out.

Chromolithograph of a rubber stamp and ink pad beside a stamped controlled document — A signature carries weight only when the record shows who signed, when, and what it meant.

Subpart C: electronic signatures (§§ 11.100 to 11.300)

Who may hold a signature, how it is made, and how the passwords behind it are kept.

§ 11.100General requirements for electronic signatures

The text says: Each signature is “unique to one individual and shall not be reused by, or reassigned to, anyone else”; before issuing one, “the organization shall verify the identity of the individual”; and users must “certify to the agency” that their electronic signatures are the legally binding equivalent of handwritten ones.
In a small lab: Three duties. Never recycle a leaver's account for a new starter. Check identity before the first signature is issued. And send FDA the certification: a letter signed in ink, sent on paper or electronically, with where to send it on FDA's Letters of Non-Repudiation Agreement page. FDA accepts an individual letter or a company-wide one that “covers all employees of that company”.
Have ready: The identity check on file for each signer, dated before their account could sign.
Proof no account was renamed or handed to someone else.
A copy of the certification letter and the date it was sent.
2003 guidance: Enforced in full. The guidance keeps “requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)” outside the discretion.

Common misreading

“Our e-signature vendor files the letter for us.” § 11.100(c) puts the certification on the persons using electronic signatures. The 2023 change to § 11.100(c)(1) was a nonsubstantive update about how to submit it.

§ 11.200Signature components and controls

The text says: Non-biometric signatures “Employ at least two distinct identification components such as an identification code and password.” Outside a continuous session, “each signing shall be executed using all of the electronic signature components”.
In a small lab: User ID plus password is enough. In one continuous session the first signing uses both components and later ones need at least the component only the signer can use (usually the password); after a log-out or time-out, every signing asks for both again. Misuse should take two or more people colluding. Biometric signatures must be usable only by their owner.
Have ready: The signing configuration: what is asked at the first signing and at each later one.
Tests inside one session and after a time-out, showing the components requested each time.
2003 guidance: Enforced in full. The guidance keeps “requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)” outside the discretion.

Common misreading

“Part 11 requires biometrics or multi-factor authentication.” The text accepts “an identification code and password”. Stronger methods are a choice, not a Part 11 requirement. Tools that sign this way are read against the rule on the e-signature software comparison.

§ 11.300Controls for identification codes and passwords

The text says: Keep each ID and password pair unique so “no two individuals have the same combination”; have them “periodically checked, recalled, or revised (e.g., to cover such events as password aging)”; deauthorise lost tokens; “detect and report in an immediate and urgent manner any attempts at their unauthorized use”; and test tokens and cards initially and periodically.
In a small lab: Five controls: uniqueness, periodic review, loss management, transaction safeguards and device testing. Most of them live in your IT settings (lockout after failed attempts, alerts to whoever handles security) and in one SOP. If you use no tokens or cards, (c) and (e) shrink to a sentence saying so.
Have ready: The password policy and the settings that enforce it.
Lockout and alert configuration, and one example of an alert being handled.
The lost-token procedure and token test records, where tokens are used.
2003 guidance: Enforced in full. The guidance keeps “requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)” outside the discretion.

Common misreading

“Part 11 sets a password expiry period.” It gives password aging as an example of periodic revision and names no number of days. The interval is yours to set and justify.

Takeaway

Before anyone signs in a new system: identity checked (§ 11.100(b)), the accountability policy acknowledged (§ 11.10(j)), the certification letter on file (§ 11.100(c)), and the signing configuration tested inside and outside one session (§ 11.200).

Where the rule is silent

Retention period: None. The predicate rule sets it; § 11.10(c) and (e) only tie to “the records retention period”.
Audit-trail review: No cadence in Part 11. “Regularly reviewed” is EU Annex 11 § 9, covered in the guide to EU Annex 11.
Vendor certification: None. The only certification in the rule is the user's letter to FDA under § 11.100(c). FDA keeps no list of certified software; what to test instead is in Part 11 compliant software, by category.
MFA or biometrics: Not required. § 11.200(a)(1) accepts “an identification code and password”.
Signer's local time: Not expected by FDA's 2003 guidance. Document which time zone your stamps use.
Password expiry: No interval. § 11.300(b) gives password aging as an example of periodic revision.
A recent rewrite: None. The record and signature controls (§§ 11.10–11.300) are the 1997 text. Later amendments added food-safety carve-outs to § 11.1 (2004–2021) and, in 2023, updated how the § 11.100(c) letter is sent.
EU Annex 11: A separate EU text; the January 2011 version is in force. See the Annex 11 vs Part 11 mapping.

Sources

Regulation text quoted from the eCFR; guidance quoted from FDA. General information, not regulatory advice.

21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR, up to date as of 2026-10-20), eCFRread 2026-10-22
Electronic Records; Electronic Signatures, final rule, 62 FR 13430, Federal Registerread 2026-10-22
Change of Address; Technical Amendment, 88 FR 13018, Federal Registerread 2026-10-22
Letters of Non-Repudiation Agreement, FDAread 2026-10-22
Part 11, Electronic Records; Electronic Signatures — Scope and Application (2003 guidance), FDAread 2026-10-22
Data Integrity and Compliance With Drug CGMP: Questions and Answers, FDAread 2026-10-22
21 CFR Part 58, Good Laboratory Practice for Nonclinical Laboratory Studies, eCFRread 2026-10-22
21 CFR Part 211, CGMP for Finished Pharmaceuticals, eCFRread 2026-10-22
EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22