21 CFR Part 11: what it is and who it binds

Published 2026-10-23 17 min read

Chromolithograph of an open regulations book between an amber bottle and a cobalt bottle — An open rule book between amber and cobalt glass: Part 11 sits over the records you already keep.

Record summary: 21 CFR Part 11, eCFR text read 2026-10-22

Full title: Electronic Records; Electronic Signatures
Issued by: U.S. Food and Drug Administration, under 21 U.S.C. 321-393 and 42 U.S.C. 262
Published: 1997-03-20, 62 FR 13430
In force since: 1997-08-20
Shape: 3 subparts, 10 sections, § 11.1 to § 11.300
Binds: The people and firms who use the system to keep FDA-required records, not the software maker
How FDA reads it: The 2003 Scope and Application guidance: narrow scope, discretion on four controls
Last change to a control: 2023-03-02, a nonsubstantive update to § 11.100(c)(1)

21 CFR Part 11 is FDA's rule for electronic records and electronic signatures. It does not create new records; it sets the conditions under which the records other FDA rules already make you keep can live on a computer and be signed there. Ten sections, in force since 1997-08-20, read narrowly since 2003.

This guide covers what it reaches, who it binds, how FDA reads it today and what it does not ask for, then sets out the first steps for a small lab or device maker.

Part 11 in plain words

21 CFR Part 11 is the FDA rule that decides when an electronic record can stand in for a paper one and when an electronic signature counts as a handwritten one. In its own words it sets “the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper” (§ 11.1(a)).

It does not tell you which records to keep, or for how long. Other FDA rules do that: drug GMP, the GLP rules for nonclinical studies, the device quality system rules, the clinical trial rules. FDA calls those the predicate rules. Part 11 sits on top of them and asks one question: if you keep or sign those records on a computer, can the records and signatures be trusted as much as paper and ink?

On the bench that comes down to a short list a QA manager can recite: a validated system, access limited to the right people, a computer-generated audit trail that never hides the old value, copies an inspector can read, records that survive the whole retention period, and signatures that show who signed, when and why, and cannot be lifted onto another record. The Part 11 requirements, section by section guide takes each control in turn; this page is the map around them.

Takeaway

Start every Part 11 question with “which FDA rule makes us keep this record?” If no rule requires it and it never goes to FDA, Part 11 has nothing to say about it.

Which records it reaches

The rule's reach is set in § 11.1(b): it “applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations.” It also covers electronic records submitted to FDA under the Food, Drug, and Cosmetic Act and the Public Health Service Act, even when no regulation names them.

In 2003 FDA narrowed how it reads that sentence. Its Scope and Application guidance says “we will narrowly interpret the scope of part 11” and lists the records it treats as Part 11 records. Laid out as cases:

Scroll sideways for every column

Which records count as Part 11 records
The record	Part 11 record?	Why
Required by a predicate rule and kept electronically in place of paper	Yes	The electronic file is the record (2003 guidance)
Required, kept both on paper and electronically, and the electronic copy is the one people work from	Yes	Reliance decides, not the existence of a printout (2003 guidance)
Required, produced on a computer, and the signed paper printout is the record people rely on	Generally no	FDA: the computer use “would not trigger part 11” (2003 guidance)
Sent to FDA in electronic form	Yes	§ 11.1(b); the submission type must be one FDA accepts electronically (§ 11.2(b))
Kept electronically, but no FDA rule requires it	No	“not part 11 records” (2003 guidance)
A paper record sent as a fax or a scanned email	No	§ 11.1(b): Part 11 “does not apply to paper records that are, or have been, transmitted by electronic means”
Records required only by certain food-safety rules (parts 112, 117, 121, 507 and some part 1 subparts)	No, unless another rule also requires them	§ 11.1(f), (i)–(p)

The second and third rows are where labs go wrong. Printing a result and signing the printout does not take the record out of Part 11 if analysts still review, reprocess or report from the electronic file. FDA puts it plainly: “actual business practices may dictate whether you are using electronic records instead of paper records.” Its advice is to decide in advance, record by record, whether the paper or the electronic version is the one you rely on, and to “document this decision (e.g., in a Standard Operating Procedure (SOP), or specification document).”

Common misreading

“Part 11 covers every electronic file we hold.” It does not. It reaches records an FDA rule requires and records sent to FDA. A training slide deck or a sales forecast on the same server is outside it, and so is a signed paper form that was only scanned and emailed.

To run a single record through these cases, use the Part 11 applicability checker. It asks three questions and tells you whether Part 11 applies to the record, to the record only, or not at all.

Takeaway

For each regulated record, write down the predicate rule behind it and whether the paper or the electronic version is the one relied on. That short table is your Part 11 scope, and it is the first thing an inspector will ask you to explain.

Who it binds

Part 11 is written to the user, not the software maker. The closed-system controls are addressed to “Persons who use closed systems to create, modify, maintain, or transmit electronic records” (§ 11.10), the open-system ones to persons who use open systems (§ 11.30), and the signature certification to “Persons using electronic signatures” (§ 11.100(c)). In practice that is the regulated firm, its QA unit and every person who signs.

The rule reaches you through whichever predicate rule makes you keep records. These are the usual routes in for the teams this site writes for (see what GxP covers for the wider map):

Scroll sideways for every column

Who Part 11 binds and the predicate rule that brings it in
Who	Predicate rule that brings Part 11 in	A typical Part 11 record
A drug maker and its QC lab	21 CFR 211: § 211.68, § 211.188, § 211.194	An HPLC result, its integration and its audit trail in a chromatography data system
A nonclinical (GLP) lab	21 CFR 58: § 58.130(e), § 58.190, § 58.195	Study raw data entered straight into a LIMS or an electronic notebook
A medical device maker	21 CFR 820 (QMSR): § 820.35 and ISO 13485 Clause 4.2.5	An approved design review or a complaint file in an eQMS
A clinical sponsor, investigator or CRO	21 CFR 312: § 312.57, § 312.62	Case histories in an EDC system, or a signed eConsent form
A biologics maker	21 CFR 600: § 600.12	A manufacturing step recorded at the time it is done, kept electronically

The text has no size threshold. A five-person contract lab running one LIMS is held to the same controls as a large manufacturer; what changes with size is how much validation the risk calls for, not whether the rule applies. For a device maker the route in changed on 2026-02-02, when the QMSR took effect and brought ISO 13485:2016 into part 820 by reference. Part 11 was not excepted (§ 820.1(b)), as the QMSR guide for small device makers explains.

Vendors, hosts and contract labs

A vendor cannot carry your Part 11 duties for you. It can supply a system with audit trails, signature manifestations and validation documents, but the rule asks the user to validate for its own use, write the accountability policy and send FDA the e-signature certification. When records sit in a vendor's cloud, the Part 11 guide for cloud and SaaS systems covers the supplier side.

Three questions decide what it asks of a system

01
Does an FDA rule require the record, or does it go to FDA?
No: Part 11 does not apply. Yes: go on.
02
Is the system closed or open?
Closed (your own people control access): the § 11.10 controls. Open: § 11.10 plus the extra measures in § 11.30.
03
Are the signatures on the record electronic?
Yes: § 11.50, § 11.70 and all of Subpart C apply as well.

Open versus closed turns on one definition: a closed system is one where “system access is controlled by persons who are responsible for the content of electronic records that are on the system” (§ 11.3(b)(4)). The open vs closed system check sorts a real system against that wording.

Takeaway

List every system that holds a predicate-rule record, then mark each one closed or open and say whether it carries e-signatures. Those three columns tell you which sections of Part 11 each system answers to.

How the rule is built: Subparts A, B and C

Part 11 is short. Ten sections in three subparts, and most of the weight sits in two of them: § 11.10 for records and § 11.100 to § 11.300 for signatures.

Subpart A, General Provisions (§§ 11.1–11.3): what the rule covers, how it lets you go paperless, and the definitions everything else leans on.
Subpart B, Electronic Records (§§ 11.10–11.70): the controls on the system and on how a signature appears on, and stays tied to, its record.
Subpart C, Electronic Signatures (§§ 11.100–11.300): who may hold a signature, what it is made of, and how passwords and tokens are managed.

Scroll sideways for every column

The ten sections of 21 CFR Part 11
Section and its eCFR heading	Subpart	What it asks, in one line
§ 11.1Scope	A	What the rule covers, that compliant records and signatures equal paper ones, inspection access, food-safety carve-outs
§ 11.2Implementation	A	Kept records may go electronic if Part 11 is met; submitted records only for types FDA accepts electronically
§ 11.3Definitions	A	Closed and open system, electronic record, electronic and digital signature, biometrics
§ 11.10Controls for closed systems	B	Eleven controls, (a) to (k): validation, copies, retention, access, audit trail, system checks, training, policy, documentation
§ 11.30Controls for open systems	B	The § 11.10 controls as appropriate, plus measures such as encryption and digital signature standards
§ 11.50Signature manifestations	B	A signed record shows the printed name, the date and time, and the meaning of the signature
§ 11.70Signature/record linking	B	A signature cannot be cut, copied or moved to falsify another record
§ 11.100General requirements	C	One signature per person, identity checked first, and a certification letter to FDA
§ 11.200Electronic signature components and controls	C	At least two components, such as a user ID and a password, unless biometric
§ 11.300Controls for identification codes/passwords	C	Unique combinations, periodic checks, lost-token handling, misuse alerts, device testing

Common misreading

The signature sections are not all in Subpart C. § 11.50 (what a signature shows) and § 11.70 (signature linked to its record) sit in Subpart B, Electronic Records, because they are rules about the record a signature lands on. A gap assessment that reads “signatures = Subpart C” misses both.

Each of these sections, with what an inspector asks to see for it, is laid out in 21 CFR Part 11 requirements, section by section.

1997 and 2003: the rule and the narrowed reading

1997-03-20FDA publishes the final rule, “Electronic Records; Electronic Signatures”, at 62 FR 13430.
1997-08-20Part 11 takes effect. Systems already running before this day are the “legacy systems” of the 2003 guidance.
2003FDA issues the Scope and Application guidance: a narrow reading of the scope and enforcement discretion on four controls. FDA's page dates it September 2003, the PDF cover August 2003.
2004–2021§ 11.1 gains carve-outs for records kept under certain food-safety rules. The controls themselves do not change.
2023-03-02A nonsubstantive amendment to § 11.100(c)(1): the signature certification may be sent electronically, and FDA's web page gives the address.
2024-10FDA finalizes its clinical-investigations Q&A on electronic systems, records and signatures, which expands on the 2003 guidance for trials.
2026-02-02The device QMSR takes effect; Part 11 still applies to device records alongside it.

By 2003 FDA had heard that some readings of the rule would “significantly increase the costs of compliance to an extent that was not contemplated at the time the rule was drafted,” mostly around validation, audit trails, retention, copying and legacy systems. So FDA said it was “re-examining part 11” and, while it did, “we will narrowly interpret the scope of part 11.” It also said “we do not intend to take enforcement action to enforce compliance with the validation, audit trail, record retention, and record copying requirements of part 11 as explained in this guidance.” The rulemaking it expected never came: the eCFR text today is still the 1997 rule plus the small amendments above. Part 11 has not been rewritten since 1997, and the 2003 guidance is still FDA's reading of it.

What the discretion covers, and what FDA said it still enforces:

Scroll sideways for every column

FDA's 2003 enforcement position, control by control
Control	Cite	2003 position
Validation	§ 11.10(a)	Discretion
Audit trails	§ 11.10(e), (k)(2)	Discretion
Copies of records for FDA	§ 11.10(b)	Discretion
Record retention and protection	§ 11.10(c)	Discretion
Every Part 11 control, for a legacy system that meets all four of FDA's conditions	all of Part 11	Discretion
Limiting access to authorized people	§ 11.10(d)	Enforced
Operational, authority and device checks	§ 11.10(f), (g), (h)	Enforced
Education, training and experience of people who build, maintain or use the system	§ 11.10(i)	Enforced
Written policy holding signers accountable	§ 11.10(j)	Enforced
Controls over systems documentation	§ 11.10(k)	Enforced
The matching open-system controls	§ 11.30	Enforced
Electronic signatures	§§ 11.50, 11.70, 11.100, 11.200, 11.300	Enforced
The predicate rules and their recordkeeping requirements	e.g. parts 58, 211, 820	Enforced

Inspection risk

Discretion on the Part 11 audit trail is not permission to run without one. The same guidance says “records must still be maintained or submitted in accordance with the underlying predicate rules, and the Agency can take regulatory action for noncompliance with such predicate rules.” GLP already demands that the person entering data is identified and that changes “not obscure the original entry” (§ 58.130(e)); drug GMP demands that changes to computer records be “instituted only by authorized personnel” (§ 211.68(b)). FDA also notes that audit trails “can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation.”

The legacy-system door is shut for almost every small lab. It covers only systems running before 1997-08-20 that met the predicate rules then and now, with documented fitness for intended use. A system bought later can never qualify. Validation itself did not go away either: FDA asked for “a justified and documented risk assessment,” which is the root of today's risk-based approach (see CSA vs CSV).

Takeaway

Read the 2003 discretion as a statement about scale, not about need. Validate and trail what matters by risk, and treat access, signatures, training and the accountability policy as fully in force.

What FDA does not require

Much of what is sold as “Part 11 requirements” is not in the text. These are the claims a small team hears most often from vendors and consultants, set against what the rule and FDA's guidance actually say.

Scroll sideways for every column

Common assumptions about Part 11 and what the text says
What people assume	What the text says	Cite
The software has to be FDA certified	FDA certifies no Part 11 software and keeps no approved list. The rule binds “Persons who use” the system; its only certification is your own letter about your own e-signatures.	§ 11.10, § 11.100(c)
E-signatures need biometrics, PKI or multi-factor login	“At least two distinct identification components such as an identification code and password” is enough. Encryption and digital signatures appear only as “additional measures” for open systems.	§ 11.200(a)(1), § 11.30
Part 11 sets how long records are kept	It sets no period. Records must be retrievable “throughout the records retention period”, and the predicate rule fixes that period, e.g. at least one year after batch expiry for drug records under § 211.180.	§ 11.10(c), (e)
Time stamps must show the signer's local time	FDA: “we do not expect you to record the signer's local time.” Your system documentation should explain which time-zone reference it uses.	2003 guidance, fn. 5
Every electronic record is covered	Only records an FDA rule requires, and records submitted to FDA. A relied-on paper printout generally keeps the computer out of scope.	§ 11.1(b)
Part 11 sets an audit-trail review schedule	It requires the trail and its retention, not a review cadence. “Regularly reviewed” is EU Annex 11 wording; your own risk-based procedure sets the schedule.	§ 11.10(e)
You must follow GAMP 5 or CSA	Neither is in the rule. GAMP 5 is ISPE industry guidance; CSA is FDA guidance written for device production and quality management system software. Both help size validation; neither replaces it.	§ 11.10(a)
A system must be all paper or all electronic	Electronic records and signatures may replace paper “in whole or in part”. Hybrid set-ups are allowed, as long as you know which version is the record.	§ 11.2(a)

None of this makes the job optional. Validation is still a Part 11 control and a predicate-rule duty, and the audit trail still has to exist where records are created and changed. The point is to spend effort where the rule puts it. For the trail itself, see what a GxP audit trail must capture; for sizing validation in a small lab, the CSV guide for small labs.

Takeaway

When anyone tells you “Part 11 requires” something, ask for the section number. If they cannot give one, the demand comes from a guidance, a standard, a predicate rule or a sales deck, and you can weigh it as such.

How Part 11 works with the predicate rules

FDA defines predicate rules as “the underlying requirements set forth in the Act, PHS Act, and FDA regulations (other than part 11).” The split of work is clean once you see it. The predicate rule decides what must be recorded, by whom and for how long. Part 11 decides how the electronic version earns the same trust as paper. One rule never stands in for the other.

Here is one chromatography result in a drug QC lab, followed through both:

Scroll sideways for every column

One HPLC result traced through the predicate rule and Part 11
Question	Answered by	What it says
Must the result be kept?	§ 211.194	Yes. Laboratory records must include “complete data derived from all tests”.
For how long?	§ 211.180	“At least 1 year after the expiration date of the batch”.
Who may change the computer record?	§ 211.68(b)	Changes “instituted only by authorized personnel”, with a backup file of data.
Is the CDS file a Part 11 record?	2003 guidance	Yes, if the lab keeps or relies on the electronic result rather than a signed printout.
What must the trail show?	§ 11.10(e)	Who created, changed or deleted what, and when, without hiding the old value. FDA's own HPLC example lists user name, run date and time, integration parameters and reprocessing details.
How long is the trail kept?	§ 11.10(e)	“At least as long as that required for the subject electronic records”, so the § 211.180 period.
How do analyst and reviewer sign?	§ 11.50, § 11.70	Printed name, date and time, and meaning (performed, reviewed), linked to the result so it cannot be moved.

A GLP lab reads the same way through part 58: § 58.130(e) wants the person entering data identified at the time of entry and changes made “so as not to obscure the original entry”, and Part 11 supplies the electronic means. For the record-quality side of both, the ALCOA+ principles guide gives lab examples.

A cite that no longer exists

The 2003 guidance names 21 CFR 820.70(i) as the device rule on software validation. The QMSR, in force since 2026-02-02, removed § 820.70; software validation now sits in ISO 13485 Subclauses 4.1.6, 7.5.6 and 7.6, incorporated by reference. Part 11 still applies to device records (§ 820.1(b)). Update any SOP or validation plan that still cites 820.70(i).

Takeaway

In your system inventory, put the predicate rule cite next to every record type. It answers the retention question, the “who may change it” question and the Part 11 scope question in one column.

What “Part 11 compliant” means on software

No software is Part 11 compliant on its own, because compliance is a claim about how a regulated user runs a system, not a property of code. FDA keeps no certified list. When a vendor writes “Part 11 compliant”, read it as “the vendor states its product supports the Part 11 controls”, and then check which ones. Some controls are features you can buy; others are things only your organization can do.

Scroll sideways for every column

Which Part 11 controls the system supplies and which you supply
Control	Cite	Who supplies it
Computer-generated, time-stamped audit trail	§ 11.10(e)	The system
Name, date and time, and meaning on every signed record	§ 11.50	The system
Signature locked to its record	§ 11.70	The system
Two signing components, such as user ID and password	§ 11.200(a)	The system
Access limited by role, authority checks	§ 11.10(d), (g)	Both
Readable and electronic copies for an inspector	§ 11.10(b)	Both
Password aging, lost-token handling, misuse alerts	§ 11.300	Both
Validation for your intended use	§ 11.10(a)	You, by procedure
Trained, qualified users and administrators	§ 11.10(i)	You, by procedure
Written policy holding signers accountable	§ 11.10(j)	You, by procedure
Identity checked before a signature is issued	§ 11.100(b)	You, by procedure
Certification letter to FDA	§ 11.100(c)	You, by procedure

A good vendor will hand you validation documents, a description of its audit trail and a statement of how its signatures meet § 11.50 and § 11.70. Our Part 11 software read by category sets what vendors publish against these rows, and the e-signature software comparison does the same for signing tools. To check one signed record yourself, the signature manifestation check compares its printed block with § 11.50.

The one letter you send FDA

Before or when you start using e-signatures, § 11.100(c) asks you to certify to FDA that they are “intended to be the legally binding equivalent of traditional handwritten signatures.” FDA calls it a Letter of Non-Repudiation; it can cover named people or the whole company, and FDA's page says a mailed paper copy is now optional. It is a letter you send, not a product approval, and your vendor cannot send it for you.

Takeaway

Ask every vendor for its Part 11 statement and validation package, map it against the “the system” and “both” rows above, and write SOPs for every “you” row before go-live.

First steps for a small lab or device maker

Most small teams meet Part 11 when they move off paper, buy their first eQMS or LIMS, or get a customer audit question they cannot answer. This order works whichever came first.

01
List the systems that hold regulated records
LIMS, notebooks, instrument software, the eQMS, the training system, spreadsheets with GxP calculations (see Excel spreadsheets under Part 11). One line per system.
02
Name the predicate rule behind each record
Write the cite next to each record type and decide, in an SOP, whether the paper or the electronic version is the one relied on. FDA recommends exactly this.
03
Mark each system open or closed, and note e-signatures
That sets which sections apply: § 11.10 always, § 11.30 if open, § 11.50 to § 11.300 if records are signed electronically.
04
Run a gap check per system
Score each system against the controls with the Part 11 compliance checklist, then rank the gaps by risk to product quality and record integrity.
05
Validate by risk
Validate for your intended use, spending more effort where a failure could hurt quality or data (§ 11.10(a)). A word processor used only to write SOPs is FDA's own example of where validation matters little.
06
Write the procedures the software cannot supply
The e-signature accountability policy (§ 11.10(j)), access granting and removal, identity checks before issuing signatures, and training records for users and administrators (training record template).
07
Send the certification letter
File the Letter of Non-Repudiation under § 11.100(c) before or when e-signatures go live.
08
Keep it current
Change control on the system and its documentation (§ 11.10(k)), a set schedule for reviewing audit trails, and a re-check when the vendor ships a major release.

Selling into Europe as well? The EU Annex 11 guide covers the extra expectations, such as periodic evaluation and business continuity, that Part 11 does not spell out.

Part 11 on one sheet

What it is: FDA's rule for when electronic records and signatures count as paper and ink
Applies to: Records an FDA rule requires, and records submitted to FDA
Binds: The people and firms who use the systems, not the software vendor
In force since: 1997-08-20
Shape: Subpart A general provisions, B electronic records, C electronic signatures
2003 discretion: The Part 11 versions of validation, audit trail, copies and retention
Always enforced: Access, system checks, training, accountability policy, e-signatures, predicate rules
Retention: Set by the predicate rule; Part 11 sets none
Signatures: Two components such as ID and password; name, date and time, and meaning shown
Your letter: Certification to FDA under § 11.100(c)

Questions

Is 21 CFR Part 11 a law?

It is a regulation: Part 11 of Title 21 of the Code of Federal Regulations, issued by FDA under the Food, Drug, and Cosmetic Act and the Public Health Service Act (authority 21 U.S.C. 321-393 and 42 U.S.C. 262). It binds like any FDA regulation. FDA's guidance on it does not: the 2003 guidance is marked “Contains Nonbinding Recommendations”.

Does Part 11 apply to an R&D lab?

Only where an FDA rule requires the record or the record goes to FDA. Early research records that no FDA rule requires fall outside it on FDA's 2003 reading. Nonclinical studies run under GLP (part 58), and records that end up in a submission, are inside it.

Does Part 11 apply to Excel spreadsheets?

Yes, when a spreadsheet holds or calculates a record a predicate rule requires and people rely on the electronic file. Typical gaps are unlocked formula cells, no audit trail of edits and no control over which version of the file is current.

Is a scanned copy of a signed paper form a Part 11 record?

Not while the paper is the record: § 11.1(b) excludes “paper records that are, or have been, transmitted by electronic means”. If you later keep the scan as the record in place of the paper, it is a required record kept electronically in place of paper, which FDA's 2003 guidance treats as a Part 11 record.

Is Part 11 the same as EU Annex 11?

No. They overlap on validation, audit trails, access and signatures, but each has items the other lacks. Annex 11 adds risk management, periodic evaluation, incident management and business continuity; Part 11 alone asks for two signing components, password and token controls and the letter to FDA. The Annex 11 vs Part 11 map sets them side by side.

Is FDA rewriting Part 11?

In 2003 FDA said it anticipated rulemaking to change Part 11. It has not been rewritten since 1997; the eCFR text is the 1997 rule plus small amendments. FDA's current reading lives in its guidance: the 2003 Scope and Application guidance and, for trials, the clinical-investigations Q&A finalized in October 2024.

Sources

21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR), eCFRread 2026-10-22
Electronic Records; Electronic Signatures, final rule, 62 FR 13430, Federal Registerread 2026-10-22
Change of Address; Technical Amendment, 88 FR 13018, Federal Registerread 2026-10-22
Part 11, Electronic Records; Electronic Signatures: Scope and Application, FDAread 2026-10-22
Scope and Application guidance (PDF), FDAread 2026-10-22
Letters of Non-Repudiation Agreement, FDAread 2026-10-22
Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Q&A, FDAread 2026-10-22
Computer Software Assurance for Production and Quality Management System Software, FDAread 2026-10-22
Data Integrity and Compliance With Drug CGMP: Questions and Answers, FDAread 2026-10-22
Medical Devices; Quality System Regulation Amendments, 89 FR 7496, Federal Registerread 2026-10-22
21 CFR Part 820, Quality Management System Regulation, eCFRread 2026-10-22
21 CFR Part 58, Good Laboratory Practice, eCFRread 2026-10-22
21 CFR Part 211, CGMP for Finished Pharmaceuticals, eCFRread 2026-10-22
21 CFR Part 312, Investigational New Drug Application, eCFRread 2026-10-22
21 CFR Part 600, Biological Products: General, eCFRread 2026-10-22
EudraLex Volume 4, Annex 11: Computerised Systems (PDF), European Commissionread 2026-10-22
GAMP 5 Guide, 2nd Edition, ISPEread 2026-10-22