What is a LIMS (and when is it Part 11 ready)?
Published 12 min read
Fig. 01A LIMS (laboratory information management system) is the software that carries a sample through a lab: it logs the sample in, assigns the tests, takes the results from analysts and instruments, checks them against the specification, routes them for review and approval, and issues the report or certificate of analysis. When a predicate rule requires those records and you keep them in the LIMS, it becomes a Part 11 system, and the question stops being what it can do and becomes what it can prove.
What a LIMS does
In a drug or biologics QC lab, a GLP study lab, a device test lab or a biotech R&D group, the LIMS is the register of every sample and every result. (Clinical diagnostic labs run a laboratory information system, an LIS, under different rules; this guide does not cover them.) The quickest way to see what a LIMS has to hold is to read the drug CGMP rule for lab records, § 211.194(a). Its eight items read like a LIMS specification: the sample, the method, the measure used, all the data, the calculations, the result against the standard, who did the test, and who reviewed it.
Scroll sideways for every column
| What a LIMS does | What it records | Where a rule already asks for it |
|---|---|---|
| Sample login | Sample ID, where it came from, quantity, lot, date taken and date received | § 211.194(a)(1); GLP specimens identified by test system, study, nature and date § 58.130(c) |
| Chain of custody and storage | Who received, moved, split or used the sample, where it is stored, when it was disposed of | Your own SOPs; GLP archive entry limited to authorized personnel § 58.190(d) |
| Test assignment and methods | Which tests run on which sample, the method and its version, the specification limits | A statement of each method § 211.194(a)(2); spec changes approved by the quality unit § 211.160(a) |
| Result entry and instrument data | Weights, raw values, units, and the graphs, charts and spectra behind them | Weight or measure used § 211.194(a)(3); “a complete record of all data” § 211.194(a)(4) |
| Calculations | Formulas, units, conversion and equivalency factors, the calculated result | § 211.194(a)(5); where the system does the maths, a written record of the program and validation data § 211.68(b) |
| Specification check | The result against its limit, and a flag when it falls outside | How each result compares with its standard § 211.194(a)(6) |
| Analyst sign-off and second-person review | Who ran each test and when; who reviewed the complete record, and the meaning of each signature | § 211.194(a)(7), (a)(8); in electronic form § 11.50, § 11.70 |
| Reports and certificates of analysis | The signed result as a printout or PDF that leaves the lab | Name, date and time, meaning on every printout § 11.50(b); accurate, complete copies § 11.10(b) |
| Reagents, standards, instruments, stability | Lots and expiry of reagents and standards, calibration due dates, stability pulls | § 211.194(c), (d), (e) |
| Archive and retrieval | The result, its trail and its signatures, findable for the whole retention period | Ready retrieval § 11.10(c); GLP archives “indexed to permit expedient retrieval” § 58.190(e) |
Ten functions; the third column quotes the eCFR as read 2026-10-22. GLP and device labs have their own record rules; the cites show where they overlap.
Already comparing vendors?
Our LIMS comparison for biotech and Part 11 labs reads six vendors' own documentation against the same 10 Part 11 rows this guide uses, with a verdict for a small lab.
Takeaway
Before you look at any software, write down which of these ten functions your lab runs today, on paper or in spreadsheets, and which rule asks for each record. That list is the start of your requirements.
Fig. 02Where instrument data fits
Instrument data is where a LIMS gets harder than a form. FDA's 2018 data integrity Q&A splits instrument records in two. A static record is “a fixed-data record such as a paper record or an electronic image”. A dynamic record lets the user interact with the content: move a chromatogram's baseline and the peaks change.
For simple instruments the static record can be the original. FDA names pH meters and balances, whose printout may be the record you keep. For instruments whose files can be reprocessed, it cannot: the Q&A says an FT-IR spectral file is dynamic, and a printout “would not satisfy CGMP requirements to retain original records or true copies”. So a result typed into the LIMS from a chromatogram is only half the record. The dynamic file stays in the chromatography data system or a data archive, for as long as the result does.
Common misreading
A PDF of the chromatogram attached to the LIMS result is not the original record. Keep the dynamic file, its audit trail and every reprocessing; FDA's Q&A says that when chromatography is reprocessed each result is kept for review.
The same Q&A names the LIMS directly: a LIMS “can be designed to automatically save after each entry”, the electronic version of writing each entry in ink as you go. Ask for that setting in the demo. Chromatography systems are read on their own rows in the chromatography data system comparison.
LIMS vs ELN vs SDMS vs CDS
Four kinds of lab software overlap, and vendors blur the lines by selling them as one platform. What separates them is the record each one owns, which also decides the Part 11 row that bites first.
Scroll sideways for every column
| System | What it holds | Shape of the record | Part 11 row that bites first | Read more |
|---|---|---|---|---|
| LIMSlaboratory information management system | Samples, tests, specifications, results, review and release | Structured fields moving through a fixed workflow | Review and approval signatures § 11.50, § 11.70; role checks § 11.10(g) | LIMS compared |
| ELNelectronic lab notebook | How an experiment was planned and done: protocol, observations, attachments | Free-form pages, signed and then locked | Author and witness signatures § 11.50; edits after signing kept in the trail § 11.10(e) | ELNs compared |
| SDMSscientific data management system | Raw files captured from many instruments, catalogued and archived | Instrument files in their own formats, often dynamic | Complete data kept § 211.194(a)(4); retrieval for the retention period § 11.10(c) | Not compared on this site |
| CDSchromatography data system | Runs the chromatographs, acquires and integrates the peaks | Dynamic: the baseline can be moved and the run reprocessed | A trail on every reprocessing § 11.10(e); each result kept for review (FDA 2018 Q&A 14) | CDS compared |
| Spreadsheet | The calculations and logs a small lab keeps before it buys anything | A file anyone with access can overwrite | Trail and locking § 11.10(e); calculation checked § 211.68(b) | Excel under Part 11 |
A small lab rarely needs all four on day one. Pick one home for each record type and write it down: results in the LIMS, raw chromatograms in the CDS, experiment write-ups in the ELN. Two systems each holding part of one record is how a trail goes missing. Whatever holds the record needs the audit trail described in what an audit trail is in GxP.
What Part 11 ready has to mean
No LIMS is FDA certified, because FDA certifies none. Part 11 binds the people who use a system, so “Part 11 ready” can only mean the software carries the technical controls and leaves you able to do the rest. Of the fifteen controls below, five can only be carried by your lab, whatever the vendor says.
Scroll sideways for every column
| Control | Who carries it | What to see in the demo or keep on file |
|---|---|---|
| Access limited to authorized people§ 11.10(d) | Both | Named accounts only; your list of who has which role |
| Secure, time-stamped audit trail§ 11.10(e) | Software | Old and new values, user, date and time, on every change |
| Steps forced into order§ 11.10(f) | Both | No approval before review; your workflow configured to match the SOP |
| Authority checks by role§ 11.10(g) | Both | An analyst cannot approve or edit a spec; roles you assign |
| Device checks on the source of input§ 11.10(h) | Software | Instrument data tagged with the instrument it came from |
| Signature shows name, date and time, meaning§ 11.50 | Software | All three on screen and on the printed CoA |
| Signature linked to its record§ 11.70 | Software | Editing a signed result voids or blocks the signature |
| Two components to sign§ 11.200(a) | Software | ID and password at the first signing in a session |
| Accurate, complete copies§ 11.10(b) | Both | An export with data, trail and signatures; your SOP for inspections |
| Records protected and retrievable§ 11.10(c) | Both | Backups and restore tested; the retention period from your predicate rule |
| Validation for your intended use§ 11.10(a) | Your lab | Your requirements, your tests, your report; the vendor pack is an input |
| Trained builders, admins and users§ 11.10(i) | Your lab | Training records before anyone signs |
| Written accountability for e-signatures§ 11.10(j) | Your lab | A signed policy every user has read |
| Control of system documentation§ 11.10(k) | Your lab | Configuration and admin documents under change control |
| Certification of e-signatures to FDA§ 11.100(c) | Your lab | Your non-repudiation letter, on file with FDA |
The software rows are the ones to see working in a demo. The rows marked “Your lab” are documents you write, and a vendor can help but cannot sign them for you. Each control is explained in 21 CFR Part 11 requirements, section by section.
Inspection risk
A shared login, or one person signing with another's credentials, breaks the rule that a signature is unique to one person § 11.100(a) and used only by its owner § 11.200(a)(2). A shared bench account is how a well-built LIMS ends up with results nobody can attribute.
A demo script you can run
Sales demos show features. Inspectors follow a result. Send this script ahead of the demo and ask the vendor to run it live on a test sample, in this order. It changes with your lab type, hosting and EU release.
Pre-filled for a drug QC lab buying a hosted LIMS. Change any choice and the script follows.
- 01
The record your rule asks for § 211.194(a)
Ask them to: Open one finished test record from sample receipt to approval.
You should see: Sample, method, every data point and spectrum, calculations, result against spec, the analyst, and the second-person reviewer.
- 02
Access and authority checks by role § 11.10(d), (g)
Ask them to: Log in as an analyst and try to approve your own result, edit a specification and open the admin settings.
You should see: Each attempt refused. Admin rights sit with someone independent of the record content (FDA 2018 Q&A 4).
- 03
Secure, computer-generated, time-stamped audit trail § 11.10(e)
Ask them to: Enter a result, change it, then delete a test from the sample.
You should see: Three trail entries, each with user, date and time, old and new value. The first value is still readable.
- 04
Two distinct components to sign § 11.200(a)
Ask them to: Sign twice in one session, then log out, log back in and sign again.
You should see: ID and password at the first signing; at least the password after that; both again in the new session.
- 05
Signature shows name, date and time, and meaning § 11.50
Ask them to: Sign the reviewed result as Reviewed, approve it, then print the report or CoA.
You should see: Printed name, date and time, and meaning for both signatures, on screen and on paper.
- 06
Signature linked to its record so it cannot be moved § 11.70
Ask them to: Change the result after it has been approved.
You should see: The change is blocked, or the approval is voided and the result goes back for review.
- 07
Accurate, complete copies for inspection § 11.10(b)
Ask them to: Export one sample's full record as you would hand it to an inspector.
You should see: A readable copy and an electronic copy carrying results, metadata, the trail and the signatures.
- 08
Audit trail kept as long as the record § 11.10(e)
Ask them to: Close and archive the sample, then ask for its trail back.
You should see: The trail comes back with the record; nobody can purge it alone before the retention period ends.
- 09
Validation documentation to support the customer's own validation § 11.10(a)
Ask them to: Ask for the validation package and a list of what it does not cover.
You should see: Evidence for standard functions; your configuration and workflows left to your own validation (FDA 2018 Q&A 3).
- 10
Open-system controls: encryption, digital signatures § 11.30
Ask them to: Ask who controls access to the hosted system and how records are protected from creation to receipt.
You should see: If the vendor controls access the system is open, and encryption and digital signature standards come into play.
Retention: At least 1 year after the batch's expiration date (§ 211.180).
Takeaway
Keep the vendor's answers and screenshots: they are evidence for your validation. Check the printed report from the signing step with the signature manifestation check, then see how each vendor documents the same rows in the Part 11 LIMS comparison.
What a small lab should settle before buying
Each of these gets harder to change once a contract is signed and the system is configured. Settle the nine first.
- 01
Which records are regulated
List the records a predicate rule requires that will live in the LIMS. That list decides whether Part 11 applies at all (§ 11.1(b)). The Part 11 applicability checker answers it one record at a time.
- 02
Paper or screen as the record you rely on
If reviewers sign printouts that meet the predicate rule and rely on those, FDA's 2003 guidance says the computer that produced them does not trigger Part 11. The day review moves to the screen, it does. FDA recommends you document the choice, for example in an SOP.
- 03
Your workflow, written as requirements
Write the result's path from login to release as numbered requirements before the first demo. FDA's 2018 data integrity Q&A puts it plainly: validate the system but not its intended use and “you cannot know if your workflow runs correctly.” The URS template gives you the format.
- 04
Which instruments feed it, and where their files stay
Balances and pH meters can print an original record. Chromatographs and FT-IR produce dynamic files that a printout cannot replace. Decide whether the LIMS, a CDS or an SDMS keeps those files, and test the hand-off.
- 05
Hosting, and who controls access
A hosted LIMS needs a written agreement with the vendor (Annex 11 § 3 asks for formal agreements with third parties) and an answer on whether the system is open or closed. The open vs closed system check settles the second, and Part 11 for cloud and SaaS systems covers the rest.
- 06
Who validates, and how much
The vendor's package covers its standard functions. Your configuration, calculations and reports are yours to test, sized by risk. Computer system validation for small labs sizes that work for a small team.
- 07
What moves over from the old system
Spreadsheets, paper logbooks, an old database: decide what migrates, what is archived where it is, and how you will prove nothing changed on the way. Annex 11 § 4.8 makes checks on migrated data part of validation.
- 08
Who holds the admin rights
In a small lab the person who sets up the LIMS often enters results too. FDA's 2018 Q&A says the administrator role should go to people independent of the record content. Name that person, or an outside administrator, before go-live.
- 09
How you get everything out
Ask how every result, trail and signature leaves in readable and electronic form if you change vendor (§ 11.10(b), (c)). Record retention outlasts most software contracts.
Takeaway
Settle the first four on paper before any demo; they turn a sales call into a test. The last five belong in the contract and the validation plan.
A LIMS on one sheet
- What it is
- The system that carries a sample from login through tests, review and approval to a signed result.
- Who runs one
- R&D and biotech labs, drug and biologics QC, GLP study labs, device test labs.
- When Part 11 applies
- Once it holds records a predicate rule requires, or records submitted to FDA (§ 11.1(b)).
- What the software brings
- Audit trail, role and sequence checks, signature manifestation and linking, two-part signing.
- What only your lab brings
- Validation for your use, training, the signature policy, document control, the letter to FDA.
- Demo test that tells most
- Change an approved result, then print the report. Watch what happens to the signature and the trail.
- Not a LIMS
- Notebook pages (ELN), raw instrument files (SDMS), chromatography runs (CDS).
Questions
Does FDA require a lab to have a LIMS?
No. The predicate rules require records, not a system: § 211.194 lists what a drug lab record must hold and § 58.130(e) how GLP data are entered and changed, and paper meets both. Part 11 only sets the conditions for keeping those records electronically.
Is a LIMS the same as an ELN?
No. A LIMS runs samples and results through a fixed workflow; an ELN records how an experiment was done. Many vendors sell both on one platform, but each record type still needs one home, and the signature rows differ: review and approval in a LIMS, author and witness signatures in a notebook.
Can a spreadsheet be our LIMS?
It can hold results, but every Part 11 control has to be built around a file anyone with access can overwrite: the trail, the locking, the signatures, the checked calculation. Under drug CGMP, § 211.68(b) also wants input and output checked for accuracy. Many small labs start there; the controls get harder to hold as results and users grow.
What does pre-validated mean on a LIMS?
That the vendor has tested its standard functions and will hand you the evidence. It does not validate your use. FDA's 2018 data integrity Q&A: “If you validate the computer system but you do not validate it for its intended use, you cannot know if your workflow runs correctly.”
Is a cloud LIMS an open system?
It depends on who controls access, not on where the server sits. Part 11 calls a system closed when access is controlled by the people responsible for the records on it (§ 11.3(b)(4)), and open when it is not (§ 11.3(b)(9)). An open system adds the § 11.30 measures, such as encryption and digital signature standards.
Does the LIMS vendor send FDA our e-signature certification?
No. § 11.100(c) puts the letter on the people using electronic signatures. FDA accepts an individual letter or a company-wide one that covers all employees.
Sources
Regulation text quoted from the eCFR and EudraLex; guidance quoted from FDA. General information, not regulatory advice.
- 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR, up to date as of 2026-10-20), eCFRread 2026-10-22
- 21 CFR Part 211, CGMP for Finished Pharmaceuticals (§ 211.68, § 211.160, § 211.180, § 211.194), eCFRread 2026-10-22
- 21 CFR Part 58, Good Laboratory Practice (§ 58.130, § 58.190, § 58.195), eCFRread 2026-10-22
- 21 CFR Part 600, Biological Products: General (§ 600.12), eCFRread 2026-10-22
- 21 CFR Part 820, Quality Management System Regulation (§ 820.35), eCFRread 2026-10-22
- Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018), FDAread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures — Scope and Application (2003 guidance), FDAread 2026-10-22
- Letters of Non-Repudiation Agreement, FDAread 2026-10-22
- EudraLex Volume 4, Annex 11: Computerised Systems (2011), § 3, § 4.8, § 8, European Commissionread 2026-10-22