21 CFR Part 11 compliant software: eleven categories and what compliant can mean
Published , reviewed
Verdict
- Start here if you are a small lab
- QualioCategory: eQMS. Procedures, training and deviations are the first records a small GMP or GLP lab keeps, so the first system is usually a quality system. Qualio covers documents, training, CAPA, change control and events, gives customers a validation pack with test scripts and a Part 11 assessment, and its own pages describe six of the ten rows.
- Start here if you make medical devices
- Greenlight Guru QualityCategory: device QMS. Under the QMSR, in force since February 2, 2026, a device maker documents a quality system that meets ISO 13485, with design controls for class II, class III and some class I devices. Greenlight Guru is built for medical device teams, puts design controls and complaints beside CAPA, and provides an IQ protocol with completed OQ and PQ reports. Its signature rows are claimed rather than described on its pages, so test those first.
- Start here if you run clinical studies
- Viedoc EDCCategory: EDC. FDA does not pre-evaluate EDC systems for Part 11, so your checks start from what the vendor documents. Viedoc's own documentation describes seven of the ten rows, more than any other EDC we read, with a validation summary report per release in an inspection readiness packet.
The comparisons behind the three rows: GxP compliance software for small labs, medical device QMS software and EDC and eConsent software.
Fig. 01FDA certifies no software. When it issued Part 11 in 1997 the agency wrote that it “does not seek to certify or otherwise approve of such programs, but expects people who use such programs to ensure that they are suitable for their intended use.” So “21 CFR Part 11 compliant software” means a product whose controls can support your compliance; whether your use complies is a claim your company makes and backs with its own validation. This page sorts the software a regulated lab, device maker or clinical team buys into eleven categories, says what Part 11 asks of each, and names the products in each category whose own pages describe the most of the ten rows we read.
What compliant can mean on a vendor's page
A vendor's Part 11 claim covers the controls the software provides: the audit trail (§ 11.10(e)), the signature display and link (§§ 11.50, 11.70), the sign-in at signing (§ 11.200) and role checks (§ 11.10(d), (g)). We read each product against those rows and recorded one of three things: the vendor's own documentation describes the control, the vendor claims it without describing it, or the vendor publishes nothing on it. Across the 66 products we read for these categories, 212 of 660 cells are described on the vendor's own pages. The rest is a claim to test or a question to ask.
Two limits apply before any product is compared. Part 11 reaches only records a predicate rule requires, or that you submit to FDA (§ 11.1(b)); the applicability checker settles that for one record. And FDA's 2003 guidance narrowed enforcement of Part 11's own validation, audit trail, retention and copying rules, but said it would enforce the predicate rules and the “requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)”. The signature rows are where a gap costs most. The Part 11 requirements, section by section covers each one.
Common misreading
“FDA-certified Part 11 software.” There is no such thing. The only certification in Part 11 is the letter your company sends FDA about its own electronic signatures (§ 11.100(c)). A vendor's certificate or audit report is supplier evidence for your file.
Software by category
Each card says what Part 11 and the rule behind it ask of that kind of system, then names the products whose own pages describe the most of the ten rows, with the count of each status. That is a measure of what a vendor documents in public, not a ranking of the software. The button under each card opens the full comparison for that category. Filter by the work you do to see only the categories it needs.
11 of 11 categories shown
eQMS and document control
11 products readDrug CGMP wants written procedures approved by the quality control unit (§ 211.100(a)) and GLP wants written SOPs (§ 58.81). Once those approvals are electronic, each one must show the signer's printed name, the date and time, and the meaning of the signature, on screen and on any printout (§ 11.50).
Products whose own pages describe the most of the rows
- TrackWise DigitalPharma, biotech and device companies that want quality events, CAPA and change control in one system.9 verified, 0 stated, 1 not stated
- Veeva QMSPharma, biotech and device companies that bring sites, suppliers and contract manufacturers into one system.8 verified, 2 stated, 0 not stated
- Veeva QualityDocsGxP companies that need controlled SOPs and quality documents shared with internal and external parties.8 verified, 1 stated, 1 not stated
On the same kind of system: Part 11 compliant document control software, Part 11 compliant SOP management software, Part 11 compliant CAPA software, Deviation management software, Change control software for regulated teams, Audit management software for GxP teams, Supplier quality management software, Medical device QMS software.
E-signature tools
6 products readSigning is the whole job, so the signature sections apply in full: the § 11.50 manifestation, the § 11.70 link that stops a signature being “excised, copied, or otherwise transferred”, and § 11.200(a)(1): “at least two distinct identification components such as an identification code and password.”
Products whose own pages describe the most of the rows
- Adobe Acrobat Sign (Bio-Pharma Settings)Regulated teams on Acrobat Sign business or enterprise plans that can run a dedicated Part 11 group and their own validation.9 verified, 1 stated, 0 not stated
- Docusign Part 11 modulePharma, biotech, medtech and clinical teams on Docusign eSignature that need Part 11 signing for SOPs, batch records and agreements.6 verified, 4 stated, 0 not stated
On the same kind of system: Is Docusign Part 11 compliant?, Is Adobe Acrobat Sign Part 11 compliant?, Docusign vs Adobe Sign for regulated teams.
Training records (LMS)
5 products readPart 11 itself asks that the people who develop, maintain or use a system “have the education, training, and experience to perform their assigned tasks” (§ 11.10(i)). The training record is how you show it, so the sign-off on it is a regulated signature.
Products whose own pages describe the most of the rows
- Veeva TrainingLife-science companies, often already on Veeva quality applications, managing role-based GxP training.8 verified, 1 stated, 1 not stated
- Qualio Training ManagementStartups and small life-science companies that want training inside a simple eQMS.6 verified, 3 stated, 1 not stated
On the same kind of system: Training record template.
Validation software (CSV and CSA)
6 products readThese tools hold the evidence for § 11.10(a), validation “to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.” Executed test steps and their sign-offs are electronic records too, so the tool needs the same controls as the systems it validates.
Products whose own pages describe the most of the rows
- Veeva Validation ManagementCompanies already on Veeva quality applications that want validation in the same system.8 verified, 1 stated, 1 not stated
- Tricentis VeraTeams validating software (CSV/CSA) whose testing already runs in Jira or Tricentis tools.3 verified, 5 stated, 2 not stated
On the same kind of system: IQ OQ PQ template, CSA validation scope planner, Traceability matrix template.
LIMS
6 products readA LIMS holds results. Drug CGMP asks for “complete data derived from all tests” (§ 211.194(a)), and GLP asks that the person entering data is identified at input and that a change never hides the original entry (§ 58.130(e)). The Part 11 audit trail is how a LIMS proves both.
Products whose own pages describe the most of the rows
- LabKey LIMSResearch and biotech labs that want a configurable LIMS, with Part 11 signatures in the Enterprise and Biologics editions.8 verified, 2 stated, 0 not stated
- LabVantage PharmaPharma and biotech R&D, analytical and QC manufacturing labs.2 verified, 8 stated, 0 not stated
On the same kind of system: What is a LIMS (and when is it Part 11 ready)?.
Electronic lab notebooks (ELN)
6 products readA notebook entry used in a GLP study is study data under § 58.130(e). When the author signs and a colleague witnesses it, both signatures need the § 11.50 manifestation and must stay linked to that entry (§ 11.70).
Products whose own pages describe the most of the rows
- Labguru ELNAcademic, biotech, pharma, QC and contract research labs.7 verified, 1 stated, 2 not stated
- Benchling NotebookBiotech and pharma R&D teams that want a separate validated environment for their GxP work.4 verified, 6 stated, 0 not stated
On the same kind of system: What is a LIMS (and when is it Part 11 ready)?.
Chromatography data systems (CDS)
6 products readFDA's 2018 data integrity Q&A uses HPLC as its audit trail example (user name, date and time of the run, integration parameters, reprocessing details) and says “Aborted or incomplete injections should be captured in audit trails and should be investigated and justified.”
Products whose own pages describe the most of the rows
- Empower Chromatography Data SystemRegulated labs that want acquisition, processing, reporting and data distribution in one system.8 verified, 1 stated, 1 not stated
- OpenLab CDSRegulated labs running LC, GC and single-quad MS instruments that want a clause-by-clause Part 11 map.8 verified, 0 stated, 2 not stated
On the same kind of system: What is an audit trail (in GxP)?.
Data integrity and audit trail review
5 products readFDA's 2018 Q&A wants data that are “attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA)”. Software that collects data from instruments or reviews their trails has to carry that metadata with the record, audit trail included.
Products whose own pages describe the most of the rows
- CFR GatewayQC labs with older PC-controlled instruments they do not want to replace.2 verified, 6 stated, 2 not stated
- Tetra Scientific Data and AI CloudBiopharma companies centralizing instrument data across R&D and QC.1 verified, 8 stated, 1 not stated
On the same kind of system: Audit trail review checklist, ALCOA+ record check.
Temperature and environmental monitoring
5 products readReadings and alarm acknowledgements are Part 11 records once a predicate rule needs them or your procedures rely on them in electronic form. A changed alarm limit or sensor setting then needs a time-stamped trail (§ 11.10(e)), and an acknowledgement signed electronically needs the § 11.50 manifestation.
Products whose own pages describe the most of the rows
- Centron PresidioPharma, biotech and hospital sites that want monitoring together with vendor validation services.3 verified, 6 stated, 1 not stated
- Vaisala viewLincLabs, warehouses and GMP facilities monitoring storage and cleanroom conditions.3 verified, 3 stated, 4 not stated
Electronic batch records and MES
5 products readProduction steps “shall be documented at the time of performance” (§ 211.100(b)), and Part 11 adds “operational system checks to enforce permitted sequencing of steps and events, as appropriate” (§ 11.10(f)). Each performed-by and checked-by entry is a signature under § 11.50.
Products whose own pages describe the most of the rows
- Composable MESDrug and device makers that want to digitize batch records app by app.8 verified, 1 stated, 1 not stated
- Critical Manufacturing MES for Medical DevicesMedical device manufacturers that need eDHR under Parts 11 and 820.1 verified, 7 stated, 2 not stated
EDC and eConsent
5 products readFDA's 2024 clinical Q&A: “FDA does not perform preliminary evaluations of electronic systems (e.g., EDC system, electronic clinical trial management system) to determine whether they comply with part 11 requirements.” The sponsor or site checks the system, and the agreement needs “A plan that ensures the sponsor will have access to data throughout the regulatory retention period”.
Products whose own pages describe the most of the rows
- Viedoc EDCSponsors and CROs that want inspection documents for each release.7 verified, 2 stated, 1 not stated
- OpenClinica EDCSponsors, CROs and research teams that want EDC and eConsent in one system.5 verified, 2 stated, 3 not stated
On the same kind of system: 21 CFR Part 11 for cloud and SaaS systems.
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
What to test first, by category
A demo shows what the vendor chose to show. One test per category, run in a sandbox before you sign, tells you more. Each row below names the Part 11 row most likely to matter for that kind of record and how many of the products we read describe it on their own pages.
Scroll sideways for all columns
| Category | Test this row first | How to test it in a demo | Products that describe it |
|---|---|---|---|
| eQMS and document control | Signature shows name, date and time, and meaning§ 11.50 | Print an approved SOP. Every approval should show the printed name, the date and time, and a meaning such as approval. | 5 of 11 verified |
| E-signature tools | Two distinct components to sign§ 11.200(a) | Sign from the e-mail link. The signer should enter both components at the moment of signing, not only when logging in days earlier. | 3 of 6 verified |
| Training records (LMS) | Access and authority checks by role§ 11.10(d), (g) | Log in as a trainee and try to mark your own training complete. Only a trainer or QA role should be able to sign it off. | 3 of 5 verified |
| Validation software (CSV and CSA) | Validation documentation to support the customer's own validation§ 11.10(a) | Ask for the vendor's own validation package for the tool. A paperless validation tool still has to be validated for your use. | 3 of 6 verified |
| LIMS | Secure, computer-generated, time-stamped audit trail§ 11.10(e) | Edit a result after review. The trail should show the old and new value, who changed it, when, and the reason. | 3 of 6 verified |
| Electronic lab notebooks (ELN) | Signature linked to its record so it cannot be moved§ 11.70 | Sign and witness an entry, then try to edit it. The entry should lock, or the edit should void the signatures and show in the trail. | 2 of 6 verified |
| Chromatography data systems (CDS) | Secure, computer-generated, time-stamped audit trail§ 11.10(e) | Reprocess a run with new integration parameters. The trail should name who did it and when, and the first result should still be there. | 5 of 6 verified |
| Data integrity and audit trail review | Audit trail kept as long as the record§ 11.10(e) | Move a file from an instrument PC into the system. The original audit trail should come with it and stay as long as the record. | 0 of 5 verified |
| Temperature and environmental monitoring | Secure, computer-generated, time-stamped audit trail§ 11.10(e) | Change an alarm limit, then find the change in the trail: who made it, when, and the old value. | 4 of 5 verified |
| Electronic batch records and MES | Signature shows name, date and time, and meaning§ 11.50 | Run a step and its second-person check. Both signatures should show name, date and time, and meaning on screen and in the printed batch record. | 1 of 5 verified |
| EDC and eConsent | Accurate, complete copies for inspection§ 11.10(b) | Export one full casebook with its audit trail, in a readable and an electronic form, and check the contract says you can do so for the whole retention period. | 2 of 5 verified |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Write what you saw into your validation file as you go; the URS template turns these checks into numbered requirements you can trace to a test.
What no software does for you
Whatever you buy, Part 11 leaves these with the regulated company:
- § 11.10(a)
- Validate the system for your use“Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.” A vendor package is a starting point you review against your intended use; the validation guide for small labs sizes the work.
- § 11.10(i)
- Train the people who use itEveryone who develops, maintains or uses the system must “have the education, training, and experience to perform their assigned tasks”, and you keep the records that show it.
- § 11.10(j)
- Write the accountability policy“Written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures”. No product ships this; it is your SOP.
- § 11.100(b)
- Check identity before issuing a signature“The organization shall verify the identity of the individual” before it assigns or certifies an electronic signature.
- § 11.100(c)
- Send FDA the certification letterYou certify that your electronic signatures are “intended to be the legally binding equivalent of traditional handwritten signatures”. It is a letter you send to FDA, not a product approval; FDA's Letters of Non-Repudiation Agreement page explains how.
How we chose the examples
This page has no lineup of its own: each card draws on the products already read for that category's own comparison. The examples are computed from those readings: the products with the most rows described on the vendor's own pages, ties broken by fewer rows with nothing published. A vendor with fewer described rows can still fit you better; the category pages give a verdict by use case.
How we read the vendors
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.
FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.
Some vendors' pages could not be read on the read date, so they are not on this page.
Questions
Is there an FDA list of Part 11 compliant software?
No. In the 1997 preamble FDA wrote that it “does not seek to certify or otherwise approve of such programs, but expects people who use such programs to ensure that they are suitable for their intended use.” Its 2024 clinical Q&A says the same for EDC and trial systems: FDA does not evaluate them in advance. A list that calls itself FDA-approved Part 11 software is a marketing list.
A vendor sent us a Part 11 certificate. Is that enough?
It is evidence for your supplier file, not a compliance status. The only certification in Part 11 is the letter your company sends FDA about its own electronic signatures (§ 11.100(c)). What you still owe is the validation for your intended use (§ 11.10(a)), training (§ 11.10(i)) and the accountability policy (§ 11.10(j)). The Part 11 compliance checklist lists every line for one system.
Which category should a small lab buy first?
Usually a quality system, because procedures, deviations and training records start on day one and link to each other. Data systems such as a LIMS or an ELN can follow once the volume of results makes paper and instrument printouts slow. The GxP compliance software comparison for small labs maps each GMP, GLP and GCP duty to the system that holds it.
Does Part 11 apply if we print the record and sign it on paper?
Often not. FDA's 2003 guidance says that when paper printouts meet the predicate rule and you rely on them, “the use of computer systems in the generation of paper records would not trigger part 11.” It recommends you document that decision, for example in an SOP. If your team works from the electronic copy, it is a Part 11 record again. The Part 11 applicability checker walks one record through the test.
Can Part 11 records live in a vendor's cloud?
Yes, and the duty stays with you: “Regulated entities are responsible for ensuring that electronic records meet applicable part 11 requirements” (2024 clinical Q&A). The 1997 preamble regards records stored on systems operated by third parties, such as commercial online services, as being on an open system, which brings in § 11.30. Read Part 11 for cloud and SaaS systems and classify yours with the open vs closed system check.
Can a spreadsheet be our Part 11 software?
A spreadsheet that holds or calculates GxP data is a computerised system like any other, so the same rows apply: access, an audit trail on changes, signatures, validation. Most of those are hard to build in a plain file. The guide to Excel spreadsheets under Part 11 covers when a spreadsheet can stay and when to move the work into a system.
We also sell into the EU. Does Annex 11 change what we buy?
It adds work around the software more than in it: a formal agreement with the supplier (§ 3), a documented risk assessment behind validation and data integrity decisions (§ 1) and periodic evaluation (§ 11). That is why the last row we read on every product is whether the vendor names Annex 11 at all. The Annex 11 vs Part 11 map sets the two side by side.
Sources
- 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
- Electronic Records; Electronic Signatures, final rule and preamble, 62 FR 13430 (1997), Federal Registerread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003 guidance), FDAread 2026-10-22
- Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Q&A (2024), FDAread 2026-10-22
- Data Integrity and Compliance With Drug CGMP: Questions and Answers (2018), FDAread 2026-10-22
- 21 CFR Part 211, CGMP for Finished Pharmaceuticals (§§ 211.100, 211.194), eCFRread 2026-10-22
- 21 CFR Part 58, Good Laboratory Practice (§§ 58.81, 58.130), eCFRread 2026-10-22
- Medical Devices; Quality System Regulation Amendments, 89 FR 7496, Federal Registerread 2026-10-22
- 21 CFR Part 820, Quality Management System Regulation (§ 820.10), eCFRread 2026-10-22
- Letters of Non-Repudiation Agreement, FDAread 2026-10-22
- Qualio: Part 11 page, Qualioread 2026-10-22
- Greenlight Guru Quality: Part 11 page, Greenlight Gururead 2026-10-22
- Viedoc EDC: Part 11 page, Viedoc Technologiesread 2026-10-22
- TrackWise Digital: Part 11 page, Sparta Systemsread 2026-10-22
- Veeva QMS: Part 11 page, Veeva Systemsread 2026-10-22
- Veeva QualityDocs: Part 11 page, Veeva Systemsread 2026-10-22
- Adobe Acrobat Sign (Bio-Pharma Settings): Part 11 page, Adoberead 2026-10-22
- Docusign Part 11 module: Part 11 page, Docusignread 2026-10-22
- Veeva Training: Part 11 page, Veeva Systemsread 2026-10-22
- Qualio Training Management: Part 11 page, Qualioread 2026-10-22
- Veeva Validation Management: Part 11 page, Veeva Systemsread 2026-10-22
- Tricentis Vera: Part 11 page, Tricentisread 2026-10-22
- LabKey LIMS: Part 11 page, LabKeyread 2026-10-22
- LabVantage Pharma: Part 11 page, LabVantage Solutionsread 2026-10-22
- Labguru ELN: Part 11 page, BioData Inc.read 2026-10-22
- Benchling Notebook: Part 11 page, Benchlingread 2026-10-22
- Empower Chromatography Data System: Part 11 page, Watersread 2026-10-22
- OpenLab CDS: Part 11 page, Agilentread 2026-10-22
- CFR Gateway: Part 11 page, Agaram Technologiesread 2026-10-22
- Tetra Scientific Data and AI Cloud: Part 11 page, TetraScienceread 2026-10-22
- Centron Presidio: Part 11 page, Rees Scientificread 2026-10-22
- Vaisala viewLinc: Part 11 page, Vaisalaread 2026-10-22
- Composable MES: Part 11 page, Tulipread 2026-10-22
- Critical Manufacturing MES for Medical Devices: Part 11 page, Critical Manufacturingread 2026-10-22
- OpenClinica EDC: Part 11 page, OpenClinicaread 2026-10-22