Chromatography data system software: six CDS read against Part 11

FDA's “Data Integrity and Compliance With Drug CGMP: Questions and Answers” (December 2018) is guidance for drug manufacturers, and much of it is about lab data. When it needs an example, it reaches for chromatography: an HPLC run for what an audit trail holds, a chromatogram for a dynamic record, injections for when data must be saved. Two more answers are about chromatography alone, and one says who reads the trail. The table quotes each, with FDA's answer numbers.

The guidance gives the background in one sentence: “In recent years, FDA has increasingly observed CGMP violations involving data integrity during CGMP inspections,” and these have led to “warning letters, import alerts, and consent decrees.” It publishes no count there, and neither do we.

The Q&A sorts records into two kinds. A static record is fixed: a paper printout or an electronic image. A dynamic record lets the user interact with its content, and its example is a chromatographic record whose baseline can be moved so that “the resulting peaks may appear smaller or larger.”

Answer 10 draws the consequence. A printout can serve as the record only where it is the original or a true copy, as with a balance. For a dynamic file it says a static record “would not satisfy CGMP requirements to retain original records or true copies” (§ 211.180(d)). FDA's example there is an FT-IR spectral file; by the definition in answer 1.d, a chromatogram you can reprocess is the same kind of record. It is FDA's “original or a true copy” applied to a peak table; our guide to the ALCOA+ principles covers the other attributes.

10 rows, each read on the vendor's own pages. A row is verified only where the vendor's documentation describes the control; a general “Part 11 compliant” line counts as stated.

The table says what a vendor has written down. A demo shows whether the screens behave that way. Pick the CDS you are seeing next: each of the eight steps shows what that vendor's own pages say about the row it tests, so you know which ones need the closest look. Print it or copy it into the meeting notes, and keep the answers for your validation file.

Once the system is live, the same checks become routine review. The audit trail review checklist turns them into a signed worksheet, and the signature manifestation check tests a signed report against § 11.50.

The verdict picks three. Every CDS here suits a lab somewhere, so this is the whole lineup set against the lab each vendor says it serves, with how much of the table its pages describe.

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Whatever you choose, validation stays with your lab under § 11.10(a). Write the steps above into your user requirement specification so they become tests, and scope the rest by risk as our guide to computer system validation describes.

Each card shows the six rows a chromatography result leans on: the trail and its retention, who may change or sign, the signature and its link to the result, and the validation papers.

Regulation text from the eCFR and EudraLex; guidance from FDA. Vendor sources are linked on each vendor card. General information, not regulatory advice.

1. Data Integrity and Compliance With Drug CGMP: Questions and Answers (guidance, December 2018), FDAread 2026-10-22
2. Data Integrity and Compliance With Drug CGMP: Questions and Answers (PDF), FDAread 2026-10-22
3. 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
4. 21 CFR Part 211, CGMP for Finished Pharmaceuticals, eCFRread 2026-10-22
5. 21 CFR Part 58, Good Laboratory Practice for Nonclinical Laboratory Studies, eCFRread 2026-10-22
6. Part 11, Electronic Records; Electronic Signatures: Scope and Application (guidance, 2003), FDAread 2026-10-22
7. EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22