Is Adobe Acrobat Sign Part 11 compliant?
Published , reviewed
Verdict
- Short answer
- It can support Part 11. It is not compliant by itself.FDA certifies no software, and Adobe's own handbook says the Bio-Pharma Settings alone are insufficient to satisfy all Part 11 requirements.
- What carries it
- One dedicated group with Bio-Pharma SettingsAvailable on business and enterprise plans, the settings enforce identity challenges and signing reasons only for agreements sent from that group; other groups do not get the Part 11 signature format.
- Stays with you
- Validation, procedures and the recordsYou adapt and run the validation, write the access and signature procedures, keep records in your own repository and send FDA the § 11.100(c) letter.
Fig. 01Acrobat Sign can carry a Part 11 signature, but only after you build the conditions for it. Adobe's April 2025 handbook for regulated customers is plain about this: the Bio-Pharma Settings are necessary, they are “insufficient to satisfy all 21 CFR Part 11 requirements” on their own, and the customer validates the result. Below is the set-up in the order an administrator does it, then each requirement with the part Adobe covers and the part you keep. For the same reading of Docusign, see is Docusign Part 11 compliant.
Setting up the Part 11 group, step by step
Ten steps, adapted from the implementation checklist in Adobe's handbook. The menu paths are Adobe's; the rule line says which part of Part 11 the step serves. Steps 1, 9 and 10 happen outside the settings screens, so they need records of their own in your validation file.
- 01
Decide which documents need a Part 11 signature
Adobe's handbook asks you to split the processes that fall under a predicate rule from those that do not, and to build groups around that split. A supplier NDA does not need the signing ceremony a batch record or an SOP approval does. If you are unsure, run the record through the Part 11 applicability checker first.
- Who
- QA, with the process owners
- Where
- Outside the application
- Rule
- § 11.1(b)
- 02
Confirm the service level
Bio-Pharma Settings come with the business and enterprise levels of Acrobat Sign Solutions. The handbook adds that an enterprise plan is needed for single sign-on or for a Sandbox. Signing inside Acrobat Pro, Standard or Reader, the mobile app and API connections sit outside the handbook's scope.
- Who
- Account Administrator
- Where
- Your Acrobat Sign contract
- Rule
- None (a licensing fact)
- 03
Create a dedicated GxP group
Make one group for the people whose signatures fall under Part 11 and keep everyone else in groups without the settings. A new group starts with the account's settings; the Part 11 configuration is applied as a group-level override. Name a group administrator for the GxP group.
- Who
- Account Administrator
- Where
- Account > Global Settings > Groups
- Rule
- § 11.10(d)
- 04
Choose the signature type
Allow electronic signatures, or certificate-based digital signatures through a trust service provider you on-board. Part 11 does not require the digital route; an ID and password is enough for § 11.200(a)(1).
- Who
- Group Administrator
- Where
- Account > Groups > Signature Preferences
- Rule
- § 11.200(a), or § 11.30 for digital
- 05
Restrict the authentication methods
The handbook's checklist sets internal signers to Acrobat Sign authentication and lets external signers use Acrobat Sign authentication, Phone authentication or a one-time password by email. These are the methods the enforced challenges work with (next section). Decide whether senders may change the default.
- Who
- Group Administrator
- Where
- Account > Groups > Send Settings
- Rule
- § 11.200(a)(1)
- 06
Place users and set their authority
Create users by hand or sync them from your directory, place the regulated signers in the GxP group and give each the permission level their role needs. Verifying a person's identity before they get a signature is your procedure, not a setting (§ 11.100(b)).
- Who
- Account or Group Administrator
- Where
- Account > Users
- Rule
- § 11.10(d), (g); § 11.100(b)
- 07
Turn on Bio-Pharma Settings for the group
Enable the enforced identity challenges and require a signing reason from a pre-defined list, with the blank reason excluded. The signature block then prints the signer's name, the date and time, and the reason. Reasons set at account level flow down to every group, so keep the list short and check it with the signature manifestation check.
- Who
- Group Administrator
- Where
- Account > Groups > Bio-Pharma Settings
- Rule
- § 11.50; § 11.200(a)(1)
- 08
Fix the date and time zone
The time stamp is applied when the signer presses Click to Sign. FDA's 2003 guidance does not expect the signer's local time, but your documentation should say which time zone the stamps use.
- Who
- Group Administrator
- Where
- Account > Groups > Group Settings
- Rule
- § 11.50(a)(2)
- 09
Plan where signed records go
Adobe says Acrobat Sign should not be used as a records management system. Pull each signed PDF and its audit report into your own repository, and if you set retention rules, give the audit trail its own period: deleting an agreement in Acrobat Sign removes its history with it.
- Who
- Account Administrator and Records owner
- Where
- Data governance (retention rules)
- Rule
- § 11.10(c), (e)
- 10
Validate before the first regulated signature
Adapt and run Adobe's validation document templates against your own configuration, or write your own protocols with the IQ OQ PQ template. Re-assess at each major release.
- Who
- QA and the system owner
- Where
- A Sandbox, where your plan includes one
- Rule
- § 11.10(a)
Common misreading
Turning on Bio-Pharma Settings does not make an account Part 11 ready. Only agreements sent from the configured group get the enforced challenges and the name, time and reason block. A user who also sits in a non-GxP group and sends a batch record from there gets an ordinary signature without that block.
Where the signer is challenged
Bio-Pharma Settings decide when the signer must prove who they are; the Send Settings decide how. Each of the three points below is switched on separately. Members of the group are also challenged when they sign a document alone through self-signing.
- 01Opening the agreementBefore the signer can see the content.
- 02Clicking a signature fieldEach time a signature is started in the document.
- 03Pressing Click to SignAfter the reason is chosen; the signature is applied only once this challenge is passed.
The enforced challenges work only with three authentication methods. Others in Adobe's list, such as a sender-set signing password, knowledge-based questions or a government ID check, are not among them. With no authentication at all, a recipient opens the email link and presses Click to Sign with no further check; Adobe's handbook says proper authentication methods are needed to meet Part 11. The Part 11 requirements, section by section covers the continuous-session rule behind the repeated challenges.
Scroll sideways for all columns
| Method | What the signer gives | Adobe's own label | Against § 11.200(a)(1) |
|---|---|---|---|
| Acrobat Sign authentication | A verified email address or Adobe ID, and a password (or your SSO login) | single-factor | An identification code plus a password: the pair § 11.200(a)(1) names. The handbook's default for internal signers. |
| One-time password via email | A single-use code sent to the signer's inbox; the address is pre-filled | single-factor | Both pieces depend on one mailbox. Say in your validation why that counts as two distinct components for your use. |
| Phone authentication | A code sent by SMS or voice call to a known phone | two-factor | Ties the signer to a device. Adobe sells it as pre-purchased transactions used per recipient, so plan for it with external signers. |
Labels are the groupings in Table 2 of Adobe's April 2025 handbook. Part 11 asks for two distinct identification components, not for multi-factor authentication.
Requirement by requirement
9 of 10 rows read verified because Adobe's handbook describes each of those controls. The § 11.30 row reads stated. Encryption and certificate-based digital signatures are described; no Part 11 open-system statement. That is a statement about Adobe's documentation, not a finding that your use meets Part 11: the right-hand column is what an inspector will ask you, not Adobe.
Scroll sideways for all columns
| Requirement | Adobe | What Adobe describes | What stays with you |
|---|---|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verified | With Bio-Pharma Settings the signature shows the printed name, the date and time it was applied and the reason, on screen and on paper. Only agreements sent from the configured group get this format. | Keep internal users' profile names right, brief external signers to type their full name, and own the list of reasons. |
| Signature linked to its record so it cannot be moved§ 11.70 | verified | The signed PDF and its audit report are linked through the agreement's Transaction ID; PDF certification seals the file against changes. | File the PDF and its audit report together and keep the Transaction ID with the record. |
| Two distinct components to sign§ 11.200(a) | verified | Enforced re-authentication when the agreement opens, at the signature field and after Click to Sign, using Acrobat Sign login, phone authentication or a one-time email passcode. | Unique accounts, password rules (§ 11.300) and a written policy that holds signers accountable (§ 11.10(j)). |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified | A system-generated activity log, downloadable as a PDF audit report: signer name and email, date and time, reason, and each authentication event. | Part 11 sets no review cadence; Annex 11 § 9 asks for the trail to be regularly reviewed. Set yours in a procedure. |
| Audit trail kept as long as the record§ 11.10(e) | verified | Records stay while the account is active unless you delete them; a retention rule can give the audit trail its own period. Adobe says Acrobat Sign is not a records system. | The retention period comes from your predicate rule, not from Part 11. Export each record and audit report to your repository. |
| Validation documentation to support the customer's own validation§ 11.10(a) | verified | Validation document templates for typical use cases in the core web application, re-issued at each major release with an impact assessment report. | Assess the templates, adapt them to your configuration and run them. Validation is yours under § 11.10(a). |
| Accurate, complete copies for inspection§ 11.10(b) | verified | The signed record and audit report come out through the interface or API as certified, sealed PDFs, readable on screen and on paper. | Be able to hand an inspector the record and its audit report from your own repository. |
| Access and authority checks by role§ 11.10(d), (g) | verified | Account Administrator, Group Administrator, Privacy Administrator, Sender and Signer roles, with administrator duties set out in the handbook. | An access procedure: who joins the GxP group, who approves it, and a periodic check of the list. |
| Open-system controls: encryption, digital signatures§ 11.30 | stated | Documents encrypted at rest and in transit; certificate-based digital signatures through trust service providers; PDF certification. | Decide whether your use is an open system (outside signers, vendor-hosted) and record the § 11.30 measures you rely on. |
| EU Annex 11 statementEU GMP Annex 11 | verified | The handbook is written for 21 CFR Part 11 and EudraLex Annex 11 together. | Annex 11 adds duties of its own, such as § 11 periodic evaluation and a formal agreement with the supplier (§ 3). |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Whether you treat Acrobat Sign as an open system changes the § 11.30 row; the open vs closed system check walks the definitions, and the guide to Part 11 for cloud and SaaS systems covers the supplier side.
The validation templates: yours to adapt and run
Adobe offers validation document templates. Read what the handbook says about them before you plan around them:
- They cover a set of typical use cases in the core Acrobat Sign web application, not the mobile app and not integrations with other systems.
- The customer assesses whether they fit, including which of its own use cases they miss, and may adapt and execute them as its evidence.
- Adobe re-issues them for each major release with an impact assessment report, which is your input for deciding what to re-test.
- Customers who qualify for a Sandbox can use it as the controlled environment for pre-production and validation testing.
Treat them as a starting point. Your requirements, risk assessment and the tests for anything the templates do not cover stay yours; the CSV guide for small labs sizes that work.
What stays with you
- Validation
- Adobe's handbook puts it on the customer to show, with objective evidence, that Acrobat Sign is fit for its intended use. Start from a user requirement specification that names your groups, methods and reasons, then trace each to a test.
- The certification letter
- § 11.100(c) asks the company using e-signatures to certify to FDA that they are the legally binding equivalent of handwritten ones. It is a letter you send to FDA, not a product approval, and Adobe cannot send it for you. FDA's Letters of Non-Repudiation page says where it goes.
- Signature policy and training
- A written policy holding people accountable for what they sign (§ 11.10(j)), training for signers and administrators (§ 11.10(i)), and identity checks before anyone gets a signature (§ 11.100(b)). The SOP template gives the controlled-document frame.
- Access and release review
- Adobe's governance table lists user access management and a named owner who reads Adobe's update documentation before each release. A settings change Adobe Support makes for you still goes through your change control, the handbook says.
- Records and retention
- Retention comes from the predicate rule behind the record, not from Part 11. Adobe's handbook asks for a procedure that pulls each signed record and audit report into a repository you manage.
- Use outside the handbook
- Signing in Acrobat Pro, Standard or Reader, the mobile app, API integrations, templates and custom workflows are outside the handbook. Adobe says the customer assesses those before using them. Its Digital Identity Gateway does not support the enforced challenges and should be left out of Part 11 use.
Adobe's governance chapter also lists the quality-system topics a customer should have in place around the system: computer system validation, logical security, training, documentation management, change and configuration management, backup and recovery, disaster recovery, periodic review, vendor assessment, and incident and problem management.
Our record and method
Adobe Acrobat Sign (Bio-Pharma Settings)
e-signature- What it is
- Adobe Acrobat Sign is Adobe's cloud e-signature service, and its Bio-Pharma Settings add enforced identity challenges and required signing reasons for a group of users. Adobe's handbook says the settings come with the business and enterprise service levels and are not enough on their own to meet every Part 11 requirement.
- Who it fits
- Regulated teams on Acrobat Sign business or enterprise plans that can run a dedicated Part 11 group and their own validation.
| Requirement | Status |
|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verifiedApplies only to agreements sent from a Bio-Pharma Settings group; the handbook does not cover signing in the mobile app, through the API or in Acrobat Pro, Standard or Reader. |
| Two distinct components to sign§ 11.200(a) | verifiedEnforced re-authentication works with Acrobat Sign login, phone authentication or a one-time email passcode. |
| Audit trail kept as long as the record§ 11.10(e) | verifiedAdobe says Acrobat Sign is not a records system; signed records and audit reports are exported to the customer's own repository. |
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedAdobe supplies validation document templates that the customer adapts and runs. |
| EU Annex 11 statementEU GMP Annex 11 | verifiedThe handbook covers Part 11 and EudraLex Annex 11 together. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Adobe's own Part 11 pageread 2026-10-22
How we read the vendors
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.
FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.
Comparing tools? Read Docusign vs Adobe Sign for regulated teams for the two side by side, or the Part 11 e-signature software comparison for six vendors on the same rows.
Questions
Is Adobe Acrobat Sign FDA approved or certified for Part 11?
No software is. FDA keeps no list of certified or approved Part 11 software; the only certification in Part 11 is the user's own letter under § 11.100(c). Adobe's handbook makes the same point from its side: the customer validates Acrobat Sign for its intended use.
Do Bio-Pharma Settings switch on for the whole account?
Adobe recommends configuring them on a dedicated group. A new group inherits the account settings and the Bio-Pharma configuration overrides them for that group only. Agreements sent from a group without the settings do not get the Part 11 signature format, so a user who belongs to both kinds of group must start regulated agreements from the GxP group. Signing reasons set at account level flow down to every group.
Does the signer really authenticate three times?
It can be up to three: on opening, at the signature field and after Click to Sign. Each challenge is switched on separately. Several signature fields in one agreement are applied with one Click to Sign, which Adobe treats as one signing event with one audit-trail entry. Adobe calls the repeated logins “acceptable and unavoidable” for Part 11 signing, which is why it keeps them to one group.
Which Acrobat Sign plans include Bio-Pharma Settings?
The handbook names the business and enterprise service levels of Acrobat Sign Solutions, and says single sign-on and a Sandbox need enterprise. Ask Adobe for current terms; we do not list prices.
Can we keep signed records in Acrobat Sign?
Adobe says not as your records system. Documents stay while the account is active unless deleted, and deleting an agreement removes its activity history with it. Export the certified PDF and the audit report into your own repository, where your audit trail and retention controls apply.
Does the same set-up cover EU Annex 11?
Adobe wrote the handbook for Part 11 and Annex 11 together. Annex 11 has duties Part 11 lacks, such as periodic evaluation and audit-trail review; the EU Annex 11 guide sets them out.
Sources
- Acrobat Sign Solutions & Healthcare and Life Science Organizations: A Handbook for 21 CFR Part 11 and EudraLex Annex 11 (April 2025, PDF), Adoberead 2026-10-22
- 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR, up to date as of 2026-10-20), eCFRread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures — Scope and Application (2003 guidance), FDAread 2026-10-22
- Letters of Non-Repudiation Agreement, FDAread 2026-10-22
- EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22