Skip to content

Part 11 compliant e-signature software: what six vendors publish, read against the rule

Published , reviewed

Verdict

Best overall
Adobe Acrobat Sign (Bio-Pharma Settings)Its own documentation, a handbook written for Part 11 and Annex 11 together, describes 9 of the 10 requirement rows, more than any other tool here. Adobe also says the Bio-Pharma Settings alone do not meet every Part 11 requirement.
Best for a small lab
Box Sign (21 CFR Part 11 requests)For a lab whose controlled documents already live in Box: the Part 11 request type adds a Box login before signing and re-authentication after each signature, and it requires Box's GxP Validation offering.
Best for a device maker
Docusign Part 11 moduleDocusign names medtech among the teams the module fits, and its Validator for Life Sciences (an additional module) runs monthly QA tests on Part 11 functions and posts the reports in the account.
Chromolithograph of a stamped controlled document with a folded corner and a capped penFig. 01
A signed controlled document: the signature is only as good as the record it is tied to.

Most e-signature vendors that sell to life sciences say “Part 11 compliant”. The rule asks for something narrower and more testable: a printed name, a time and a meaning on every signed record, a signature that cannot be lifted onto another file, two components to sign, and an audit trail behind it. This page reads six e-signature tools against those rows using only what each vendor publishes on its own pages, then lists the part of Part 11 that no tool can carry for you.

What the rule asks of any e-signature tool

Part 11 has no section called “e-signature software”. A signing tool is judged on the same sections as any other system that holds signed records, and six of them do most of the work. Each row below pairs the requirement with a test you can run on a trial account in an afternoon. The full text of every section is in 21 CFR Part 11 requirements, section by section.

Scroll sideways for all columns

The Part 11 signature requirements and what to test in a vendor demo
SectionWhat the rule asksWhat to test in the demo
§ 11.50The signed record shows the printed name of the signer, the date and time of signing, and the meaning (such as review, approval, responsibility, or authorship), on screen and on any printout.Download the signed PDF and print it. All three items must sit on the page itself, not only in a separate certificate.
§ 11.70Each signature is linked to its record so it cannot be excised, copied or otherwise transferred to falsify a record by ordinary means.Ask how the link is made, then try it by ordinary means: edit a signed PDF, or paste its signature block onto another file, and see whether the change shows.
§ 11.100(a), (b)A signature belongs to one person, is never reused or reassigned, and the organization verifies the person's identity before issuing it.Ask how a departed signer's account is closed, and whether the same email can ever be issued to someone else.
§ 11.200(a)Signatures not based on biometrics use at least two distinct components, such as an identification code and password. Outside one continuous session, every signing uses all of them.Sign two documents in a row, then sign again after a break. Count the components the tool asks for each time.
§ 11.300ID code and password pairs stay unique, are checked or revised periodically, lost tokens are deauthorized, and attempts at misuse are reported at once.Find the lockout, password and session settings, and who receives the alert after failed sign-ins.
§ 11.10(e)A secure, computer-generated, time-stamped audit trail records operator actions, and is kept as long as the record it describes.Export the audit report for one signed document and check that every signing event and its reason are in it.

The middle column paraphrases the eCFR text; the right column is our own demo script, not a rule.

No enforcement discretion on signatures

FDA's 2003 Scope and Application guidance relaxed enforcement of the Part 11 versions of validation, audit trail, copies and retention. It did not relax the signature sections. FDA says it will enforce

“requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)”

So everything in the table above is enforced as written.

Common misreading

Part 11 does not require two-factor codes, certificates or PKI. § 11.200(a)(1) accepts “an identification code and password”. Encryption and digital signatures appear in § 11.30 as additional measures for open systems. A vendor selling PKI is offering more than the rule asks, which can still be worth having. Whether your use is open or closed is a separate question: run it through the open vs closed system check.

Takeaway

Run the demo tests before the order, not during validation. Score the printed signature block of a test document with the signature manifestation check.

Six tools, requirement by requirement

Each cell is a status word, never a tick. Read verified as “the vendor's own documentation describes how the control works”, and stated as “the vendor claims it and we could not see how”. A stated row is a question for the demo, not a failure.

Scroll sideways for all vendors

Part 11 requirements by e-signature tool
RequirementDocusign Part 11 moduleAdobe Acrobat Sign (Bio-Pharma Settings)Box Sign (21 CFR Part 11 requests)PharmaDoXsignNowFoxit eSign
Signature shows name, date and time, and meaning§ 11.50verifiedverifiedstatedstatedstatedstated
Signature linked to its record so it cannot be moved§ 11.70verifiedverifiedverifiedstatedstatedstated
Two distinct components to sign§ 11.200(a)verifiedverifiedverifiedstatedstatedstated
Secure, computer-generated, time-stamped audit trail§ 11.10(e)verifiedverifiedverifiedstatedstatedstated
Audit trail kept as long as the record§ 11.10(e)statedverifiedstatedstatednot statedstated
Validation documentation to support the customer's own validation§ 11.10(a)verifiedverifiedverifiedverifiednot statednot stated
Accurate, complete copies for inspection§ 11.10(b)verifiedverifiedverifiedstatedstatedstated
Access and authority checks by role§ 11.10(d), (g)statedverifiedverifiedstatedstatedstated
Open-system controls: encryption, digital signatures§ 11.30statedstatedstatedstatedstatedstated
EU Annex 11 statementEU GMP Annex 11statedverifiednot statednot statednot statednot stated

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

How much of each claim is described

No tool here has every row described in its own documentation: each leaves some rows as claims, or publishes nothing on them.

Status words counted per vendor across the 10 requirement rows
Vendorverifiedstatednot stated
Docusign Part 11 module6 of 104 of 100 of 10
Adobe Acrobat Sign (Bio-Pharma Settings)9 of 101 of 100 of 10
Box Sign (21 CFR Part 11 requests)6 of 103 of 101 of 10
PharmaDoX1 of 108 of 101 of 10
signNow0 of 107 of 103 of 10
Foxit eSign0 of 108 of 102 of 10

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

A count of what each vendor publishes, not a score: a stated row may be true, and a verified row still has to pass your own validation.

Read one requirement across the tools

The table shows one word per cell. Pick a requirement to see what each vendor attaches to it: the plan it needs, the sign-in it depends on, the page we read it on.

Signature shows name, date and time, and meaning

§ 11.50, 2 of 6 read on the vendor's own documentation

Scroll sideways for all columns

Signature shows name, date and time, and meaning (§ 11.50), vendor by vendor
VendorStatusWhat the vendor's page says
Docusign Part 11 moduleverifiedSigning reasons can be edited by accounts on the Enterprise Pro plan.Docusign page read 2026-10-22
Adobe Acrobat Sign (Bio-Pharma Settings)verifiedApplies only to agreements sent from a Bio-Pharma Settings group; the handbook does not cover signing in the mobile app, through the API or in Acrobat Pro, Standard or Reader.Adobe page read 2026-10-22
Box Sign (21 CFR Part 11 requests)statedBox's pages describe the signing reason in the signature frame; they do not list the name and time shown.Box page read 2026-10-22
PharmaDoXstatedThe vendor claims it; its pages do not describe the control.SIGNiX page read 2026-10-22
signNowstatedsignNow names the printed name, date and time; it does not mention the meaning of the signature.signNow page read 2026-10-22
Foxit eSignstatedThe vendor claims it; its pages do not describe the control.Foxit page read 2026-10-22

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Part 11 is a mode you switch on

In most of these tools, Part 11 signing is not the default account. It is a module, a group setting, a request type or a switch the vendor flips, and the controls apply only inside it. That matters in a small lab where the same account also signs NDAs and purchase orders: a regulated document sent from the wrong group, or from an account that never had the Part 11 mode switched on, lands without the manifestation you validated.

Where the Part 11 mode starts and stops

Docusign Part 11 module

How it is switched on A pre-set account configuration, the Part 11 module, that adds signature-level authentication, a signing reason and the signature manifestation.

Where it stops In-person signing, delegated signing and signing in the mobile apps are not available on Part 11 accounts, and some Part 11 settings can only be changed through Docusign Support.

Adobe Acrobat Sign (Bio-Pharma Settings)

How it is switched on Bio-Pharma Settings applied to a group of users, on the business and enterprise service levels.

Where it stops The Part 11 manifestation applies only to agreements sent from a group configured with the settings, and Adobe says the settings alone do not meet every Part 11 requirement.

Box Sign (21 CFR Part 11 requests)

How it is switched on A 21 CFR Part 11 request type inside Box Sign: a Box login before signing, re-authentication after each signature and a signing reason.

Where it stops Part 11 signing requires Box's GxP Validation offering, and Part 11 requests are not available for Ready-Sign Links or Sign Myself.

PharmaDoX

How it is switched on A separate life sciences offering in which each signature is bound to the document with PKI.

Where it stops SIGNiX lists an IQ/OQ/PQ validation package; 8 of the other 9 rows are claims on its product page rather than described controls.

signNow

How it is switched on Part 11 support switched on for an account by signNow's support team, which turns on dual-factor authentication for every signer.

Where it stops signNow says testing and scanning information is available on request; no validation package is described.

Foxit eSign

How it is switched on Foxit says Foxit eSign adheres to 21 CFR Part 11 for its pharmaceutical and biotech clients.

Where it stops Its signature manifestation, signature linking and signing components rest on a general Part 11 claim; its pages do not describe how any of the three works.

For the full Docusign setup, read is Docusign Part 11 compliant; for Adobe's group settings, is Adobe Acrobat Sign Part 11 compliant.

Vendor by vendor

One card per tool, in the table's order, with the six rows that matter most for signing. Choosing between the two largest? Docusign vs Adobe Sign for regulated teams puts them side by side.

Docusign Part 11 module

e-signature
What it is
The Docusign Part 11 module is a pre-set eSignature account configuration that adds signature-level authentication, a signing reason and a signature manifestation with printed name, time stamp and reason. Docusign pairs it with the Validator for Life Sciences, which runs monthly QA tests on Part 11 functions and posts the reports in the account.
Who it fits
Pharma, biotech, medtech and clinical teams on Docusign eSignature that need Part 11 signing for SOPs, batch records and agreements.
Docusign Part 11 module: Part 11 requirements
RequirementStatus
Signature shows name, date and time, and meaning§ 11.50verifiedSigning reasons can be edited by accounts on the Enterprise Pro plan.
Signature linked to its record so it cannot be moved§ 11.70verified
Two distinct components to sign§ 11.200(a)verifiedSigners re-enter their Docusign username and password, or the last four digits of their phone and an SMS code, at each signature field (Original mode) or when opening and completing the envelope (Rapid mode); in-person, delegated and mobile-app signing are not available on Part 11 accounts.
Secure, computer-generated, time-stamped audit trail§ 11.10(e)verified
Validation documentation to support the customer's own validation§ 11.10(a)verifiedDocusign's product page calls the Validator for Life Sciences an additional module.
Accurate, complete copies for inspection§ 11.10(b)verified

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Docusign's own Part 11 pageread 2026-10-22

Adobe Acrobat Sign (Bio-Pharma Settings)

e-signature
What it is
Adobe Acrobat Sign is Adobe's cloud e-signature service, and its Bio-Pharma Settings add enforced identity challenges and required signing reasons for a group of users. Adobe's handbook says the settings come with the business and enterprise service levels and are not enough on their own to meet every Part 11 requirement.
Who it fits
Regulated teams on Acrobat Sign business or enterprise plans that can run a dedicated Part 11 group and their own validation.
Adobe Acrobat Sign (Bio-Pharma Settings): Part 11 requirements
RequirementStatus
Signature shows name, date and time, and meaning§ 11.50verifiedApplies only to agreements sent from a Bio-Pharma Settings group; the handbook does not cover signing in the mobile app, through the API or in Acrobat Pro, Standard or Reader.
Signature linked to its record so it cannot be moved§ 11.70verified
Two distinct components to sign§ 11.200(a)verifiedEnforced re-authentication works with Acrobat Sign login, phone authentication or a one-time email passcode.
Secure, computer-generated, time-stamped audit trail§ 11.10(e)verified
Validation documentation to support the customer's own validation§ 11.10(a)verifiedAdobe supplies validation document templates that the customer adapts and runs.
Accurate, complete copies for inspection§ 11.10(b)verified

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Adobe's own Part 11 pageread 2026-10-22

Box Sign (21 CFR Part 11 requests)

e-signature
What it is
Box Sign is the e-signature feature built into Box. Its 21 CFR Part 11 request type requires a Box login before signing, re-authentication after each signature and a signing reason.
Who it fits
Life sciences teams that already keep their controlled documents in Box.
Box Sign (21 CFR Part 11 requests): Part 11 requirements
RequirementStatus
Signature shows name, date and time, and meaning§ 11.50statedBox's pages describe the signing reason in the signature frame; they do not list the name and time shown.
Signature linked to its record so it cannot be moved§ 11.70verified
Two distinct components to sign§ 11.200(a)verifiedPart 11 requests are not available for Ready-Sign Links or Sign Myself.
Secure, computer-generated, time-stamped audit trail§ 11.10(e)verified
Validation documentation to support the customer's own validation§ 11.10(a)verifiedPart 11 signing in Box Sign requires Box's GxP Validation offering.
Accurate, complete copies for inspection§ 11.10(b)verified

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Check with the vendor

Some rows above are stated or not stated on Box's own pages. Ask Box for its validation documentation and test the control in your own validation before you rely on it.

Box's own Part 11 pageread 2026-10-22

PharmaDoX

e-signature
What it is
PharmaDoX is SIGNiX's digital signature offering for life sciences, in which each signature is bound to the document with PKI. SIGNiX describes it as built for 21 CFR Part 11 clinical, quality and regulatory records and lists an IQ/OQ/PQ validation package.
Who it fits
Pharma, biotech and CRO teams that want certificate-based digital signatures on clinical and quality records.
PharmaDoX: Part 11 requirements
RequirementStatus
Signature shows name, date and time, and meaning§ 11.50stated
Signature linked to its record so it cannot be moved§ 11.70stated
Two distinct components to sign§ 11.200(a)stated
Secure, computer-generated, time-stamped audit trail§ 11.10(e)stated
Validation documentation to support the customer's own validation§ 11.10(a)verified
Accurate, complete copies for inspection§ 11.10(b)stated

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Check with the vendor

Some rows above are stated or not stated on SIGNiX's own pages. Ask SIGNiX for its validation documentation and test the control in your own validation before you rely on it.

SIGNiX's own Part 11 pageread 2026-10-22

signNow

e-signature
What it is
signNow is a cloud e-signature service for sending, signing and managing documents. signNow says its support team switches on 21 CFR Part 11 support for an account, which turns on dual-factor authentication for every signer.
Who it fits
Small regulated teams that want a general-purpose e-signature tool with Part 11 support switched on by request.
signNow: Part 11 requirements
RequirementStatus
Signature shows name, date and time, and meaning§ 11.50statedsignNow names the printed name, date and time; it does not mention the meaning of the signature.
Signature linked to its record so it cannot be moved§ 11.70stated
Two distinct components to sign§ 11.200(a)statedPart 11 support is switched on for an account by signNow's support team.
Secure, computer-generated, time-stamped audit trail§ 11.10(e)stated
Validation documentation to support the customer's own validation§ 11.10(a)not statedsignNow says testing and scanning information is available on request; no validation documents are named.
Accurate, complete copies for inspection§ 11.10(b)stated

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Check with the vendor

Some rows above are stated or not stated on signNow's own pages. Ask signNow for its validation documentation and test the control in your own validation before you rely on it.

signNow's own Part 11 pageread 2026-10-22

Foxit eSign

e-signature
What it is
Foxit eSign is Foxit's cloud e-signature service for collecting signatures online, with audit trails and signer sequences. Foxit says it adheres to 21 CFR Part 11 for its pharmaceutical and biotech clients.
Who it fits
Pharmaceutical and manufacturing teams looking at a general-purpose e-signature tool.
Foxit eSign: Part 11 requirements
RequirementStatus
Signature shows name, date and time, and meaning§ 11.50stated
Signature linked to its record so it cannot be moved§ 11.70stated
Two distinct components to sign§ 11.200(a)stated
Secure, computer-generated, time-stamped audit trail§ 11.10(e)stated
Validation documentation to support the customer's own validation§ 11.10(a)not stated
Accurate, complete copies for inspection§ 11.10(b)stated

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Check with the vendor

Some rows above are stated or not stated on Foxit's own pages. Ask Foxit for its validation documentation and test the control in your own validation before you rely on it.

Foxit's own Part 11 pageread 2026-10-22

How we read the vendors

Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.

verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.

FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.

What stays with you

Even a tool with every row verified would not make your signatures compliant. Part 11 puts the controls on the persons who use the system, and several of its signature duties are procedures and letters, not features. An inspector asks for these, not for the vendor's brochure.

Scroll sideways for all columns

Part 11 duties split between the e-signature tool and the regulated company
DutySectionWhat the tool can give youWhat you do
Validate the system for your intended use§ 11.10(a)Validation templates, test reports or a qualification package, where the vendor offers them.A requirements spec, a risk assessment, tests of your own configuration and a signed summary report.
Verify each signer's identity before issuing a signature§ 11.100(b)Account invitations and identity checks at sign-in.A documented identity check before the account is switched on, kept with the user's access record.
Keep every signature unique to one person§ 11.100(a), § 11.300(a)Named user accounts and unique log-ins.No shared or generic accounts; a leaver's account is closed and never handed on.
Certify your e-signatures to FDA§ 11.100(c)Nothing. The rule puts the certification on the persons using electronic signatures.A letter, signed by hand, saying the e-signatures in your system are intended to be the legally binding equivalent of handwritten signatures. FDA's page on Letters of Non-Repudiation Agreement covers where it goes, for one person or the whole company.
Hold signers accountable in writing§ 11.10(j)Nothing beyond the signing screen's wording.A written policy each signer reads and signs before first use.
Train the people who use and run it§ 11.10(i)User guides and admin documentation.Training records for signers and administrators, refreshed when the configuration changes.
Run password and token controls§ 11.300(b) to (e)Lockout, session and password settings, and alerts on failed sign-ins.An SOP for periodic revision, deauthorizing lost tokens, reporting attempted misuse at once and testing any tokens or cards.
Define what each signature means§ 11.50(a)(3)A configurable list of signing reasons.A fixed list of meanings (for example reviewed, approved, authored) tied to each document type in your SOP.
Keep signed records for the retention period§ 11.10(c)Export of the signed file and its audit report.The retention period from your predicate rule, and a records system that holds both files for all of it.

Inspection risk

A QC result approved under a colleague's login breaks § 11.100(a) and § 11.200(a)(2) whatever the tool does. A login shared to cover a weekend is the signature failure no configuration can catch; the accountability policy under § 11.10(j) is where you forbid them in writing.

Takeaway

Write the signing requirements into a user requirement specification before the demo, then size the testing with the CSA validation scope planner. For signing tools in other software categories, see Part 11 compliant software, by category.

Questions

Is there an FDA list of approved Part 11 e-signature software?

No. FDA keeps no list of certified or approved Part 11 software, and the rule has no vendor certification in it. Part 11 binds the persons who use a system. A vendor's “Part 11 compliant” line means its product supports the controls; whether your use complies is a validation claim you make yourself. The background is in 21 CFR Part 11: what it is and who it binds.

Does Part 11 require two-factor authentication or digital certificates?

No. § 11.200(a)(1) asks for at least two distinct identification components “such as an identification code and password”. Digital signatures and encryption appear only in § 11.30, as additional measures for open systems. Two-factor codes and certificates are good controls; they are not the legal minimum.

Is a standard e-signature plan enough for Part 11?

For most tools on this page, no. Docusign, Adobe, Box, SIGNiX and signNow each put Part 11 signing behind a separate module, group setting, request type, offering or support switch, and the Part 11 controls apply inside it. Foxit's pages describe no separate setting. The section on Part 11 modes sets out where each one starts and stops.

Does the e-signature vendor send the non-repudiation letter to FDA for us?

No. § 11.100(c) puts the certification on the “Persons using electronic signatures”: your company, by a letter signed by hand. FDA accepts a letter for named individuals or one that covers the whole company. It is a letter you send to FDA, not a product approval.

Can the e-signature tool be our records system?

Check before you assume it. Part 11 sets no retention period of its own; your predicate rule does, and § 11.10(c) asks that records stay retrievable for all of it. Adobe, for one, says Acrobat Sign is not a records system and that signed records and audit reports are exported to the customer's own repository. Most labs route the signed file into their document control system. Signatures on records that live in another system are usually applied there: a notebook entry in the electronic lab notebook, a participant's consent in an eConsent system.

We have suppliers and contract labs signing too. Does that change anything?

It can. Part 11 calls a system open when access is not controlled by the people responsible for the records on it, and an open system needs the § 11.30 measures on top of the § 11.10 controls. Classify your own setup with the open vs closed system check, and read the guide to Part 11 for cloud and SaaS systems for the supplier side.

What does EU Annex 11 add for electronic signatures?

Annex 11 § 14 expects e-signatures to have the same impact as handwritten ones within the company, to be permanently linked to their record, and to include the time and date they were applied. It names no printed-name or meaning element. In our mapping, § 11.70 linking answers the second point and the time in a § 11.50 manifestation answers the third. The guide to EU Annex 11 covers the rest.

What is the difference between an electronic and a digital signature here?

In Part 11, an electronic signature is any symbol a person adopts as the legally binding equal of a handwritten signature. A digital signature is one kind of electronic signature, based on cryptography, that lets the signer and the integrity of the data be verified. Every digital signature is an electronic signature; not the reverse.

Sources

Regulation text quoted from the eCFR; guidance from FDA and the European Commission; vendor rows from each vendor's own pages. General information, not regulatory advice.

  1. 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR, up to date as of 2026-10-20), eCFRread 2026-10-22
  2. Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003 guidance), FDAread 2026-10-22
  3. Letters of Non-Repudiation Agreement, FDAread 2026-10-22
  4. EudraLex Volume 4, Annex 11: Computerised Systems (revision January 2011), European Commissionread 2026-10-22
  5. Docusign Part 11 module: Part 11 documentation, Docusignread 2026-10-22
  6. Adobe Acrobat Sign (Bio-Pharma Settings): Part 11 documentation, Adoberead 2026-10-22
  7. Box Sign (21 CFR Part 11 requests): Part 11 documentation, Boxread 2026-10-22
  8. PharmaDoX: Part 11 documentation, SIGNiXread 2026-10-22
  9. signNow: Part 11 documentation, signNowread 2026-10-22
  10. Foxit eSign: Part 11 documentation, Foxitread 2026-10-22