Part 11 compliant EDC and eConsent: five vendors read against FDA's 2024 Q&A
Published , reviewed
Verdict
- Best overall
- Viedoc EDCSeven of ten rows described on its own documentation, more than any other product here, mapped against published clinical-data requirements and tested for each release, with a validation summary report per release in an inspection readiness packet. We read its EDC only; ask about eConsent separately.
- Best for an investigator-initiated study
- OpenClinica EDCIts user documentation is public and shows how the investigator signs, that editing a signed form unsigns the event, and that casebooks export as PDF, JSON or ODM XML with the audit trail: evidence a sponsor-investigator can write tests against. Its Consent module takes investigator countersignatures. It publishes no validation documents for customers, so the testing is yours.
- Best for a sponsor running several trials
- Rave EDCOne vendor from simple studies to complex global trials, with Rave Lite for Phase I, Phase IV and medtech studies, libraries of pre-validated eCRFs and Medidata Consent. None of its rows is described on a public page: start your vendor audit with the assurance report on electronic records and signatures it makes available to customers.
Fig. 01An EDC holds the case report forms; an eConsent system holds the signed consent forms. Both are part of the case history an investigator must keep (§ 312.62(b) for drugs, § 812.140(a)(3) for devices), so once they live in software, Part 11 applies to it. FDA's October 2024 Q&A on electronic systems in clinical investigations says that once a record enters the sponsor's EDC, FDA intends to assess Part 11 compliance Q1, and that it checks no EDC in advance Q16. We read what five EDC vendors publish about each Part 11 control on their own pages and set it against what that Q&A asks.
This page is about clinical-trial software for sponsors, CROs and sites; clinical diagnostic lab software answers to other rules. For where trials sit among the other regulated areas, see what GxP covers.
What FDA's 2024 Q&A asks of an EDC
The Q&A is final (October 2024, Revision 1, docket FDA-2017-D-1105) and expands the 2003 Part 11 guidance for investigations under parts 312 and 812. Its line on hosted systems is the one every SaaS EDC contract sits under: “Regulated entities are responsible for ensuring that electronic records meet applicable part 11 requirements.” The vendor builds the controls; you prove they work for your study.
Scroll sideways for all columns
| Q&A | What FDA asks | Our table row | Described on the vendor's own pages |
|---|---|---|---|
| Q12 | The trail captures every change, who made it (user ID and role), the date and time, and the old and new value, with the reason where it applies. It is protected from being changed or switched off. | Secure, computer-generated, time-stamped audit trail§ 11.10(e) | Viedoc EDC, OpenClinica EDC and Castor EDC |
| Q12 | Every audit trail entry on creating, changing or deleting a record is available for FDA inspection, and is kept at least as long as the record it covers. | Audit trail kept as long as the record§ 11.10(e) | Viedoc EDC |
| Q5 | Copies for inspection come in human-readable form with the metadata and audit trail. When a hosted contract ends, the metadata is obtained, kept and linked to each data element. | Accurate, complete copies for inspection§ 11.10(b) | Viedoc EDC and OpenClinica EDC |
| Q11 | A record of everyone authorised in the system: the date each user was added, their rights and permissions, and every change to them. Nobody shares a login. | Access and authority checks by role§ 11.10(d), (g) | Viedoc EDC, OpenClinica EDC and Castor EDC |
| Q7 | Validation covers the protocol-specific build, customisations, data transfers and interfaces. Where the provider validates, you may review its development, validation, functional testing and change control records. | Validation documentation to support the customer's own validation§ 11.10(a) | Viedoc EDC |
| III.E | A signed record carries the signer's printed name, the date and time of signing, and the meaning of the signature. | Signature shows name, date and time, and meaning§ 11.50 | Viedoc EDC |
| III.E | The signature is linked to its record so it cannot be cut, copied or moved, and any change made after signing shows in the audit trail. | Signature linked to its record so it cannot be moved§ 11.70 | Viedoc EDC and OpenClinica EDC |
| Q11 | A risk assessment of security for every system, open or closed, and safeguards such as encryption to keep data confidential at rest and in transit. | Open-system controls: encryption, digital signatures§ 11.30 | None of them |
The last column names the products whose row reads verified in the requirement table below: the control is described on the vendor's own documentation, not only claimed.
For each study FDA also wants the sponsor to list the electronic systems used and their requirements, with a diagram of the data flow from creation to final storage Q8. FDA may inspect an IT provider that has taken on a sponsor's obligations, and may run a focused inspection of any provider when trial data integrity is in doubt Q19.
Takeaway
Ask each vendor for the documents behind the rows it only claims, and write data access for the whole retention period into the agreement Q17. Our guide to Part 11 for cloud and SaaS systems covers the agreement; the open vs closed system check settles whether a hosted EDC needs the § 11.30 extras.
Who keeps what
An EDC serves three parties and each answers for different records. An investigator who runs their own EDC keeps the sponsor's documentation as well Q9, which is why an investigator-initiated study needs a written user requirement specification and a validation plan sized like any other, as in our computer system validation guide.
What FDA says it will look for at a sponsor inspection, and what the sponsor should be able to hand over for each study. A CRO carries these to the extent it took on the sponsor's obligations.
- A list of the electronic systems used in the study (EDC, CTMS, IRT, eCOA) and their system requirementsQ8
- A diagram of the data flow from where data are created to final storageQ8
- Validation: risk assessment, plans, execution and reports, plus any assessment of a provider's systemQ8
- User acceptance testing, change control, and account setup with user access controlsQ8
- Data migration, retention, backup, recovery and contingency plans, and the alternative way to enter data when the system is downQ8
- Training records and the roles of sponsor, sites and other parties in using each systemQ8
- A written agreement with each IT provider that includes a plan for access to the data for the whole retention periodQ17
- Records of your oversight of the provider throughout the trial, available to FDA on requestQ18
The audit trail on a CRF change
Source data are “all information in original records and certified copies of original records of clinical findings, observations, or other activities in a clinical trial necessary for the reconstruction and evaluation of the trial”, the ICH E6(R2) definition the Q&A uses. In the example below the clinic vitals sheet is the source and the EDC value is checked against it. The trail has to let an inspector rebuild every step, including the wrong value.
Example audit trail: Subject 104-017, Visit 2, Vital signs, systolic blood pressure (mmHg). All times UTC. Illustrative data.
Scroll sideways for all columns
| Date and time | User and role | Action | Old value | New value | Reason |
|---|---|---|---|---|---|
| 2026-03-11 09:42 | crc.104Study coordinator | Entered and saved | none | 412 | none |
| 2026-03-11 09:42 | systemEdit check | Range check fired (60 to 250); query opened | none | none | none |
| 2026-03-11 09:44 | crc.104Study coordinator | Changed in reply to the query | 412 | 142 | Digits transposed; clinic vitals sheet reads 142 |
| 2026-03-18 14:05 | cra.07Monitor | Source data verified; query closed | none | none | none |
| 2026-03-20 10:15 | pi.104Investigator | Signed the visit (meaning: reviewed and approved) | none | none | none |
| 2026-03-25 16:30 | crc.104Study coordinator | Changed after signing; signature removed, visit to re-sign | 142 | 144 | Repeat reading recorded late; clinic note |
- The wrong value stays
- The first value stays on the trail after it is corrected. § 11.10(e): changes “shall not obscure previously recorded information.”
- Row 2, the edit check
- FDA does not ask for every keystroke, but where an edit check prompts a correction the trail should show the original response, the fact that the check fired, and the change made Q13.
- Columns
- Date and time, the person (user ID and role), and the old and new value must be there; the reason should be, where it applies Q12. A trial across time zones states the zone or records GMT Q14.
- Row 6, after signing
- Changes made after an electronic signature must show in the audit trail (Q&A section III.E). Whether the system also removes the signature and asks for a new one is a design choice to test in your validation.
What a trail has to capture in any GxP system is in our guide to audit trails; the EDC-specific part is the edit check and the signature that a later change undoes.
eConsent: what the signed record carries
The rule behind every consent form is short. Consent “shall be documented by the use of a written consent form approved by the IRB and signed and dated by the subject or the subject's legally authorized representative at the time of consent. A copy shall be given to the person signing the form” § 50.27(a). eConsent moves that form onto a screen, so Part 11 now governs the signature and the record. FDA and HHS's Office for Human Research Protections wrote the joint eConsent guidance in December 2016; FDA's page still lists it as the final guidance (read 2026-10-22).
Scroll sideways for all columns
| The record carries | Rule or guidance | Check in the demo |
|---|---|---|
| The participant's signature, or their legally authorized representative's | § 50.27(a) | Is it a Part 11 electronic signature (eIC Q6) or a handwritten one drawn on screen (Q25)? A drawn signature must be linked to the record too. |
| The date of consent, captured by the system | § 50.27(a), eIC Q6 | The date the participant signed, recorded by the system, not the date a PDF was uploaded later. |
| Printed name, date and time, and meaning on the signed record | § 11.50 | Open a signed test consent: all three show on screen and on the printout. |
| A checked identity when no one from the site watches the signing | § 11.100(b), eIC Q2, Q7 | How the system confirms who is signing remotely: an ID document, personal questions, biometrics or video (Q26). |
| The IRB-approved version the participant saw | eIC Q13, Q15 | Every approved version, web pages and videos included, can be pulled from the archive. |
| A copy for the person who signed | § 50.27(a), eIC Q9 | FDA recommends the copy shows the signature and the date. Paper or electronic is fine. |
Common misreading
“The system took the consent” is the misreading. The investigator stays responsible for consent on-site or remote, and “cannot delegate authority to obtain informed consent to the electronic system” eIC Q2. The software records the consent; a person still obtains it.
Four of the five products in this lineup also sell eConsent (OpenClinica EDC, Castor EDC, Medrio EDC and Rave EDC). Their signature rows matter twice here, because the eConsent guidance lets you rely on “a statement from the vendor” that describes how the signature is created eIC Q6. None of them describes the signature manifestation on a public page, so ask each for that statement in writing before the IRB submission.
Scroll sideways for all vendors
| Requirement | OpenClinica EDC | Castor EDC | Medrio EDC | Rave EDC |
|---|---|---|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | stated | stated | stated | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | verified | stated | stated | stated |
| Two distinct components to sign§ 11.200(a) | verified | stated | stated | stated |
| Accurate, complete copies for inspection§ 11.10(b) | verified | stated | stated | stated |
| Open-system controls: encryption, digital signatures§ 11.30 | not stated | stated | stated | not stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
To test a signed consent or a signed casebook page against § 11.50, use the signature manifestation check. If you also sign protocols and agreements outside the EDC, the Part 11 e-signature software comparison reads those tools on the same rows.
Requirement by requirement
All ten rows, each read on the vendor's own pages. A row is verified only where the vendor's documentation describes the control; a “Part 11 compliant” line counts as stated. What each row means in the rule is in Part 11 requirements, section by section.
Scroll sideways for all vendors
| Requirement | Viedoc EDC | OpenClinica EDC | Castor EDC | Medrio EDC | Rave EDC |
|---|---|---|---|---|---|
| Signature shows name, date and time, and meaning§ 11.50 | verified | stated | stated | stated | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | verified | verified | stated | stated | stated |
| Two distinct components to sign§ 11.200(a) | stated | verified | stated | stated | stated |
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified | verified | verified | stated | stated |
| Audit trail kept as long as the record§ 11.10(e) | verified | stated | stated | stated | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | verified | not stated | not stated | not stated | stated |
| Accurate, complete copies for inspection§ 11.10(b) | verified | verified | stated | stated | stated |
| Access and authority checks by role§ 11.10(d), (g) | verified | verified | verified | stated | stated |
| Open-system controls: encryption, digital signatures§ 11.30 | not stated | not stated | stated | stated | not stated |
| EU Annex 11 statementEU GMP Annex 11 | stated | not stated | stated | stated | not stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Vendor by vendor
Each card shows the six rows that weigh most in an EDC: the trail on a changed value, the investigator's signature and its link to the record, copies for inspection, the validation pack and role checks.
Medidata and Part 11
Medidata's pages we read make a general claim about controls for electronic records and signatures and do not name 21 CFR Part 11, so its rows read as claims. Ask for the Part 11 statement in writing.
Viedoc EDC
EDC- What it is
- Cloud electronic data capture for clinical trials with drag-and-drop study design and pre-built templates. Viedoc maps each release against published clinical-data requirements and tests them automatically.
- Who it fits
- Sponsors and CROs that want inspection documents for each release.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Signature shows name, date and time, and meaning§ 11.50 | verified |
| Signature linked to its record so it cannot be moved§ 11.70 | verified |
| Accurate, complete copies for inspection§ 11.10(b) | verified |
| Validation documentation to support the customer's own validation§ 11.10(a) | verifiedA validation summary report per release in an inspection readiness packet. |
| Access and authority checks by role§ 11.10(d), (g) | verified |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Viedoc Technologies' own Part 11 pageread 2026-10-22
OpenClinica EDC
EDCeConsent- What it is
- Electronic data capture for clinical studies with an optional Consent module for participant eConsent and investigator countersignatures. OpenClinica publishes its user documentation openly.
- Who it fits
- Sponsors, CROs and research teams that want EDC and eConsent in one system.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Signature shows name, date and time, and meaning§ 11.50 | statedThe signing screen shows the attestation and full name; date and time are not described. |
| Signature linked to its record so it cannot be moved§ 11.70 | verifiedEditing a signed form unsigns the event. |
| Accurate, complete copies for inspection§ 11.10(b) | verifiedCasebooks export as PDF, JSON or ODM XML, with the audit trail. |
| Validation documentation to support the customer's own validation§ 11.10(a) | not stated |
| Access and authority checks by role§ 11.10(d), (g) | verified |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on OpenClinica's own pages. Ask OpenClinica for its validation documentation and test the control in your own validation before you rely on it.
OpenClinica's own Part 11 pageread 2026-10-22
Castor EDC
EDCeConsent- What it is
- Cloud electronic data capture with eCRF templates, plus an eConsent product with built-in video calls and eSignature. Castor serves academic, biotech, pharma and CRO studies.
- Who it fits
- Academic, biotech and CRO teams that want EDC and eConsent on one platform.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verifiedData can only be archived, not deleted. |
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | not statedCastor says it validates the system itself; documents for customers are not described. |
| Access and authority checks by role§ 11.10(d), (g) | verified |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Castor's own pages. Ask Castor for its validation documentation and test the control in your own validation before you rely on it.
Castor's own Part 11 pageread 2026-10-22
Medrio EDC
EDCeConsent- What it is
- Electronic data capture combined with clinical data management features in one platform with a no-code study builder. Medrio also sells eConsent for in-clinic and remote consent.
- Who it fits
- Sponsors and CROs that want to build and amend studies without waiting on the vendor.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Signature shows name, date and time, and meaning§ 11.50 | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | not stated |
| Access and authority checks by role§ 11.10(d), (g) | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Medrio's own pages. Ask Medrio for its validation documentation and test the control in your own validation before you rely on it.
Medrio's own Part 11 pageread 2026-10-22
Rave EDC
EDCeConsent- What it is
- Electronic data capture with libraries of pre-validated eCRFs and drag-and-drop study design. Medidata also offers Rave Lite for Phase I, Phase IV and medtech studies, and Medidata Consent for eConsent.
- Who it fits
- Sponsors and CROs running anything from simple studies to complex global trials.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | statedMedidata's public pages claim e-record and e-signature controls in line with international requirements; none we read names 21 CFR Part 11. |
| Signature shows name, date and time, and meaning§ 11.50 | statedMedidata's public pages claim e-record and e-signature controls in line with international requirements; none we read names 21 CFR Part 11. |
| Signature linked to its record so it cannot be moved§ 11.70 | statedMedidata's public pages claim e-record and e-signature controls in line with international requirements; none we read names 21 CFR Part 11. |
| Accurate, complete copies for inspection§ 11.10(b) | statedMedidata's public pages claim e-record and e-signature controls in line with international requirements; none we read names 21 CFR Part 11. |
| Validation documentation to support the customer's own validation§ 11.10(a) | statedAn assurance report covering e-records and e-signatures is available to customers. |
| Access and authority checks by role§ 11.10(d), (g) | statedMedidata's public pages claim e-record and e-signature controls in line with international requirements; none we read names 21 CFR Part 11. |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Medidata's own pages. Ask Medidata for its validation documentation and test the control in your own validation before you rely on it.
Medidata's own Part 11 pageread 2026-10-22
How we read the vendors
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.
FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.
Questions
Is there an FDA-approved or Part 11 certified EDC?
No. FDA's 2024 Q&A says it “does not perform preliminary evaluations of electronic systems (e.g., EDC system, electronic clinical trial management system) to determine whether they comply with part 11 requirements” Q16; they are evaluated during an inspection. It also does not certify systems or methods used to obtain electronic signatures Q28. A vendor's Part 11 line is a claim your own validation has to test.
Is a signature drawn with a finger on a tablet an electronic signature?
No. FDA treats a signature drawn with a finger or a stylus as a handwritten signature Q25. It still has to be linked to its electronic record, and it should sit on the document where it would appear on a printed page. A typed or clicked signature with a login is the electronic kind, and that is the one the Part 11 e-signature rows are about.
Can we rely on the eConsent vendor's statement that it meets Part 11?
For how the signature works, yes. The 2016 eConsent guidance says IRBs, investigators and sponsors “may rely on a statement from the vendor” that describes how the signature is created and that the system meets the relevant Part 11 requirements eIC Q6. Get that statement in writing; a marketing page is not it. Validating the system for your study stays with you Q7.
Does the investigator have to be there when a participant signs an eConsent?
No. Consent can be taken at the site or remotely, but the investigator stays responsible and “cannot delegate authority to obtain informed consent to the electronic system” eIC Q2. When no one from the site witnesses the signing, the system needs a way to confirm the signer is the participant or their legally authorized representative § 11.100(b), for example a check of an ID document, personal questions, biometrics or visual methods.
How long do we keep EDC data and its audit trail?
Part 11 sets no period of its own: the audit trail is kept at least as long as the record it covers § 11.10(e), and the record's period comes from the predicate rule. Under an IND, investigators keep records for two years after the marketing application for the indication is approved, or, if none is filed or approved, until two years after the investigation is discontinued and FDA is notified § 312.62(c); sponsors have a similar rule § 312.57(c). Device studies keep records for two years after the later of the study's end or the date they stop being needed for the marketing submission § 812.140(d).
What happens to our trial data if we leave the EDC vendor?
Plan it before you sign. FDA recommends the agreement include “a plan that ensures the sponsor will have access to data throughout the regulatory retention period” Q17, and when a hosted contract ends the sponsor should make sure the metadata are obtained, kept and linked to each data element Q5. Our guide to Part 11 for cloud and SaaS systems covers the quality agreement clause by clause.
Does Part 11 require us to review EDC audit trails on a schedule?
No. Part 11 requires the trail, not a review cadence. The 2024 Q&A says periodic review “may be helpful” and that the decision to review should rest on a risk assessment of the study Q12. If you do review, the audit trail review checklist builds the list of events and the frequency by risk.
Does Part 11 apply to hospital records that feed our EDC?
FDA does not intend to assess electronic health record systems for Part 11 compliance. “Once the electronic record enters the sponsor's electronic data capture (EDC) system, FDA intends to assess compliance with part 11” Q1. The sponsor is still responsible for the quality and integrity of what it submits. Not sure whether a given record is in scope? Run it through the Part 11 applicability checker.
Sources
Regulation text from the eCFR; guidance from FDA and HHS. Q numbers on this page refer to FDA's 2024 clinical Q&A; “eIC Q” numbers to the 2016 eConsent guidance. Vendor sources are linked on each vendor card. General information, not regulatory advice.
- Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 2024, Revision 1), FDAread 2026-10-22
- The same guidance, full text (PDF), FDAread 2026-10-22
- Use of Electronic Informed Consent in Clinical Investigations: Questions and Answers (December 2016), FDA and HHS OHRPread 2026-10-22
- The same guidance, full text (PDF), FDA and HHS OHRPread 2026-10-22
- 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
- 21 CFR 50.27, Documentation of informed consent, eCFRread 2026-10-22
- 21 CFR Part 312, Investigational New Drug Application (§§ 312.57, 312.62), eCFRread 2026-10-22
- 21 CFR 812.140, Records (investigational device exemptions), eCFRread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003), FDAread 2026-10-22