Skip to content

Part 11 electronic signature requirements: signature manifestation check

Part 11 asks every signed electronic record to show who signed, when, and what the signature means, on screen and on paper, and to keep the signature tied to its record. Paste what your system prints, answer how it signs, and see each line read against the rule, with a corrected block beside yours. It covers the duties outside the software too, from the identity check to the Part 11 certification letter.

The tool

Click any answer to change it. Pre-filled with a realistic example: a chromatography report signed in a QC lab.

01What the signed record shows

Editing this box refills the three fields below. Labels it reads: Signed by, Approved by, Date, Signed on, Meaning, Reason.

As your record shows it

Signed by
jdoe
Meaning
Signed
Date
10/22/2026 14:07

Corrected (§ 11.50), illustrative values marked

Signed by
Jane Doe (jdoe)example
Meaning
Approvedexample
Date
2026-10-22 14:07 UTCexample

02Where the block lives

Where do the three items appear? § 11.50(b)
How are they stored? § 11.50(b)
How is the signature tied to the record? § 11.70

03How it is signed

What does the signer use? § 11.200
Who holds the accounts? § 11.100(a)
What is entered at each signing? § 11.200(a)(1)
No one person alone can sign as someone else (an admin cannot set and know a user's password) (§ 11.200(a)(2)–(3))
IDs and passwords are checked, recalled or revised on a schedule (§ 11.300(b))
Unauthorized attempts are reported at once to security (§ 11.300(d))
Do signers carry tokens or cards? § 11.300(c), (e)

04Your side, beyond the screen

Each signer's identity was verified before the signature was issued (§ 11.100(b))
The certification letter has gone to FDA (§ 11.100(c))
A written policy holds signers accountable for what they sign (§ 11.10(j))

Result

5 gaps, 1 to confirm

The printed block carries 1 of 3 items § 11.50(a) asks for. Each line below names the rule it reads; a gap is a line to fix, confirm is a line to settle in your validation file.

What the block shows

  1. § 11.50(a)(1)gapPrinted name of the signer. Shows a login ID ("jdoe"), which is an identification code, not the printed name of the signer. Print the name; the ID can sit beside it.
  2. § 11.50(a)(2)meetsDate and time the signature was executed. Date and time are shown.
  3. 2003 guidance, fn. 5confirmTime zone reference. No time zone on the block and none named in your documents. Part 11 names no zone and FDA does not expect the signer's local time, but your documentation should explain the time zone reference.
  4. § 11.50(a)(3)gapMeaning of the signature. "Signed" only says a signature happened. The rule asks what it means: review, approval, responsibility or authorship, for example.

Where the block lives

  1. § 11.50(b)gapShown on every human readable form. The block shows on screen but drops off the printout or PDF. It must be part of any human readable form.
  2. § 11.50(b)meetsSame controls as the record. Name, date and time, and meaning are stored by the system under the record's own controls.
  3. § 11.70meetsSignature linked to its record. The signature is bound to the record: it cannot be lifted onto another record, and a change to the record shows.

How it is signed

  1. § 11.100(a)meetsUnique to one person. Each signature belongs to one person and is never reused or reassigned.
  2. § 11.200(a)(1)meetsTwo distinct components, used at signing. Every signing takes the user ID and password, which meets § 11.200(a)(1)(ii) and, inside a session, (i).
  3. § 11.200(a)(2)–(3)meetsOnly the owner can use it; misuse needs two or more people. Using another person's signature would take two or more people working together.
  4. § 11.300(b)meetsID and password issuances checked, recalled or revised. Issuances are checked or revised on a schedule (password aging, for example).
  5. § 11.300(d)meetsUnauthorized attempts detected and reported. Attempts at unauthorized use are reported at once to the system security unit.
  6. § 11.300(c), (e)n/aTokens and cards: loss management and testing. No tokens or cards carry ID or password information.

Your side, beyond the screen

  1. § 11.100(b)gapIdentity verified before the signature is issued. No identity check on file before signatures were issued.
  2. § 11.100(c)gapCertification letter sent to FDA. No certification to FDA yet. It is due before or at the time of first use, and the duty sits with your organization, not the vendor.
  3. § 11.10(j)meetsWritten accountability policy. A written policy holds each signer accountable for actions under their signature.

What it checks

A signed electronic record has to say three things on its face: who signed, when, and what the signature means. § 11.50(a) puts it as “the printed name of the signer”, “the date and time when the signature was executed” and “the meaning (such as review, approval, responsibility, or authorship)”. § 11.50(b) adds that those three items fall under the same controls as the record and appear on “any human readable form of the electronic record (such as electronic display or printout)”.

The check reads your block against those words, then goes past the screen. § 11.70 asks that the signature be linked to its record so it cannot be “excised, copied, or otherwise transferred”. Sections 11.100, 11.200 and 11.300 govern how an electronic signature is issued and executed. FDA’s 2003 guidance narrowed how it enforces some of Part 11, but it named the signature sections among the ones it still enforces: “§§ 11.50, 11.70, 11.100, 11.200, and 11.300”. For every other section, see Part 11 requirements, section by section.

It does not decide whether Part 11 reaches the record in the first place. If you are unsure, run the Part 11 applicability checker first.

How to use this check

  1. 01Open one signed record the way a reviewer sees it. Use an ordinary account, not the admin view. What the system shows there is what an inspector reads.
  2. 02Export or print the same record. Put the PDF beside the screen. A block that shows on screen and vanishes from the report is the most common gap on this page.
  3. 03Paste the block into step 01. Copy it as text from the screen or the PDF. The three fields fill themselves; fix any field the reader got wrong.
  4. 04Answer steps 02 to 04 from evidence, not memory. Storage and linking come from the vendor's documentation and your own tests; identity checks and the FDA letter come from your files.
  5. 05Copy the findings into the validation file. Each gap becomes a requirement or a test, each confirm a line someone signs off with the evidence attached.

The verdict words are plain. meets: the line matches the rule’s words. gap: it does not, and the line says why. confirm: the rule does not settle it from what you entered, so write down your reading and the evidence. n/a: the rule does not reach that line.

Worked example: six blocks as systems print them

Six signature blocks of the kind QA teams paste from chromatography, document control and e-signature tools, each read by the tool itself. The meanings in the passing rows are the four the rule names. Starred values in the corrected column are illustrative.

Six signature blocks read against § 11.50(a), with the corrected block for each
Block as printedName§ 11.50(a)(1)Date and time§ 11.50(a)(2)Meaning§ 11.50(a)(3)Zone2003 guidanceCorrected
Electronically signed by: jdoe Signed on: 10/22/2026 14:07 Reason: SignedgapmeetsgapconfirmJane Doe (jdoe) *Approved *2026-10-22 14:07 UTC *
Approved by: Jane Doe Date: 2026-10-22 14:07 UTCmeetsmeetsmeetsmeetsJane DoeApproved2026-10-22 14:07 UTC
Reviewed by Jane Doe on 22-Oct-2026 09:15 CETmeetsmeetsmeetsmeetsJane DoeReviewed2026-10-22 09:15 CET
QA Manager 22/10/2026 Meaning: ApprovalgapgapmeetsconfirmJane Doe *Approval2026-10-22 14:07 UTC *
j.doe@lab.example 2026-10-22T14:07:00Z Meaning: AuthorshipgapmeetsmeetsmeetsJane Doe *Authorship2026-10-22 14:07 UTC
John Doe 03/04/2026 10:00 Meaning: ResponsibilitymeetsmeetsmeetsconfirmJohn DoeResponsibility2026-03-04 10:00 UTC *

The first row is the tool’s default and a common real case: the system prints the login ID, a meaning of “Signed” and no zone. The fix is often configuration, not new software: switch the report template to the user’s full name, and turn on signature meanings, which some systems label reasons. Write the corrected block into your user requirement specification and test the printout in OQ with the IQ OQ PQ template.

Four gaps that turn up on signature blocks

A login ID instead of a name

“jdoe” is an identification code, one of the two components § 11.200(a)(1) uses to execute the signature. It is not the printed name of the signer. Print the name; keeping the ID beside it in brackets helps reviewers match the audit trail.

“Signed” as the meaning

A meaning says what the signer took on: reviewed the data, approved the batch, authored the method. A generic “Signed” or “Electronically signed” says only that a signature happened. If one record carries an author and an approver, each needs its own meaning.

Inspection risk

The block on screen but not in the PDF. Teams approve on screen, then send the PDF to a client or file it as the batch record, and the signature block is not on it. § 11.50(b) asks for the items on any human readable form, the printout included.

Misreading: “Local time on every signature”

Part 11 asks for the date and time, not the signer’s local time. FDA’s 2003 guidance says “we do not expect you to record the signer’s local time”, and that your documentation should explain time zone references. A server that stamps UTC is fine if the SOP or the block says so. The rows of the audit trail should use the same reference.

E-signature requirements beyond the screen

A clean signature block proves the software can show the right things. Five duties around electronic signatures are met in your files, not in the product, and buying a tool that states Part 11 support does not move them to the vendor.

  1. 01Verify each signer's identity before issuing the signature § 11.100(b)Before an organization sets up a person's electronic signature, it “shall verify the identity of the individual”. In a small lab that is often HR or the system owner checking a photo ID against the account request and filing the signed request. The system cannot do this for you, and an inspector asks for the file, not the screen.
  2. 02Send FDA the certification letter § 11.100(c)Persons using electronic signatures certify to FDA, before or at first use, that their electronic signatures are “intended to be the legally binding equivalent of traditional handwritten signatures”. The letter is signed by hand and sent in electronic or paper form. FDA's Letters of Non-Repudiation Agreement page offers an individual letter or a company-wide letter that covers all employees, New ESG NextGen users generate or upload the letter while registering in FDA's Unified Submission Portal, and a paper copy is now optional. On request you may have to certify a specific signature again (§ 11.100(c)(2)).
  3. 03Write the accountability policy § 11.10(j)A written policy that holds people “accountable and responsible for actions initiated under their electronic signatures”. A one-page policy that every signer signs before their account goes live is a common way to meet it; record each sign-off on a training record.
  4. 04Run the password and token procedures § 11.300Unique ID and password pairs, periodic checks or revision, deauthorizing lost tokens and cards, reporting attempted misuse to the system security unit, and testing tokens. The software supplies the switches; your procedure decides who acts and how fast.
  5. 05Train the signers § 11.10(i)People who develop, maintain or use the system need the education, training and experience for the task. For signers that includes what each meaning commits them to.

Part 11 does not require biometrics, PKI or a digital signature

§ 11.200(a)(1) accepts an identification code and password. Digital signatures and encryption appear in § 11.30 as additional measures for open systems; the open vs closed system check tells you whether that applies. FDA certifies no e-signature product either: compliance is a validation claim you make for your own use.

To see how the main e-signature tools describe their side of this split, read the Part 11 e-signature software comparison, or the single-vendor reads is Docusign Part 11 compliant and is Adobe Acrobat Sign Part 11 compliant. Then mark the rest of the system in the Part 11 compliance checklist, and write the accountability policy with the SOP template and keep each signer’s sign-off on a training record.

Where the rule says so

§ 11.3(b)(7)
Electronic signature: “a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature.”
§ 11.50(a)
“(1) The printed name of the signer; (2) The date and time when the signature was executed; and (3) The meaning (such as review, approval, responsibility, or authorship) associated with the signature.”
§ 11.50(b)
The three items “shall be included as part of any human readable form of the electronic record (such as electronic display or printout).”
§ 11.70
Signatures are linked to their records “to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.”
§ 11.100(a)
“unique to one individual and shall not be reused by, or reassigned to, anyone else.”
§ 11.200(a)(1)
“Employ at least two distinct identification components such as an identification code and password.” In one continuous session the first signing uses all components and later ones at least one private component; outside one, every signing uses all of them.
§ 11.200(a)(3)
Misuse of a person's signature “requires collaboration of two or more individuals.”
§ 11.200(b)
Biometric signatures are “designed to ensure that they cannot be used by anyone other than their genuine owners.”
2003 guidance
On time stamps: “we do not expect you to record the signer's local time”; documentation should explain time zone references.

§ 11.100(c)(1) was last amended in 2023 by a nonsubstantive technical change that added electronic submission of the letter; the signature requirements themselves date from the 1997 rule, effective August 20, 1997. EU GMP Annex 11 § 14 asks for less on the face of the record, the time and date only; see the Annex 11 vs Part 11 mapping.

Sources

  1. 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR, up to date as of 2026-10-20), eCFRread 2026-10-22
  2. Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003), FDAread 2026-10-22
  3. Letters of Non-Repudiation Agreement, FDAread 2026-10-22
  4. Change of Address; Technical Amendment, 88 FR 13018 (§ 11.100(c)(1)), Federal Registerread 2026-10-22