21 CFR Part 11 began as a permission, not a mandate. The FDA published it in March 1997, in 62 FR 13430, and made it effective on 20 August 1997, so electronic records and electronic signatures could be accepted as equivalent to paper records and handwritten signatures when the required controls were present. In September 2003, after sustained industry concern about scope and cost, the FDA issued its Part 11, Electronic Records; Electronic Signatures: Scope and Application guidance. The guidance narrowed the agency’s enforcement focus and introduced enforcement discretion for certain controls, while confirming that Part 11 itself remained in effect.
That history creates a current problem. Medical device and SaMD companies now run design, CAPA, complaint and submission processes in cloud eQMS environments, while the Quality Management System Regulation became effective on 2 February 2026. This reference explains which electronic records fall within Part 11, which controls the FDA treats with discretion, what still binds a manufacturer, and how the QMSR changes the predicate-rule analysis.
Background from 1997 to the 2026 QMSR
The original rule was designed to remove a regulatory obstacle. FDA described Part 11 as applying across its programme areas, without requiring companies to abandon paper. Instead, it set the conditions under which firms could use electronic records and signatures in place of paper records and handwritten signatures. The rule also established that an electronic signature must be unique to one individual, must not be reused or reassigned, and must remain linked to its corresponding record so it can’t be copied or transferred by ordinary means. These requirements remain visible in 21 CFR Part 11.
The 2003 guidance narrowed how the FDA applies the rule; it did not repeal it. The FDA stated that Part 11 applies to electronic records required by predicate rules, or to electronic records relied on to demonstrate compliance, and that some Part 11 controls would receive enforcement discretion where the underlying predicate rule did not require them. The predicate rules themselves remained unaffected.
The reader’s operating reality is now different from that of 1997. A cloud eQMS may host design approvals, CAPA investigations, complaints, training records and quality-system documents across several jurisdictions, with users working from different locations and service providers maintaining parts of the infrastructure. The QMSR effective on 2 February 2026 replaced the former quality-system baseline with a framework incorporating ISO 13485:2016 by reference (see our overview of the QMSR and ISO 13485:2016), while Part 11 continues to govern qualifying electronic records.
The practical consequence is a record-level assessment, not a blanket decision that an entire eQMS is either in or out of scope. A manufacturer should document whether it relies on the electronic record, the paper record, or both for each regulated record class. That decision belongs in the quality-system analysis described in MedQAIR’s QMS compliance guidance, not in a vendor brochure.
Structure of 21 CFR Part 11
Part 11 is easier to assess when its architecture is separated from the vendor’s feature list. Subpart A defines scope and terms, Subpart B governs electronic records, and Subpart C governs electronic signatures.
| Subpart and section | Subject | What a QA or RA lead should locate |
|---|---|---|
| Subpart A, 11.1 | Scope | Whether the electronic record or signature falls within Part 11 |
| Subpart A, 11.2 | Implementation | Conditions for using electronic records and signatures |
| Subpart A, 11.3 | Definitions | Terms such as closed system, open system and electronic signature |
| Subpart B, 11.10 | Closed systems | Controls for systems in which the organisation responsible for the records controls access |
| Subpart B, 11.30 | Open systems | Additional measures where the responsible organisation doesn’t control system access |
| Subpart B, 11.50 | Signature manifestations | Signer’s name, date and time, and signature meaning |
| Subpart B, 11.70 | Signature and record linking | Protection against excision, copying or transfer of a signature |
| Subpart C, 11.100 | General signature requirements | Uniqueness, identity and certification to FDA under 11.100(c) |
| Subpart C, 11.200 | Signature components and controls | Identification components and their use |
| Subpart C, 11.300 | Identification codes and passwords | Controls for non-biometric identification codes and passwords |
The table is a lookup device, not a substitute for the regulation. The decisive question remains whether a record is required under an FDA predicate rule, or whether the organisation relies on it to perform a regulated activity or demonstrate compliance.
Signatures follow the same logic. The 2003 guidance treats as Part 11 signatures those electronic signatures intended to be the equivalent of handwritten signatures, initials and other general signings required by predicate rules, including signatures that document that an action took place, such as approved, reviewed or verified. That matters in approval workflows, where a company may treat an approval click as an administrative convenience while the predicate rule treats it as a required signing.
The 11.10 controls and where FDA stands
Section 11.10 applies to closed systems, the common arrangement for an eQMS controlled by the manufacturer. The 2003 guidance narrowed enforcement for selected provisions, but it didn’t turn the remaining controls into optional design preferences.
| Control | Requirement summary | FDA enforcement stance under the 2003 guidance |
|---|---|---|
| 11.10(a) | Validation of systems for accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records | Enforcement discretion for the Part 11 validation requirement. Predicate-rule validation duties remain |
| 11.10(b) | Ability to generate accurate and complete copies for FDA inspection and review | Enforcement discretion for the Part 11 provision |
| 11.10(c) | Protection of records so they remain accurate, readily retrievable and available throughout the required retention period | Enforcement discretion for the Part 11 provision, without removing predicate-rule retention or integrity duties |
| 11.10(d) | Limitation of system access to authorised individuals | Enforced |
| 11.10(e) | Secure, computer-generated, time-stamped audit trails for creation, modification and deletion of records | Enforcement discretion for the Part 11 provision. Predicate-rule requirements on dates, sequence of events and not obscuring previous entries still apply |
| 11.10(f) | Operational system checks that enforce permitted steps and sequences | Enforced |
| 11.10(g) | Authority checks that ensure only authorised people can use, sign, alter or approve records | Enforced |
| 11.10(h) | Device checks that determine the validity of data input or operational instructions | Enforced |
| 11.10(i) | Education, training and experience appropriate to assigned responsibilities | Enforced |
| 11.10(j) | Written policies holding individuals accountable for actions initiated under their electronic signatures | Enforced |
| 11.10(k) | Controls over system documentation, including distribution, access and revision | Enforced, with discretion for related elements of 11.10(k)(2) in the circumstances described by the guidance |
The table’s apparent tension is intentional. A manufacturer may receive enforcement discretion for a specific Part 11 control while still needing equivalent evidence under a predicate rule. Audit trails illustrate the point. If a regulated record must show how a decision was made, the organisation can’t defend the record by pointing only to the 2003 discretion language.
The same reasoning applies to validation. FDA discretion under 11.10(a) doesn’t authorise an unassessed eQMS. It changes the legal route through which the evidence is expected, not the need to show that the configured system performs as intended.
Access, authority checks, training and accountability remain particularly difficult to outsource. Cloud hosting can move infrastructure administration to a service provider, but it doesn’t move responsibility for user roles, approval permissions, signature accountability or procedures. Part 11 controls should be mapped to record risks rather than maintained as an isolated checklist.
Enforcement discretion and what still binds you
The important distinction is between Part 11 enforcement discretion and predicate-rule compliance. The FDA’s 2003 guidance preserved the obligations imposed by predicate rules, including the former quality-system requirements in 21 CFR Part 820. From 2 February 2026, the QMSR provides the applicable quality-system framework and incorporates ISO 13485:2016, including software validation in clause 4.1.6 and document and record controls in clauses 4.2.4 and 4.2.5.
| Part 11 clause | What the 2003 position relaxed | What still binds after the QMSR |
|---|---|---|
| 11.10(a) | Discretion over the Part 11 validation provision | Validation of software used in the QMS under ISO 13485:2016 clause 4.1.6, as incorporated through the QMSR |
| 11.10(b) | Discretion over the Part 11 copy-generation provision | Ability to provide records and evidence required by the applicable predicate rule and inspection process |
| 11.10(c) | Discretion over the Part 11 record-protection provision | Controlled records, retention and retrieval under ISO 13485:2016 clauses 4.2.4 and 4.2.5 and applicable predicate rules |
| 11.10(e) | Discretion in defined circumstances for Part 11 audit trails | Integrity and traceability of records where the predicate rule or regulated use requires them |
| 11.10(k) and related 11.10(k)(2) elements | Discretion for selected Part 11 system-documentation controls, particularly in the guidance’s legacy context | Controlled QMS software documentation, configuration and changes under the QMSR and ISO 13485:2016 |
The FDA’s Computer Software Assurance guidance was finalised in September 2025 and reissued in February 2026 for production and quality management system software under the QMSR, superseding the September version. It describes a risk-based approach: the level of assurance evidence follows the intended use of the software and the risk it poses to product quality and the quality system, rather than identical testing of every feature.
Enforcement discretion can reduce the amount or form of evidence required for a Part 11 provision, but it can’t make an unreliable record acceptable under the predicate rule. A manufacturer still needs records that are attributable, protected, retrievable and suitable for the regulated decision they support.
The legacy position is narrow. The 2003 guidance extends enforcement discretion to all Part 11 requirements for systems operational before 20 August 1997, but only where the system met the predicate rules before that date, still meets them, and the company holds documented evidence that it is fit for its intended use. If later changes would prevent the system from meeting predicate-rule requirements, Part 11 controls should be applied. A current cloud deployment can’t rely on the age of a predecessor system.
Electronic signatures under Part 11
Electronic signatures are governed by several connected provisions. Section 11.50 addresses what appears with the signature, 11.70 protects the link between signature and record, 11.100 establishes general requirements, 11.200 sets the components and controls, and 11.300 addresses identification codes and passwords.
| Provision | Required outcome |
|---|---|
| 11.50 | The signed record shows the signer’s printed name, the date and time of signing, and the meaning of the signature |
| 11.70 | The signature is linked to its record so it can’t be excised, copied or transferred to falsify another record |
| 11.100(a) | Each electronic signature is unique to one individual and isn’t reused or reassigned |
| 11.100(b) | The organisation verifies the identity of the individual before establishing, assigning or certifying their electronic signature |
| 11.100(c) | The organisation certifies to FDA that electronic signatures are intended to be the legally binding equivalent of handwritten signatures |
| 11.200 | Non-biometric signatures use at least two distinct identification components, such as an identification code and password; biometric signatures are designed so only their genuine owner can use them |
| 11.300 | Identification codes and passwords are controlled through measures covering issuance, periodic checking, safeguards, loss management and testing |
Section 11.200 also sets the signing sequence. Within a single, continuous period of controlled system access, the first signing uses all signature components and later signings use at least one component that only the individual can execute. Outside such a session, every signing uses all components. A cloud workflow where a user approves with a single click, without entering those components, doesn’t meet 11.200, whatever the interface calls the action.
Section 11.100(c) also deserves separate treatment. The organisation must certify to FDA that its electronic signatures are intended to be the legally binding equivalent of handwritten signatures. The certification is signed with a traditional handwritten signature, and 11.100(c)(1) refers to FDA’s web page on Letters of Non-Repudiation Agreement for where to submit it. Check that page rather than an address copied from an archived procedure.
FDA’s October 2024 electronic-systems guidance for clinical investigations also addresses electronic records, IT service providers and electronic signatures. That is particularly relevant where a sponsor, investigator, technology provider and manufacturer divide control over the same record chain. The signature field may be technically correct while the surrounding identity, access and evidence arrangements remain indefensible.
Hypothetical SaMD company on a cloud eQMS
Hypothetical example: an EU-based SaMD company is preparing its first 510(k). It moves its design history file, software lifecycle records, document approvals, CAPA process and complaint handling into a cloud eQMS. The company still retains responsibility for deciding which records are relied on to demonstrate compliance.
The design review approvals, released design records, software validation evidence, CAPA investigations and complaint files are likely to be Part 11 records where they are required by, or relied on for, FDA-regulated activities. The cloud location doesn’t determine scope. The record’s role in the predicate-rule process does.
The company would need objective evidence for the controls relevant to those records:
-
Identity and access: authorised users have individual accounts, permissions are limited, and approval authority is assigned to the right roles under 11.10(d) and 11.10(g).
-
Workflow integrity: required review and approval sequences are enforced under 11.10(f).
-
Record history: changes, approvals and relevant deletions are captured and reviewable where the audit trail is required by the record’s use under 11.10(e).
-
Signature integrity: signatures show the name, date, time and meaning, remain linked to the record, and use the required identification controls under 11.50, 11.70 and 11.200.
-
Accountability: procedures, training and written responsibility policies support 11.10(i) and 11.10(j).
The vendor’s Part 11 statement provides evidence about platform capabilities. It doesn’t establish that the company’s configured workflows, roles, integrations, retention settings or procedures are suitable. Under the FDA’s CSA approach, the company can use vendor evidence as part of its assurance package, then add risk-based testing for the intended use. A system that creates a high-consequence approval record warrants stronger direct evidence than an unrelated administrative function.
Being a SaMD company doesn’t alter the Part 11 analysis. Its submission package must still be supported by records whose authorship, approval history, configuration and signature chain can be defended.
Where Part 11 lands in a medical device company
Part 11 follows the record, not the department or product label. An eQMS may contain both regulated and non-regulated material, and a SaMD may create records that become relevant because a predicate rule requires them or because the manufacturer relies on them to demonstrate compliance.
| Record class | Example records | Triggered 11.10 controls | Predicate rule |
|---|---|---|---|
| Design history and design changes | Design reviews, release approvals, change records | 11.10(d), (f), (g), (e), (j), (k) | QMSR and applicable design-control requirements |
| Software lifecycle evidence | Validation results, lifecycle records and release evidence | 11.10(a), (c), (d), (e), (k) | QMSR, including ISO 13485:2016 clause 4.1.6 |
| CAPA | Investigations, root-cause records, action approvals and effectiveness reviews | 11.10(d), (f), (g), (e), (i), (j) | QMSR |
| Complaints and vigilance records | Complaint intake, evaluation, investigation and closure | 11.10(c), (d), (e), (f), (g), (j) | QMSR and 21 CFR 803 where applicable |
| Clinical investigation records | Electronic records and approvals used in an FDA clinical investigation | 11.10(d), (e), (g), (i), (j), plus Subpart C | 21 CFR 812 where applicable |
| Labelling and UDI records | Controlled labelling versions and approval history | 11.10(c), (d), (e), (f), (g), (k) | Applicable device predicate rules |
| Production and service records | Release, production, installation or service evidence | 11.10(c), (d), (f), (g), (e) | QMSR and applicable predicate rules |
| SaMD-generated records | Required logs, outputs or records held by the software | 11.10(a), (c), (d), (e), (k) | The predicate rule connected to the regulated activity |
The table doesn’t mean every record in each class automatically falls within Part 11. The manufacturer should document, per record class, whether the electronic version is the authoritative record, whether paper remains authoritative, and whether the electronic version is relied on during a regulated activity. Hybrid arrangements need a defined relationship between the electronic and paper components.
A vendor’s claim that a product is “Part 11 compliant” is therefore only a starting point. The manufacturer still owns intended-use assessment, configuration, validation or assurance activities, user provisioning, authority checks, procedures, training, change control and the review of audit-trail behaviour. The manufacturer also owns the linkage between a design decision, its approval, the associated software evidence and the submission package.
A record-level assessment is more defensible than a generic certificate kept in the supplier file. The supplier’s evidence can reduce duplicated testing, but it can’t answer whether the configured system performs the manufacturer’s intended regulated process.
EU position and the absence of a Part 11 equivalent
There is no direct equivalent to 21 CFR Part 11 in EU medical device law. For a medical device manufacturer operating an ISO 13485:2016 quality management system, the relevant controls arise through software validation in clause 4.1.6, document control in clause 4.2.4, and record control in clause 4.2.5.
EU GMP Annex 11 concerns computerised systems used for medicinal products. It may provide useful comparative thinking, but it isn’t the binding medical-device requirement merely because a device company uses an electronic quality system.
Electronic signatures in the EU also sit within the legal framework of Regulation (EU) No 910/2014, commonly known as eIDAS. That framework addresses electronic identification and trust services. It doesn’t convert EU medical-device records into Part 11 records, and it doesn’t remove the need to validate the software used in the quality management system.
A manufacturer selling in both markets therefore needs a controlled record strategy with two legal reference points. The same electronic record may need to satisfy the organisation’s ISO 13485 controls for the EU file and Part 11, together with its FDA predicate rule, for the US process. One system can support both, but one generic compliance statement can’t replace the two assessments.
What to do now
Our view is narrow but not permissive. The 2003 guidance limits Part 11’s practical scope to electronic records and signatures connected to predicate-rule requirements or relied on for regulated activities. It doesn’t excuse weak access control, unexplained changes, unverified signatures or an eQMS that hasn’t been assessed for its intended use.
The QMSR transition on 2 February 2026 changes the quality-system foundation beneath the analysis. It doesn’t remove the need for trustworthy records. Validation now sits within the QMSR and ISO 13485:2016 framework, while the Part 11 controls that remain applicable continue to govern electronic records used in FDA-regulated processes.
The sensible response is a focused inventory:
-
identify record classes and the authoritative record;
-
map each class to its predicate rule and relevant 11.10 controls;
-
review the configured eQMS validation or assurance file;
-
test audit-trail behaviour and record retrieval;
-
verify non-biometric and biometric signature controls;
-
confirm the 11.100(c) certification position;
-
document procedures, training and supplier evidence.
Part 11 compliance is therefore an operating condition of the record system, not a property printed on the software contract.
Frequently asked questions
Which records fall within Part 11?
Under the 2003 guidance, Part 11 applies to records required by a predicate rule and kept electronically in place of paper; records kept in both forms where the electronic version is relied on to perform regulated activities; records submitted to FDA in electronic form; and electronic signatures intended to be the equivalent of handwritten signatures required by predicate rules. The 2003 Scope and Application guidance is the key interpretive reference, read with 11.1 and the relevant predicate rule.
Is a vendor’s Part 11 claim sufficient?
No. A vendor can provide platform features and supporting evidence, but the manufacturer must assess intended use, configure the system, perform proportionate validation or assurance activities, and maintain procedures and training. That follows from the relationship between 11.10(a), the organisation’s actual use of the system, and the 2003 guidance.
How must audit trails be handled?
Where applicable, 11.10(e) requires secure, computer-generated, time-stamped audit trails that record the creation, modification and deletion of electronic records without obscuring previous information. The 2003 guidance provides enforcement discretion in defined circumstances, but it doesn’t remove a predicate rule’s need for trustworthy and traceable records.
Are password-only electronic signatures acceptable?
Not as the sole basis of the signature. A non-biometric signature needs at least two distinct identification components, such as a user ID and password (11.200(a)(1)). During one continuous, controlled session, signings after the first may use a single component that only the individual can execute, such as the password. The 11.300 controls on ID codes and passwords apply throughout.
What does 11.100(c) require?
The organisation must certify to FDA that its electronic signatures are intended to be the legally binding equivalent of handwritten signatures. It is signed with a traditional handwritten signature, and FDA’s Letters of Non-Repudiation Agreement page explains where to submit it.
How does the QMSR affect Part 11?
The QMSR changes the quality-system predicate framework and incorporates ISO 13485:2016, including software validation and record controls. It doesn’t replace Part 11, which remains the electronic-record overlay where its scope is met.
For a record-level Part 11 and QMSR gap review, contact the MedQAIR team with your eQMS scope, predicate-rule mapping and current validation evidence.
