Interpreting FDA 21 CFR Part 11 Compliance and Electronic Signature Best Practices

In the life sciences sector — pharmaceuticals, medical devices, biotechnology and in-vitro diagnostics — data integrity is the foundation of every regulated decision. As paper records and handwritten signatures give way to electronic records and electronic signatures, the question is no longer whether a document was signed, but whether the whole evidence chain can still be trusted under regulatory review. 21 CFR Part 11 is the US rule that defines what that takes.

What is FDA 21 CFR Part 11?

FDA published 21 CFR Part 11 on 20 August 1997. It is the framework that allows electronic records and electronic signatures to replace paper records and handwritten signatures with equivalent legal effect, provided the required controls are met. It is not a product certification, and it is not written for one industry.

Part 11 governs the record chain, not the software. It applies to records that an FDA predicate rule requires an organisation to maintain or submit, when those records are created, modified, maintained, archived, retrieved or submitted electronically. The test is not "which industry are you in" but "do you hold records that FDA rules require you to keep or submit". Pharmaceutical manufacturers, biotech and medical-device firms, IVD makers, CROs and CDMOs can all fall in scope.

Three questions Part 11 answers

1. When does it apply? When a predicate rule requires the record and the organisation relies on the electronic version, or submits it electronically to FDA.
2. What makes an electronic signature valid? It must carry the legal effect of a handwritten signature, be attributable to a unique individual, and be bound to its record — not merely an image or a typed name.
3. How is validity maintained? Through technical and procedural controls that keep the record and signature trustworthy, complete and reproducible.

The core controls

Part 11 is short, but its requirements add up to a system built around identity, access, audit and retention: validated systems, complete and retrievable copies, protected retention, controlled access and authority, secure time-stamped audit trails, clear signature manifestation (name, date/time, meaning), signature-to-record binding, and at least two distinct identification components for non-biometric signatures.

Where Part 11 sits among global record-keeping rules

Part 11 is US law, but it has become the most widely used reference frame in regulated life sciences. Other major markets set their own rules:

• European Union — computerised systems in GMP environments fall under EU GMP Annex 11, while the legal effect of electronic signatures is set by eIDAS (Regulation (EU) No 910/2014), which distinguishes simple (SES), advanced (AES) and qualified (QES) electronic signatures.
• Japan — electronic-record expectations are set through PMDA and related guidance.
• China — NMPA rules together with the Good Record and Data Management Practice (药品记录与数据管理要求) for records and data used in regulated drug activities.

Part 11 became the common language because the United States is one of the largest pharmaceutical markets, and FDA inspection authority follows the market rather than the company's headquarters. FDA inspects manufacturing sites that supply the US market — including plants in China, India and Europe — and US customer audit requirements cascade along the supply chain to every CDMO, CRO and API supplier. Among the main regimes, Part 11 appeared earliest, is the most specific, and is cited most often; some firms that are not directly FDA-regulated adopt it voluntarily as a higher internal control baseline.

Why an ordinary e-signature falls short

An ordinary e-signature answers whether a document was signed and by whom. Part 11 asks whether the whole record chain stays trustworthy, attributable and reproducible. Four control gaps usually separate the two:

1. Audit trail. Everyday signing tools typically capture only the end result. Part 11 expects a complete, non-overwriting event chain — who did what, to which record, at what time and with what outcome, including administrative actions.
2. Signature-to-record binding. A generic signature — an image, a stamp or a line of text — can be copied onto another document. Part 11 expects the signature to be inseparable from the record, so altering the signed content invalidates it. That needs cryptographic binding, not a pasted image.
3. Identity proofing. Part 11 expects each signature to map to a unique individual, with at least two distinct identification components for non-biometric signatures and credentials used only by their owner. Shared accounts and signature-by-proxy fall outside this model.
4. Validation and evidence. Part 11 starts from a validated system. Organisations must be able to produce requirements-to-test traceability, validation reports and deviation records, which depends on software-lifecycle documentation from the vendor.

Recent FDA guidance to keep in mind

Part 11 itself has remained largely unchanged since 1997, but FDA continues to publish guidance that shapes how it is applied. In October 2024, FDA finalised its guidance on Part 11 Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations, clarifying when Part 11 applies to systems and records used in clinical research. Regulated organisations should treat Part 11 as the baseline and track FDA guidance for their specific product area.

Where responsibility sits

Capability and responsibility are not the same thing. A vendor supplies capability, documentation and support; the regulated organisation owns intended use, procedures, validation, training, access governance and record retention. Treating a vendor's compliance documentation as one's own compliance evidence is one of the most common pitfalls for companies expanding overseas — and no vendor certification transfers Part 11 compliance to the customer.

How eSign.AI supports a Part 11 signing workflow

eSign.AI provides electronic-signature and evidence capabilities that can be configured as part of a regulated process:

• Signing meaning and manifestation — workflows can capture the reason for signing together with signer and signing-event information, helping teams represent actions such as review, approval or responsibility.
• Signer verification and account controls — configurable identity and account-security options support identity and access requirements, to be assessed against the workflow and the organisation's risk model.
• Audit evidence — signing events, completion information and supporting evidence help teams reconstruct who acted, what was signed and when the event occurred.
• Workflow and system integration — API and workflow integration can connect signing steps with quality, clinical, document-management or business systems, while the organisation defines system boundaries and validation responsibilities.

Using eSign.AI does not by itself make an organisation or process Part 11 compliant. Compliance depends on the complete system, configuration, procedures, people, training, records and ongoing governance. eSign.AI completed a SOC 2 Type II attestation in 2025, an independent report describing control design and operating effectiveness over a full period — useful in vendor due diligence but not a substitute for the customer's own validation.

Which enterprises this applies to

Part 11 expectations are most relevant to pharmaceutical, biotech, medical-device and IVD companies, CROs and CDMOs, and any supplier that handles records FDA rules require to be maintained or submitted — including overseas sites that supply the US and European markets.

Further reading: FDA 21 CFR Part 11 Electronic Signatures: A Practical Guide · What Is FDA 21 CFR Part 11?