FDA 21 CFR Part 11 Electronic Signatures: A Practical Guide

Part 11 starts with the record, not the signature

FDA published 21 CFR Part 11 on 20 August 1997 to establish that electronic records and electronic signatures can replace paper records and handwritten signatures with equivalent legal effect, provided the required controls are met. The rule governs the record chain, not the software: any record created, modified, maintained, archived, retrieved or submitted electronically under an FDA predicate rule can fall within scope, whatever industry label the company carries. Part 11 does not turn every electronic approval used by a life-sciences company into a regulated record. The first question is whether a predicate rule requires the record to be maintained or submitted to FDA and whether the organisation relies on the electronic version to perform the regulated activity. If it does, the electronic record and its associated signature may fall within Part 11. That scope decision should be documented before teams choose authentication methods, configure signing fields, or validate a platform. Part 11 also does not make software alone compliant: the regulated organisation remains responsible for intended use, procedures, training, access governance, validation decisions, and ongoing control.

What Part 11 is designed to protect

The rule focuses on whether electronic records and signatures remain trustworthy, reliable, attributable, and available throughout their required lifecycle.

01. Scope: identify records required by an FDA predicate rule and determine whether the electronic or paper version is relied on.

02. Record integrity: protect regulated records against unauthorised access, alteration, loss, or incomplete reconstruction.

03. Signature accountability: connect a unique, verified signer to the signed record, time, and meaning of the signing action.

04. Inspection readiness: retain records and produce accurate, complete, human-readable and electronic copies when required.

Where Part 11 sits among global record-keeping rules

Part 11 is US law, but it has become the most widely used reference frame for electronic records and signatures in regulated life sciences. Other major markets set their own rules.

European Union

Japan

China

Why Part 11 became the common language

A practical scope test before implementation

Start with the applicable predicate rule and actual operating practice. The same technology can support both Part 11 and non-Part 11 workflows.

Part 11 is more likely to apply when

A predicate rule requires the record to be maintained and the electronic record replaces paper.
A required record exists in both formats, but the electronic version is relied on for the regulated activity.
A record is submitted electronically to FDA under an accepted submission route.
An electronic signature is used as the equivalent of a handwritten signature, initial, approval, review, or verification required by a predicate rule.

Part 11 may not be triggered when

The electronic information is not required to be retained under an FDA predicate rule.
A computer only generates a paper record and the compliant paper record is the version actually relied on.
The workflow falls within a specific exclusion stated in 21 CFR 11.1.
The record is purely operational and does not support a regulated activity, submission, or required recordkeeping obligation.

Translate Part 11 requirements into evidence you can review

A feature checklist is not enough. For each control, confirm how it works in the intended workflow and what evidence can be produced during validation, audit, or inspection.

System validation

Accurate copies

Retention and retrieval

Access and authority

Audit trail

Signature manifestation

Signature-record linking

Identity and signature controls

Why ordinary e-signatures fall short of Part 11

An ordinary e-signature answers whether a document was signed and by whom. Part 11 asks a different question: whether the whole electronic record chain stays trustworthy, attributable and reproducible under regulatory review. Four control gaps separate the two.

Audit trail

Signature-to-record binding

Identity proofing

Validation and evidence

How eSign.AI can support a Part 11 signing workflow

eSign.AI provides electronic-signature and evidence capabilities that can be configured as part of a regulated process. Suitability still depends on the customer's intended use, applicable predicate rules, procedures, validation approach, identity method, and retained evidence.

Signing meaning and manifestation. Workflows can capture the reason for signing together with signer and signing-event information, helping teams represent actions such as review, approval, or responsibility.

Signer verification and account controls. Configurable signer-verification and account-security options can support identity and access requirements. The selected method should be assessed against the workflow and the organisation's risk model.

Audit evidence. Signing events, completion information, and supporting evidence can help teams reconstruct who acted, what was signed, and when the event occurred.

Workflow and system integration. API and workflow integration can connect signing steps with quality, clinical, document-management, or business systems, while the organisation defines system boundaries and validation responsibilities.

What this does not mean. Using eSign.AI does not by itself make an organisation or process Part 11 compliant. Compliance depends on the complete system, configuration, procedures, people, training, records, and ongoing governance.

A six-step implementation path

Treat Part 11 as a controlled business process, not a feature toggle.

01

Inventory regulated records

Identify the predicate rule, record owner, required signature, retention period, submission route, and the version actually relied on.

02

Define intended use and system boundaries

Document what the eSignature platform will do, which connected systems remain authoritative, and where records and evidence are retained.

03

Set identity, access, and signing controls

Configure signer verification, authentication, roles, signing meaning, authority checks, credential recovery, and account deactivation.

04

Design the evidence package

Confirm the final record, signer name, time, signing meaning, event history, integrity evidence, and export format required for review.

05

Validate against risk and intended use

Test critical requirements, negative paths, permissions, signature linking, audit events, exports, integrations, and failure recovery.

06

Operate under controlled procedures

Maintain SOPs, training, periodic access reviews, incident handling, change control, vendor oversight, and revalidation triggers.

Who is responsible for what

Capability and responsibility are not the same thing. A vendor supplies capability, documentation and support; the regulated organisation owns intended use, procedures, validation, training, access governance and record retention. Treating a vendor's compliance documentation as one's own compliance evidence is one of the most common pitfalls for companies expanding overseas.

What a vendor provides

What the regulated organisation owns

Certification is not compliance

COMMON QUESTIONS

Questions teams ask about Part 11 electronic signatures

No. Scope depends on the applicable predicate rule, whether the record is required to be maintained or submitted, and whether the organisation relies on the electronic record for a regulated activity. Document the scope decision for each record type.

Electronic Code of Federal Regulations: 21 CFR Part 11 FDA Guidance: Part 11, Electronic Records; Electronic Signatures — Scope and Application FDA Guidance: Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations