'%3e%3cpath%20fill-rule='evenodd'%20clip-rule='evenodd'%20d='M6.99935%2012.8327C10.221%2012.8327%2012.8327%2010.221%2012.8327%206.99935C12.8327%203.77769%2010.221%201.16602%206.99935%201.16602C3.77769%201.16602%201.16602%203.77769%201.16602%206.99935C1.16602%2010.221%203.77769%2012.8327%206.99935%2012.8327Z'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M1.16602%207H12.8327'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20fill-rule='evenodd'%20clip-rule='evenodd'%20d='M6.99935%2012.8327C8.28802%2012.8327%209.33268%2010.221%209.33268%206.99935C9.33268%203.77769%208.28802%201.16602%206.99935%201.16602C5.71068%201.16602%204.66602%203.77769%204.66602%206.99935C4.66602%2010.221%205.71068%2012.8327%206.99935%2012.8327Z'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M2.875%202.95898C3.93063%204.01461%205.38896%204.66754%206.99978%204.66754C8.61062%204.66754%2010.069%204.01461%2011.1246%202.95898'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M11.1246%2011.0425C10.069%209.98691%208.61062%209.33398%206.99978%209.33398C5.38896%209.33398%203.93063%209.98691%202.875%2011.0425'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1267_9109'%3e%3crect%20width='14'%20height='14'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
What FDA 21 CFR Part 11 is, in one paragraph
FDA published 21 CFR Part 11 on 20 August 1997. It is the US rule that allows electronic records and electronic signatures to replace paper records and handwritten signatures with equivalent legal effect, provided the required controls are met. It is not a product certification and it is not industry-specific: it applies to records that an FDA predicate rule requires an organisation to maintain or submit, when those records are created, modified, maintained, archived, retrieved or submitted electronically.
Published 20 August 1997
Governs electronic records & signatures
Scope test — not by industry
Regulation, not a certification
The core controls Part 11 expects
Part 11 is short, but its requirements add up to a system built around identity, access, audit and retention. 01. Systems must be shown to perform as intended, with documented evidence, not just apparent function. 02. Complete, human-readable and electronic copies of records must be retrievable for review and copying. 03. Records stay protected and readily retrievable for the required retention period. 04. Only authorised individuals may access, sign or alter regulated records, per their authority. 05. Secure, computer-generated, time-stamped audit trails reconstruct who did what and when, including changes and deletions, without overwriting the original. 06. The signed record shows the signer's name, the date and time, and the meaning of the signature (review, approval, responsibility). 07. Signatures are bound to their records so they cannot be excised, copied or transferred to falsify another record by ordinary means. 08. Each signature maps to a unique individual; non-biometric signatures use at least two distinct identification components.
Part 11 terms that trip people up
A few definitions decide whether a workflow is in scope and how it must be controlled. Predicate rule. An FDA regulation that requires a record to be created or kept — for example GMP records or clinical trial records. Part 11 does not create record-keeping duties of its own; it sets how electronic records and signatures are handled when a predicate rule applies. Electronic record. Any combination of text, graphics, data, audio or other digital information created, modified, maintained, archived, retrieved or distributed by a computer system. Electronic signature. A computerised symbol, or series of symbols, adopted by a person as the legally binding equivalent of a handwritten signature. Digital signature. A cryptographic form of electronic signature — for example, based on a digital certificate. Part 11 defines it separately and does not require every electronic signature to be a digital signature. Closed vs open system. A closed system is one where access is controlled by the people responsible for the records; an open system is one where access is not. The required controls differ, and 11.30 adds requirements for open systems.
Why an ordinary e-signature is not automatically Part 11-ready
An ordinary e-signature answers whether a document was signed and by whom. Part 11 asks whether the whole electronic record chain stays trustworthy, attributable and reproducible under regulatory review. Four gaps usually separate the two. Audit trail. Everyday signing tools typically capture only the end result. Part 11 expects a complete, non-overwriting event chain: who did what, to which record, at what time and with what outcome, including administrative actions. Signature-to-record binding. A generic signature — an image, a stamp or a line of text — can be copied onto another document. Part 11 expects the signature to be inseparable from the record, so altering the signed content invalidates it. That needs cryptographic binding, not a pasted image. Identity proofing. Part 11 expects each signature to map to a unique individual, with at least two distinct identification components for non-biometric signatures and credentials used only by their owner. Shared accounts and signature-by-proxy fall outside this model. Validation and evidence. Part 11 starts from a validated system. Organisations must be able to produce requirements-to-test traceability, validation reports and deviation records, which depends on software-lifecycle documentation from the vendor.
Common questions about 21 CFR Part 11
No. Part 11 is a regulation, not a certificate. Software cannot be 'Part 11 certified' in a blanket sense. A vendor can supply controls and documentation, but the regulated organisation remains responsible for intended use, procedures, validation and ongoing governance.
How eSign.AI fits
eSign.AI provides electronic-signature and evidence capabilities that can be configured as part of a regulated workflow: signing meaning and manifestation, configurable signer verification and account controls, audit evidence, and API or workflow integration. Suitability still depends on the customer's intended use, applicable predicate rules, procedures, validation approach and retained evidence. Using eSign.AI does not by itself make an organisation Part 11 compliant — the regulated organisation remains responsible for the complete system, procedures, people and governance. eSign.AI completed a SOC 2 Type II attestation in 2025.
Quick Part 11 checklist
Five questions to answer before calling an electronic signing process Part 11-ready. Is the record covered by a predicate rule?. Name the rule, the record owner, the retention period and whether the electronic version is the one actually relied on. Is the system validated for intended use?. Confirm documented requirements, testing, deviations and change control proportionate to record risk. Does the audit trail reconstruct the event?. Check actor, time, action, previous value and outcome, and that history cannot be silently overwritten. Are signatures bound and manifested?. Verify name, date/time and meaning appear on the record, and that the signature cannot be moved to another record. Is identity unique and controlled?. Confirm one unique identity per signer, two identification components for non-biometric signatures, and credential ownership.
