คู่มือปฏิบัติของ FDA 21 CFR Part 11 Electronic Signatures

ความเหมาะสม ความเชื่อถือ การประสบความสำเร็จตามที่วางแผน และความสามารถในการตรวจสอบหลักฐานที่ผิดปกติหรือถูกแก้ไข

การบันทึกการใช้ที่มีเอกสาร การประเมินความเสี่ยง ความต้องการ การทดสอบ การเกิดความแตกต่าง การอนุมัติ และการควบคุมการเปลี่ยนแปลงที่เหมาะสมต่อความเสี่ยงของหลักฐาน

สำเนาที่สมบูรณ์ต้องสามารถใช้เป็นที่เข้าถึงง่ายและทางเอกสารทางไฟฟ้าสำหรับการตรวจสอบและสำเนา

Export the signed record and associated evidence without losing content, meaning, signature data, or relevant event history.

Records must remain protected and readily retrievable for the required retention period.

Confirm retention ownership, search and retrieval, backup, migration, deletion controls, and access after a contract or account changes.

Access, signing, alteration, and regulated actions must be limited to authorised individuals.

Review account provisioning, role permissions, approval authority, segregation of duties, deactivation, and periodic access review.

Secure, computer-generated, time-stamped records should reconstruct actions that create, modify, or delete regulated records.

Check event coverage, time reference, actor attribution, previous-value preservation, exportability, retention, and protection from ordinary user alteration.

The signed record must show the signer's printed name, signing date and time, and the meaning of the signature.

Verify that review, approval, responsibility, or authorship is captured clearly and remains visible in human-readable output.

A signature must be linked to its record so it cannot be copied or transferred to falsify another record by ordinary means.

Test document integrity controls and confirm the evidence package binds the signer, action, time, and final record together.

Each signature must be unique to one person, identity must be verified, and non-biometric signatures require controlled identification components.

Map identity proofing, authentication, credential ownership, password or token controls, recovery, and misuse detection to the workflow's risk.

Workflows can capture the reason for signing together with signer and signing-event information, helping teams represent actions such as review, approval, or responsibility.

Configurable signer-verification and account-security options can support identity and access requirements. The selected method should be assessed against the workflow and the organisation's risk model.

Signing events, completion information, and supporting evidence can help teams reconstruct who acted, what was signed, and when the event occurred.

API and workflow integration can connect signing steps with quality, clinical, document-management, or business systems, while the organisation defines system boundaries and validation responsibilities.

Using eSign.AI does not by itself make an organisation or process Part 11 compliant. Compliance depends on the complete system, configuration, procedures, people, training, records, and ongoing governance.

Requirement: printed copies must show signature name, date/time, and meaning. eSign.AI implementation: every signed PDF includes a signature manifest page listing all signers, timestamps (UTC + local), and signing purpose. This is auto-generated and tamper-evident.

Requirement: electronic signatures must be linked to their electronic records so they cannot be excised, copied, or transferred. eSign.AI implementation: signatures are cryptographically bound to the document hash. Any modification after signing invalidates the signature. The audit trail records the document hash at signing time.

Requirement: two distinct identification components (e.g., user ID + password). eSign.AI implementation: supports dual-factor signing (email/password + SMS OTP, or SSO + KBA). For closed systems, the platform enforces session-based authentication combined with per-signature confirmation.

Part 11.10 requires validation, audit trails, system documentation, and access controls. eSign.AI provides: validated workflow templates, complete audit logs (60-80 events per signature), ISO 27001 certified infrastructure, role-based access control with custom roles and permissions, screen watermarking, and session management. The platform's audit log records who performed each action, when (with UTC timestamp), from where (IP and geolocation), and how (authentication method).

11.50 requires signature manifestations (name, date/time, meaning). 11.70 requires signatures to be linked to their records. 11.200 requires two identification components for non-biometric signatures. eSign.AI generates a signed signature manifest for every document, cryptographically binds signatures to document hashes, and supports dual-factor signing (SSO + per-signature OTP, or password + KBA).

In life sciences, Part 11 compliance is essential for clinical trial documents, batch records, laboratory data, and regulatory submissions. eSign.AI's FDA Part 11 module includes signing reason capture, hand-drawn signature styling, timestamp recording, and face recognition for signer identity verification — features specifically designed to meet FDA inspection requirements.