In Force Checked October 24, 2026
FDA’s 2003 guidance narrowed how it enforces some provisions; the rule itself is unchanged.
What It Covers
The conditions under which FDA treats electronic records and electronic signatures as trustworthy and equivalent to paper and handwritten signatures.
Who It Applies To
Anyone keeping records required by FDA regulations in electronic form, or submitting them electronically — device, drug, and laboratory organizations alike.
Key Requirements
- Validated systems, with accurate and complete copies of records available for inspection (§11.10(a)–(b)).
- Secure, computer-generated, time-stamped audit trails of record changes (§11.10(e)).
- Access limited to authorized people, with authority and device checks (§11.10(d), (g), (h)).
- Signatures that show name, date, time and meaning, and are linked to their records (§11.50, §11.70), with controls on IDs and passwords (§11.300).
What an Auditor Asks to See
- The inventory of computerized systems holding regulated records, and their validation status.
- Audit trail configuration and evidence that audit trails are reviewed.
- User access lists and how they are maintained when people leave.
Where Systems Fall Short
- Spreadsheets used as regulated records with no controls at all.
- Audit trails switched on but never reviewed.
- Shared logins on laboratory instruments.
How QES Helps
An inventory of regulated systems sorted by risk, so validation effort goes where the records matter.
Related Standards
Sources. eCFR — 21 CFR Part 11 (opens in a new tab). Status checked October 24, 2026. This page summarizes 21 CFR Part 11; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.