What does 21 CFR Part 11 actually require?

Part 11 requires that electronic records and electronic signatures be trustworthy, reliable, and equivalent to paper. Operationally, that means system validation, secure audit trails, unique user accounts and access controls, signature/record linkage that prevents tampering, and signature manifestations that show the signer's name, date, time, and the meaning of the signature (approval, authorship, review, etc.).

Do I need a Part 11-compliant e-signature tool if I am not in pharma?

Probably not. Part 11 applies when a record is created or modified under FDA predicate rules — pharmaceutical, medical device, biotech, and adjacent GxP scopes. If your contracts are commercial agreements, employment paperwork, or HR documents outside an FDA-regulated function, the relevant framework is ESIGN and UETA, not Part 11.

Is Part 11 a certification a vendor can claim?

No. The FDA does not "certify" software vendors. Part 11 compliance is something the regulated entity demonstrates through its own validation, change control, and operational discipline. A vendor can provide the technical controls and documentation, but the regulated customer is the one held accountable on inspection.

What is the difference between Part 11 and HIPAA?

Different scope, different authority. HIPAA covers protected health information (PHI) and the privacy/security rules around it; Part 11 covers electronic records and signatures in FDA-regulated activities. A clinical trial may be subject to both, but the controls are distinct — HIPAA is about PHI handling, Part 11 is about record integrity and signature attribution.

How long do I need to retain Part 11 audit trail records?

Part 11 itself does not fix a retention period — it defers to the predicate rule that governs the underlying record. Drug manufacturing batch records typically carry a 1-year-past-expiry / 5-year-past-distribution horizon; clinical trial records are retained at least 15 years post-approval; device design history files cover the life of the device plus 2 years. The audit trail retention should match or exceed the underlying record retention.

CFR Part 11 Compliance Guide: Requirements & Audit Evidence

21 CFR Part 11 is the FDA's regulation on electronic records and electronic signatures. It applies to any FDA-regulated entity — pharmaceutical manufacturers, medical device makers, biotech sponsors, CROs, and the software vendors that supply them — that keeps records the agency could inspect under predicate rules (21 CFR 211, 820, 58, and others). Part 11 is not a certification a vendor earns once; it is a set of technical and procedural controls your system has to enforce on every record, every signature, every retrieval, for as long as the record exists.

This guide is for QA, IT, and compliance leads who need to scope what Part 11 actually demands of their e-signature platform, what audit evidence the regulation expects you to produce on inspection day, and which failure modes get flagged in 483s. It is general regulatory information, not legal advice — the final scope of your controls should be reviewed by your regulatory affairs and quality teams.

The four control families Part 11 actually tests

Part 11 organizes its requirements into a handful of control families. Treat these as the test plan an FDA inspector will run against your system — and the structure your SOPs should mirror.

Control family	What Part 11 § requires	What evidence looks like
Validation (§ 11.10(a))	System validation "to ensure accuracy, reliability, consistent intended performance"	IQ/OQ/PQ protocols, change-control records, periodic review
Audit trail (§ 11.10(e))	Secure, computer-generated, time-stamped audit trail for creation, modification, deletion	Tamper-evident event log retained for record life
Access control (§11.10)	Authority checks, unique IDs, credential management	Role matrix, JML tickets, MFA logs
E-signatures (§11.50–100)	Intent, attribution, record/signature linking	Consent log, identity check, signed-record hash

If your vendor can produce current, readable evidence in all four families on demand, you have a fighting chance on inspection day. If any one of them is a manual export stitched together from logs in three places, that gap will show up.

What Part 11 means for your e-signature workflow specifically

E-signatures land on Part 11's desk through § 11.50 (signature manifestations), § 11.70 (signature/record linking), and § 11.200 (the two distinct components of any e-signature: identification + meaning). For each signature your system captures, it must record:

Signer name, date, and time that appear on the signed record itself (printed equivalent).
Meaning of the signature — who approved, who reviewed, who authored — embedded in the signature, not buried in a separate SOP.
Linkage between the signature and the record such that the signature cannot be excised, copied, or transferred to falsify another record.
Identity verification sufficient to prevent impersonation: at minimum unique credentials, increasingly MFA for high-impact records.

The auditor's first question is almost always: "Show me a record from 2019 and walk me through every change made to it." If the audit trail cannot answer that for one record, it will not pass for ten.

Audit evidence: what you actually need to retain

The retention question trips up a lot of teams because Part 11 does not give a fixed retention period — it defers to the predicate rule for each record type. The practical implication is that Part 11 records have to outlive the underlying product or study record, which for pharmaceuticals means decades. Build your retention posture around that horizon.

Record type	Typical retention horizon	Why
Clinical trial e-signatures	15+ years post-trial completion (ICH E6 GCP)	Section 8 of ICH E6(R3) and 21 CFR 312.62
Drug manufacturing batch records	1 year after expiry / 5 years after distribution (whichever longer)	21 CFR 211.180
Device design history file	Life of device + 2 years	21 CFR 820.180
Audit trail events	Life of record + 2 years	Part 11 § 11.10(c)
Signature manifests	Life of record	Part 11 § 11.50

A safe default is to retain the signed PDF, the audit trail export, and the validation packet for the same period as the underlying record, plus a margin. Vendors that offer immutable WORM storage (write once, read many) or exportable bundles that lock at signing time simplify this posture considerably.

The recurring 483 findings on Part 11

A quick read of FDA warning letters from the last five years surfaces a small set of patterns that recur. None of them are exotic — they are exactly the controls teams forget when they bolt an e-signature tool onto a paper process.

Inadequate audit trail review. Part 11 § 11.10(e) requires review of audit trails; an inspector will ask to see your SOP for that review and the records showing it happened. Storing the trail without a documented review cadence is the most common finding.
Shared accounts. A lab manager's badge lets four technicians sign under the same identity. Unique user IDs (§ 11.10(d), 11.100(a)) are non-negotiable; SSO with group accounts fails this test on contact.
No signature/record linkage proof. The signed PDF has a signature image, but the audit trail cannot prove the document has not been swapped or modified after signing. A server-side hash captured at completion is the standard defense.
Validation gaps. Computer system validation was done at deployment and never revisited. § 11.10(a) requires periodic review — change-control tickets and a revalidation log close this gap.
Weak consent-to-esign. Part 11 § 11.100(c) requires the signer to certify that the electronic signature is the legally binding equivalent of their wet signature. A single "I agree" checkbox at signup does not satisfy this if it is not repeated at each signing or bound to the record.

If your program is being audited, the fastest risk reduction is to tighten those five items first. Each is a known inspection target.

How to evaluate a vendor for Part 11 readiness

Vendor diligence under Part 11 is heavier than a generic SOC 2 review. The table below maps the questions you should be able to answer before signing an MSA.

Question	What good evidence looks like
Current Part 11 attestation?	Independent auditor letter, not self-declaration
Validation docs (IQ/OQ/PQ)?	Current, version-controlled, periodic review
Audit trail generation and protection?	Server-side, hash-chained or append-only
Identity controls required for signing?	SSO + MFA, configurable per record type
Immutable storage for audit trail?	WORM bucket, hash-sealed exports
Record retrieval §11.10?	Single-call export of PDF + trail + consent
Change-control and incident posture?	Documented SOPs, customer-visible incident log

A vendor that answers all of these with documentation you can review is materially less risky than one that answers with marketing copy. The same diligence frame is why we cover audit trail design as a product decision — the controls have to ship with the platform, not be added in audit response. For teams moving from a paper-heavy validation process, How to Make an Electronic Signature the Safe Way is the procedural complement to this diligence frame, and Are Electronic Signatures Safe for Business Agreements? frames the broader evidentiary question. Once you have a candidate vendor, DSC filing documents and workflow checklist covers the supporting records many Part 11 programs need to track alongside the audit trail.

Building the bridge from Part 11 to broader GxP

Part 11 does not stand alone. It overlays the predicate rules — cGMP for drugs (21 CFR 210/211), quality system regulation for devices (21 CFR 820), GLP for preclinical studies (21 CFR 58). A signature on a batch production record touches all three. So when you scope a Part 11 program, you are really scoping a records-management program that satisfies all the predicate rules simultaneously.

Practical sequencing for a mid-sized QA team:

Map every record type that moves through your e-signature workflow to its predicate rule and retention horizon.
Validate the system against the highest-stakes record type first. Validation evidence carries over to lower-stakes records.
Configure role-based access, MFA thresholds, and audit-trail review cadence by record type — not globally.
Document the SOPs for periodic review, change control, and incident response before the first inspection, not after.
Rehearse a record retrieval with QA, IT, and regulatory in the room. The first time should not be inspection day.

That sequence is what we have seen work across Nota Sign's regulated customers; it is not the only way, but it is the most common path that gets a team through an inspection without surfacing a 483.

Disclaimer

This article summarizes 21 CFR Part 11 and adjacent regulatory expectations in general terms. It does not constitute legal or regulatory advice, and it does not guarantee compliance with FDA, EMA, or any other authority. Validation scope, retention, and identity controls depend on your specific records, products, and predicate rules — your regulatory affairs and quality teams should review the final configuration.

Run FDA-Regulated Signing on Nota Sign

For FDA-regulated teams, the platform choice is not just about whether an e-signature is legal — it is whether the system can produce audit-ready evidence on demand. Nota Sign, FaDaDa's global e-signature platform, supports Part 11-style controls in regulated deployments: server-side audit trails, hash-sealed exports, SSO with MFA, role-based access tied to record class, and immutable storage for signed artifacts and audit-trail bundles. Teams running GxP-adjacent workflows (clinical trials, device design history, validation protocols) can stand up signing without bolting on a separate validation layer.

The pricing structure matters here too. Because headcount does not move the invoice at Nota Sign, QA reviewers, regulatory observers, and validation contractors can be looped in without the seat-count crossing a procurement threshold mid-trial. Mid-market and enterprise buyers with Part 11 workloads can request plans tailored to their validation cadence and retention horizon. If you are scoping a Part 11 deployment or auditing an existing one, request a working session with our regulated-industries team — we will walk through your record types and the evidence each one requires.