21 CFR Part 11

21 CFR Part 11
Name	21 CFR Part 11
Jurisdiction	United States
Issued by	Food and Drug Administration
Effective	1997
Subject	Electronic records and electronic signatures

21 CFR Part 11 is a regulation established by the Food and Drug Administration that sets criteria for the acceptance of electronic records and electronic signatures in place of paper records and handwritten signatures. It affects regulated entities such as pharmaceutical firms like Pfizer, biotechnology companies like Amgen, medical device makers like Medtronic, and clinical research organizations including QuintilesIMS and ICON plc. The rule intersects with broader regulatory frameworks and standards referenced by organizations such as ICH and World Health Organization guidance.

Overview

The regulation was promulgated by the Food and Drug Administration to address the integrity, authenticity, and confidentiality of electronic records used by regulated firms including Johnson & Johnson, Roche, Novartis, and GlaxoSmithKline. It provides policy for regulated activities in contexts involving agencies such as the Centers for Disease Control and Prevention and programs like the National Institutes of Health where electronic data from systems built by vendors such as Oracle Corporation, SAP SE, Veeva Systems, and Microsoft may be used. The rule aligns with international expectations from entities like European Medicines Agency and interacts with standards produced by International Organization for Standardization and International Electrotechnical Commission.

Scope and Applicability

Part 11 applies to electronic records and electronic signatures used to meet requirements set by statutes and regulations enforced by the Food and Drug Administration, affecting manufacturing sites such as Eli Lilly and Company plants, contract manufacturers like Catalent, and clinical trial sponsors such as AstraZeneca. It is relevant for processes overseen by U.S. Department of Health and Human Services components, laboratories like Quest Diagnostics and LabCorp, and research institutions including Harvard University and Johns Hopkins University when FDA-regulated records are stored electronically. The rule distinguishes between systems used for regulated activities and those used for business functions by corporations like Bayer and Sanofi.

Key Requirements and Controls

Part 11 mandates controls including secure, computer-generated, time-stamped audit trails used by systems from vendors like Thermo Fisher Scientific, Siemens Healthineers, and GE Healthcare; procedures for access controls similar to Deloitte and PwC cybersecurity guidance; and use of electronic signatures with identity verification akin to practices at Goldman Sachs for authentication. Required elements include validation of system functionality practiced at labs such as Merck Research Laboratories, record retention policies followed by institutions like Mayo Clinic, and physical and logical security measures used by Lockheed Martin and Cisco Systems. The regulation emphasizes audit trail integrity alongside policies on data backup practiced by Amazon Web Services and IBM cloud services, and requires documentation practices seen in regulatory submissions to U.S. Food and Drug Administration centers and filings with entities like Securities and Exchange Commission when applicable.

Compliance and Validation

Validation under Part 11 requires demonstration that electronic systems perform as intended, a process commonly handled by life sciences quality teams at companies such as Biogen and Celgene and consulting firms like Ernst & Young and KPMG. Validation activities reference methodologies used in Good Manufacturing Practice programs, clinical data management techniques employed in trials run by GSK Clinical Trials and Pfizer Clinical Research, and testing frameworks similar to those used by National Institute of Standards and Technology. Documentation of validation often parallels submission packages seen in interactions with European Medicines Agency and regulatory dossiers prepared for Therapeutic Goods Administration processes.

Enforcement, Audits, and Inspection Findings

Enforcement actions and warning letters issued by the Food and Drug Administration have cited failures in Part 11 controls at firms including multinational corporations and smaller CROs, echoing inspection findings published after inspections involving entities such as Takeda Pharmaceutical Company, Bristol-Myers Squibb, and contract research organizations. FDA inspections may involve review teams from centers like Center for Drug Evaluation and Research and draw on audit procedures akin to those used by OIG audits. Historical enforcement has influenced industry practice and been discussed in forums attended by representatives from American Society for Quality, Regulatory Affairs Professionals Society, and academic centers like Massachusetts Institute of Technology.

Industry Implementation and Best Practices

Industry implementation of Part 11 is shaped by cross-sector best practices promulgated by groups including International Society for Pharmaceutical Engineering, Drug Information Association, and professional services firms such as McKinsey & Company. Best practices include risk-based approaches to validation favored by ICH guidance, integration with quality systems at firms like AbbVie and Novo Nordisk, and adoption of secure cloud architectures from providers like Google Cloud and Microsoft Azure. Training programs, standard operating procedures, and governance structures used by organizations such as U.S. Pharmacopeia and academic health centers like Stanford University School of Medicine support sustained compliance and continuous improvement.

Category:United States federal regulations