21 CFR Part 11: Scope and Application



The FDA's 21 CFR Part 11 mandates the conditions under which electronic records, including readouts from continuous environmental monitoring, must be generated and maintained to preserve and defend their accuracy and integrity. Core requirements include the use of closed, validated systems to generate, transfer, store and track electronic records. The system(s) must also automatically create and enable timely retrieval of time-stamped, records to enable audits.

Impacts and Requirements for Cleanroom Operators

Part 11 applies to cleanroom operators with process, production and/or quality systems involved in the digital collection, recording and retrieval of data. Original handwritten documents are excluded from Part 11 unless and until copied or transcribed into an electronic system.

  • All systems must be validated for their specific purpose and routinely re-validated to ensure ongoing compliance
  • Computers and databases must be sufficiently secure to prevent accidental or intentional tampering or fraud
  • The date and time of all entries should be recorded, along with personnel identifiers
  • Any data changes should be flagged as a potential source of error or fraud
  • The system should provide easy review of the metadata for each entry (personnel ID, time, date, etc.)

Part 11 is a US Federal Regulation to Ensure Electronic Records are Accurate and Trustworthy, it Covers:

Electronic Record-Keeping – digital retention of quality/product records (e.g., batch records, customer compliant records, etc.)

Electronic Signatures – digital retention of quality/production approval records (two parts: public identifier and password/biometric data; equivalent to handwritten signatures)

Electronic Submissions – NDAs, 510(k)s, PMAs, etc. (quality/production records are considered legal documents equivalent to paper records)

 
Subpart B Electronic Records   Subpart C Electronic Signatures
11.10 Closed system(s) controls   11.100 General requirements
11.30 Open system(s) controls   11.200 Electronic signature components & controls
11.50 Signature manifestations   11.300 Identification code(s)/password(s) controls
11.70 Signature/record linking      

 

Recent Modifications

2010

FDA releases Add-On Inspections to better understand how 21 CFR 11 was being implemented. Site inspections have since evolved to now cover Part 11-related issues

2007

FDA’s Guidance for Industry on computerized systems used in clinical investigations is released including internal safeguards for restricting access to computerized systems and implementing document change control and external safeguards to prevent unauthorized system/file access and data hacking

2003

FDA’s Guidance for Industry: Part 11 Scope and Application is released, clarifying several guidelines and narrowing the scope of regulation