21 CFR Part 11: Scope and Application

21 CFR 11 mandates the conditions under which electronic records, including readouts from continuous environmental monitoring, must be generated and maintained to preserve and defend their accuracy and integrity. Core requirements include the use of closed, validated systems to generate, transfer, store and track electronic records. The system(s) must also automatically create and enable timely retrieval of time-stamped, records to enable audits.

Impacts and Requirements for Cleanroom Operators

Part 11 applies to cleanroom operators with process, production and/or quality systems involved in the digital collection, recording and retrieval of data. Original handwritten documents are excluded from Part 11 unless and until copied or transcribed into an electronic system.

  • All systems must be validated for their specific purpose and routinely re-validated to ensure ongoing compliance
  • Computers and databases must be sufficiently secure to prevent accidental or intentional tampering or fraud
  • The date and time of all entries should be recorded, along with personnel identifiers
  • Any data changes should be flagged as a potential source of error or fraud
  • The system should provide easy review of the metadata for each entry (personnel ID, time, date, etc.)

Part 11 is a US Federal Regulation to Ensure Electronic Records are Accurate and Trustworthy, it Covers:

Electronic Record Keeping – digital retention of quality/product records (e.g., batch records, customer compliant records, etc.)

Electronic Signatures – digital retention of quality/production approval records (two parts: public identifier and password/biometric data; equivalent to handwritten signatures)

Electronic Submissions – NDAs, 510(k)s, PMAs, etc. (quality/production records are considered legal documents equivalent to paper records)


Subpart B

Electronic Records


Subpart C

Electronic Signatures


Closed system(s) controls  


General requirements


Open system(s) controls  


Electronic signature components & controls


Signature manifestations  


Identification code(s)/password(s) controls


Signature/record linking      


Recent Modifications

2010 FDA releases Add-On Inspections to better understand how 21 CFR 11 was being implemented. Site inspections have since evolved to now cover Part 11-related issues

2007 FDA’s Guidance for Industry on computerized systems used in clinical investigations is released including internal safeguards for restricting access to computerized systems and implementing document change control and external safeguards to prevent unauthorized system/file access and data hacking

2003 FDA’s Guidance for Industry: Part 11 Scope and Application is released, clarifying several guidelines and narrowing the scope of regulation