21 CFR Part 11 is the FDA regulation that decides whether an electronic record or electronic signature can legally replace a paper one in a regulated life science study. For MedTech and pharma teams planning clinical trials or supplying data to sponsors, getting this right isn’t optional: it determines whether your trial data will hold up to FDA inspection.
This guide breaks down what Part 11 actually requires, who it applies to, and what a 10-point compliance checklist looks like in practice for clinical trial teams.
In short
- What is it? Part 11 of Title 21 of the Code of Federal Regulations (21 CFR Part 11) is the FDA regulation that sets out when electronic records and electronic signatures can be considered trustworthy, reliable, and equivalent to paper records and handwritten signatures.
- Insights from 2026 and beyond: FDA’s ongoing modernisation of inspection practices (e.g. increased use of remote/records-based inspections) makes audit-ready electronic systems — not paper printouts — the practical baseline for sponsors and CROs.
- How it is used in clinical trials: In a clinical trial, Part 11 governs the eCRF entries, audit trails, and electronic signatures used to capture and approve trial data, from a site coordinator entering a patient’s vital signs to a Principal Investigator electronically signing off a case report form. If a sponsor or CRO stores trial records electronically instead of on paper, or submits data to the FDA electronically, those records fall under Part 11.
- Who is Ledidi? Ledidi is a Norwegian software company founded by academic surgeons and software engineers. We provide a unified, secure cloud platform, comprising Ledidi Core, Ledidi Trials, and Ledidi Registries, that integrates data capture, real-time analytics, and global collaboration.
What is 21 CFR Part 11?
21 CFR Part 11 is Part 11 of Title 21 of the Code of Federal Regulations. It establishes the US Food and Drug Administration’s (FDA) regulations on electronic records and electronic signatures. Though developed in the US, all life science companies including pharma and MedTech that create, maintain, or submit records electronically under an FDA regulation become subject to Part 11.
"Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirements set forth in Agency regulations. […] Part 11 also applies to electronic records submitted to the Agency under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, even where those records aren’t specifically named in Agency regulations."
The underlying requirements in those other laws and regulations — for example the Good Manufacturing Practice regulations (21 CFR Part 211), the Quality System regulation (21 CFR Part 820), and the Good Laboratory Practice regulations (21 CFR Part 58) — are referred to by the FDA as predicate rules.
Part 11 sits on top of these: it doesn’t create new recordkeeping obligations, it defines when you’re allowed to meet an existing predicate-rule obligation electronically instead of on paper.
What this means in practice
In practice, Part 11 exists to establish an FDA-compliant, digital Quality Management System (QMS). Replacing paper-based documentation with electronic records and e-signatures is an essential part of this shift.
The FDA’s stated purpose for the regulation, issued in final form in March 1997 and effective from 20 August 1997 is:
"To permit the widest possible use of electronic technology, compatible with FDA’s responsibility to protect the public health."
In other words: Part 11 is designed to enable digital transformation in regulated industries, not obstruct it, provided the integrity and security of the records is protected.
Also read: Guide to eCRFs in clinical trials
What do the 21 CFR Part 11 guidelines apply to?
Per the FDA’s own scope guidance, Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, transmitted, or submitted under any records requirements set forth by FDA regulations.
The FDA has clarified that it interprets this scope narrowly. In practice, this means:
- Records required to be maintained under a predicate rule and kept in electronic format in place of paper are Part 11 records.
- Records not required to be retained under a predicate rule, but which a company chooses to keep electronically anyway, are not automatically Part 11 records.
- Records required under a predicate rule that are kept in electronic format in addition to paper, and that are actually relied on to perform regulated activities, are Part 11 records even if a paper printout also exists.
- Records submitted to the FDA electronically under a predicate rule fall under Part 11.
- Electronic signatures intended to be the equivalent of a handwritten signature, initial, or other required signing (for example, marking a record as approved, reviewed, or verified) are Part 11 signatures.
Who do the guidelines apply to?
- Pharmaceutical companies
- Medical device manufacturers
- Biotechnology companies
- Biologics developers
- Contract research organisations (CROs)
- Contract manufacturing organisations (CMOs)
- Clinical laboratories
- Other FDA-regulated industries
Implications for life science companies regulated by 21 CFR Part 11
Companies subject to Part 11 need to implement controls including:
- Audits
- System validation
- Audit trails
- Electronic signatures
- Documentation for software and systems involved in the processing of electronic data
Importantly, the FDA’s application guidance clarifies that it exercises enforcement discretion on some of these — specifically validation, audit trail, record retention, and record-copying requirements — while continuing to fully enforce others. The FDA states it will still enforce, among other things:
- Limiting system access to authorised individuals
- Use of operational system checks
- Use of authority checks
- Use of device checks
- Confirming that people who develop, maintain, or use electronic systems have the education, training, and experience to do so
- Written policies that hold individuals accountable for actions taken under their electronic signature
- Appropriate controls over systems documentation
- Controls for open systems corresponding to the closed-system controls above
- All electronic signature requirements (§§ 11.50, 11.70, 11.100, 11.200, and 11.300)
This nuance matters for anyone building a compliance programme: it’s not “everything in Part 11, all the time” — it’s a combination of enforced Part 11 controls and the underlying predicate-rule requirements, which remain fully in force regardless.
Contents in the regulation
Subpart A: General provisions
- Scope
- Implementation
- Definitions
Subpart B: Electronic records
- Controls for closed systems
- Controls for open systems
- Signature manifestations
- Signature and record linking
Subpart C: Electronic signatures
- General requirements
- Electronic signatures and controls
- Controls for identification codes and passwords
FDA 21 CFR Part 11 Checklist: 10 requirements for pharmaceutical and MedTech teams
The FDA’s regulation sets out specific controls for closed systems used to create, modify, maintain, or transmit electronic records. Based directly on the FDA’s guidance and regulation text, here is a 10-point checklist for evaluating whether a system supports Part 11 compliance.
1. System validation
Any systems used to create, modify, maintain, or transmit regulatory information must be validated, meaning there must be documented evidence for the system validation. Thus, organisations must demonstrate that the system performs as intended.
2. User access control
The system must only permit access to authorised personnel. In practice, this translates to each team member having their own unique login as well as system permissions that reflect their role in the organisation.
3. Audit trails
All electronic records have a secure, time-stamped audit trail. These audit trails are a valuable tool for investigating breaches or human errors in the system as they document what changes were made, by whom, and at what time.
4. Electronic signatures
Just as each individual in the organisation has their own login, they should also have their own electronic signatures that are unique to them. They must be integrated and synchronised with their records and any actions made in the system.
5. Data backup and protection
The integrity and security of data are of the utmost importance. Having protocols in place for protecting it against unauthorised changes, loss or corruption is vital. For that reason, organisations must ensure backups, have system redundancies, and define security protocols.
6. Standard operating procedures (SOPs)
Building on the points above, organisations should implement clearly defined, standard procedures for using, maintaining, and securing 21 CFR Part 11 systems. Staff should get proper training in how to execute these SOPs.
7. Employee training
Personnel should receive the necessary training whenever systems are updated, workflows change, or a routine is breached, and all training should be logged in a training record.
8. Change control
Changes in workflows or routines must be formally structured in a control process. Such a process should also include system updates and configuration adjustments.
9. Record retrieval and copies
All records must be electronically copied and stored for FDA review upon request. This includes audit trails, signature information, and training records.
10. Long-term archiving
Finally, there should be a defined plan for how and where to archive electronic records. Archiving strategies should ensure the accessibility, readability, and security of data.
Decoding the contents: Why does 21 CFR Part 11 compliance matter for pharma and MedTech?
To successfully sell a medical device in the US, medtech innovators must navigate the Food and Drug Administration (FDA) compliance process, which serves as a major barrier to entry. Companies can transform this compliance hurdle into a competitive advantage by shifting from a reactive “checkmark” mentality to a proactive, data-driven strategy with the right software and ways of working.
| Data Practice | Implementation Strategy | Impact on Compliance & Market Entry |
|---|---|---|
| Digitized records | Move away from paper or siloed spreadsheets to a unified, cloud-based platform. | Ensures real-time data integrity, simplifies version control, and accelerates audit preparation. |
| Data traceability | Establish a digital thread linking user needs, design inputs, risk assessments, and verification tests. | Allows teams to instantly prove to regulators how a design change impacts patient safety. |
| Automated data capture | Use automated laboratory and manufacturing software to log testing outputs. | Eliminates human data-entry errors and prevents the fabrications or gaps that trigger FDA warning letters. |
| Unified data standards | Adopt global data models and prepare early for Unique Device Identification (UDI) tracking. | Speeds up the submission review process as regulators can easily parse and analyse your data sets. |
Apart from regulatory alignment, adhering to 21 CFR Part 11 requirements is crucial for data reliability and integrity. Non-compliance risk isn’t abstract: it can mean FDA warning letters, delayed submissions, or trial data being challenged or excluded during an inspection. For a MedTech company generating PMCF (post-market clinical follow-up) evidence, or a pharma sponsor building a submission dataset, that risk sits directly on the study timeline and cost.
Benefits
- Increased data confidentiality, integrity, and accessibility
- More paperless environment
- Faster information exchange
- Increased cost savings from reduced storage space
- Reduced errors
Digital security and compliance in Ledidi Trials
Ledidi Trials has officially launched as a dedicated, specialised module for GxP-regulated trials. This serves as the primary software for regulatory clinical trials, designed for MedTech, biotech, and Clinical Research Organisations (CROs).
Ledidi Trials was independently audited and confirmed audit-ready in January 2026 by Thomas Pauly CISA / DHC, verifying compliance with key regulatory expectations, including FDA 21 CFR Part 11, ICH GCP E6 (R3), and ISPE GAMP 5.
Watch: Realise your clinical trial design with us
With Ledidi, a research group can run a clinical registry on Ledidi Registries and a manufacturer-sponsored clinical trial on Ledidi Trials within the same secure environment. This can be done without migrating data or retraining staff.
Watch more videos of Ledidi in practice
How Ledidi can benefit your compliance programme
Ledidi brings EDC, clinical data management, and registry capabilities into one connected, validated environment rather than three separate systems, reducing the number of points where compliance can break down. Study teams design eCRFs themselves using an AI study builder, so forms can mirror the actual clinical workflow instead of forcing investigators into a generic template that risks data quality or protocol deviations.
Because Ledidi Trials, Core, and Registries share the same secure environment, a research group can move between a clinical registry and a GxP-regulated, manufacturer-sponsored clinical trial without migrating data or retraining staff. For MedTech teams running PMCF or post-market studies, and for pharma or CRO teams needing GxP-regulated trial support, this means faster study start-up, direct ownership of trial data, and a platform built to stay inspection-ready throughout the trial lifecycle.
About Ledidi
Ledidi is a Norwegian software company founded in 2016 by two academic surgeons and three software engineers with extensive expertise in system architecture and cloud computing.
Frequently asked questions
What does 21 CFR Part 11 stand for?
21 CFR Part 11 stands for Part 11 of Title 21 of the Code of Federal Regulations. It’s the FDA regulation that governs when electronic records and electronic signatures can be treated as equivalent to paper records and handwritten signatures, for organisations subject to FDA predicate rules.
Is 21 CFR Part 11 still in effect?
Yes. The FDA’s 2003 guidance confirms Part 11 “remains in effect” even where the Agency exercises enforcement discretion on specific requirements (validation, audit trails, record retention, record copying) during its ongoing re-examination of the rule.
What is a “predicate rule” under 21 CFR Part 11?
A predicate rule is the underlying FDA regulation or statute (e.g. GMP, QSR, GLP requirements) that already requires a record to be kept or submitted; Part 11 governs whether that record can be kept electronically instead of on paper.
Does 21 CFR Part 11 compliance software guarantee compliance?
No single piece of software can guarantee compliance on its own. Software can provide the audit trails, access controls, and e-signature functionality Part 11 expects, but responsibility for system validation and intended use remains with the regulated organisation itself.
Sources
- FDA: Guidance for Industry. Part 11, Electronic Records; Electronic Signatures – Scope and Application (CDER, CBER, CDRH, CFSAN, CVM, ORA, August 2003)
- National Archives: eCFR :: 21 CFR Part 11 – Electronic Records; Electronic Signatures
