When Part 11 may apply
Assess whether electronic records are maintained or submitted under applicable FDA record requirements, and how the organization relies on those records. An electronic system or a GxP label alone is not the full scope determination.
Check the practical controls
| Area | What to establish |
|---|---|
| Electronic records | The authoritative record, its meaning, accuracy, completeness and retrievability |
| Electronic signatures | Signer identity, meaning, date/time and linkage to the correct record |
| Audit trails | Relevant changes are recorded, protected and available for appropriate review |
| Access controls | Authorized users can perform only the actions assigned to their roles |
| Record retention | Records remain readable and retrievable for the applicable retention period |
Worked example
Example
Worked exampleFictional example. An eQMS exports an approved CAPA. Verify that the export preserves the record revision, signer identity, date/time and signature meaning. A picture of a signature is not, by itself, evidence that all applicable controls work.
Use the detailed Part 11 guide for regulatory scope and provisions; use your quality procedures to define implementation and review responsibilities.
Detailed practice, examples and references
Start with the record and its purpose
Identify which information is needed to reconstruct the regulated activity: data, metadata, relationships, approvals, and relevant history. Then identify the applicable record obligations. FDA’s Part 11 scope guidance explains the relationship between electronic records and underlying record requirements, often called predicate rules. Applicability requires evaluation of the actual record and use. FDA Part 11 scope guidance ↗
Worked example
Example 1: A result without its context
A migrated result says “Pass,” but the unit, method revision, original measurement, and approval context are missing. The migration preserved a label, not necessarily enough information to understand the decision. Define the complete record before designing the export.
Worked example
Example 2: An audit trail that is difficult to review
The system captures every technical event but cannot easily distinguish a changed acceptance limit from routine session activity. Reviewers may struggle to find meaningful changes. Design review around relevant events, responsible roles, access to underlying records, and timely handling of exceptions.
Worked example
Example 3: A signature copied into a PDF
A picture of a signature on an exported report does not by itself demonstrate who signed, what they signed, or how the signature remains associated with the record. Examine the original approval information, record version, signing meaning, identity controls, and export behavior.
Useful challenges
Change a controlled value through each authorized path. Try an unauthorized path. Check whether the history identifies the event and preserves the information required by the applicable process. Retrieve the record after an update. Confirm a reviewer can determine what version was approved. Check whether privileged administration can undermine the intended controls.
Completed review note — fictional: “The export contains the approved record, version identifier, approval identities, approval times, and signing meanings. The relationship between the export and source record was checked using the retained record identifier. Detailed change history remains accessible in the controlled archive and is included in the retention plan.”
Whether that arrangement is adequate depends on the applicable obligations, retrieval needs, and verified system behavior. A feature called “Part 11 mode” does not complete that assessment.
Common Part 11 and data-integrity records
The validation package may include a Part 11 applicability assessment, electronic-record and electronic-signature assessment, data-flow or record map, access-control matrix, audit-trail assessment, audit-trail review procedure, retention and archival requirements, backup and restore evidence, and accurate-copy verification. Link each control to the predicate-rule record and actual electronic reliance rather than treating Part 11 as a generic software checklist.
Practitioner guidance by Sandip Thorat · Simplified 17 September 2026. Apply the requirements and approved procedures relevant to your system. Report a correction.
Questions and discussion
Ask a question or share a perspective. Contributions are reviewed before publication.
Loading contribution options…