FDA 21 CFR Part 11 Applicability Assessment: Definition, Steps, and Compliance

FDA 21 CFR Part 11 is a U.S. regulation issued by the Food and Drug Administration (FDA). FDA 21 CFR Part 11 defines the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records and handwritten signatures.

The FDA 21 CFR Part 11 applicability assessment is a structured process that can be used by FDA-regulated companies to determine whether electronic records or electronic signatures fall under Part 11 requirements.

The FDA 21 CFR Part 11 applicability assessment is useful in helping organizations comply with Part 11 by clearly identifying which computerized systems are subject to regulation. The applicability assessment enables the application of necessary controls to support data integrity, security, and traceability.

The main steps of the FDA 21 CFR Part 11 applicability assessment include the applicability determination, the electronic records assessment and conclusion, the electronic signatures assessment and conclusion, and the determination of the computer system validation approach.

Important factors to consider during the applicability assessment include predicate rule requirements, the system’s intended use and regulatory impact, validation needs, system type, record authenticity and retention, and staff training.

To ensure compliance with FDA 21 CFR Part 11, companies must establish a robust Quality Management System (QMS), enforce data integrity, maintain audit trails, conduct regular system reviews, and stay up to date with regulatory changes.

SimplerQMS is an electronic Quality Management System (eQMS), tailored for life science industries. SimplerQMS meets 21 CFR Part 11 requirements through built-in technical and operational controls, offering audit trails, secure electronic signatures, role-based access, version-controlled documentation, and standardized workflows, among others.

What is the FDA 21 CFR Part 11 Applicability Assessment?

An FDA 21 CFR Part 11 applicability assessment is the process used to determine if electronic records and electronic signatures managed within a computerized system are subject to Part 11 requirements. The FDA 21 CFR Part 11 applicability assessment ensures compliance by identifying systems, records, and signatures that fall under the regulation.

The purpose of the Part 11 applicability assessment is to clarify the Part 11 requirements applicable to a given system. Part 11 applicability assessment guides the implementation of compliance controls, including audit trails, access management, data integrity, and security measures.

The applicability assessment is typically performed by a cross-functional team. The cross-functional team usually includes members from Quality Assurance (QA), Information Technology (IT), and process owners. QA defines and interprets the regulatory requirements. IT evaluates system functions and technical capabilities. The process owner, such as a Lab Manager for a Laboratory Information Management System, provides operational input.

Key outcomes of the applicability assessment include documented evidence of whether Part 11 applies, justification of the validation approach, and identification of the controls required. Part 11 applicability assessment may support building and maintaining an inventory of computerized systems subject to regulatory oversight.

What Are the Steps in an FDA 21 CFR Part 11 Applicability Assessment?

The steps of the FDA 21 CFR Part 11 applicability assessment are outlined below.

1. Determine if 21 CFR Part 11 Applies: Assess whether the organization is FDA-regulated and if the computerized system captures, modifies, or stores data required by FDA regulations.
2. Conduct 21 CFR Part 11 Electronic Records Assessment: Examine whether the system creates, modifies, maintains, archives, retrieves, or transmits electronic records. Identify if these records must be retained under FDA predicate rules, if the electronic version is the official record for decision-making, and if the system is open or closed.
3. Conclude on 21 CFR Part 11 Electronic Records Assessment: Document the conclusion of whether the system’s electronic records are subject to Part 11 requirements and specify the controls needed.
4. Conduct 21 CFR Part 11 Electronic Signatures Assessment: Assess whether the system uses electronic signatures, if signatures are required under predicate rules or internal procedures, and whether the electronic signature replaces a handwritten signature.
5. Conclude on 21 CFR Part 11 Electronic Signatures Assessment: Determine the applicability of electronic signatures clauses and document the compliance controls required.
6. Determine Computer System Validation Approach: Determine what predicate rule requirements apply to the validation of the computer system and the system’s impact on the integrity, availability, and authenticity of required records and signatures.

1. Determine if 21 CFR Part 11 Applies

The determination of Part 11 applicability aims to assess whether the computerized system could fall within the scope of FDA 21 CFR Part 11. The determination of Part 11 applicability involves analyzing the organization’s regulatory status and the type of data the system manages to decide if Part 11 requirements are relevant.

The key questions that will guide the determination of 21 CFR Part 11 applicability are the following.

• Is the company an FDA-regulated company?
• What data does this system capture, modify, or store?
• Is this data required by FDA regulations?

In 21 CFR Part 11, clauses 11.1(b) and 11.2 define when the regulation applies, while clauses 11.1(f)-(p) describe exclusions.

The applicability assessment must proceed if the company is FDA-regulated, such as a drug manufacturer under Parts 210-211, a medical device manufacturer under Part 820, or a non-clinical laboratory under Part 58, and the system generates or maintains records required by these FDA regulations. Specific clauses of Part 11, such as Subpart B clauses in the case of electronic records handled in the system, should then be identified to determine compliance obligations.

2. Conduct 21 CFR Part 11 Electronic Records Assessment

The 21 CFR Part 11 electronic records assessment determines whether records handled by the computer system fall under the scope of Part 11. The electronic records assessment step includes reviewing how the system generates, modifies, stores, or transmits records and whether those records are required for regulatory purposes.

The key questions to determine if the electronic records must comply with Part 11 are listed below.

• Is the computer system used to create, modify, maintain, archive, retrieve, or transmit records in electronic form?
• Are the electronic records created or maintained by the computerized system required to be retained by any FDA predicate rule?
• Is the electronic version of the record considered the official record, or maintained for regulated activities?
• Is the computer system open or closed?

Part 11 clause 11.1(b) specifies that records in electronic form used to meet FDA requirements must comply with Part 11.

The requirements of Part 11 Subpart B apply if the system generates or maintains official regulated records electronically. Afterward, it must be determined whether the system is classified as open or closed, since open systems have additional requirements, including document encryption and use of appropriate digital signature standards, to ensure record authenticity and security.

3. Conclude on 21 CFR Part 11 Electronic Records Assessment

The conclusion of the electronic records assessment confirms whether the system meets the requirements of Part 11 for electronic records or if compliance gaps exist.

The following questions may be used to verify the presence of operational and technical controls that ensure the authenticity, integrity, and availability of electronic records.

• Can the system generate accurate and complete copies of records?
• Are the records securely archived throughout their retention period?
• Does the system have an audit trail?
• Does the system have security and access controls?
• If the system is open, does it use document encryption and appropriate digital signature standards?

Part 11 Subpart B establishes the requirements for electronic records. In the event that the system does not comply with Subpart B requirements, a remediation plan with appropriate Corrective Actions and Preventive Actions (CAPAs) shall be initiated to ensure compliance.

4. Conduct 21 CFR Part 11 Electronic Signatures Assessment

The objective of evaluating electronic signatures is to verify whether their use within the system falls within the scope of Part 11.

The main questions that identify whether electronic signatures are subject to Part 11 requirements are given below.

• Does the system use electronic signatures to sign records?
• Does the predicate rule or internal procedure require a signature on this specific record?
• Is an electronic signature being used instead of a handwritten signature?

If electronic signatures are applied to regulated records in place of handwritten ones, the system must comply with Part 11 Subpart C requirements to ensure authenticity, accountability, and traceability.

5. Conclude on 21 CFR Part 11 Electronic Signatures Assessment

The conclusion of the electronic signatures assessment aims to ensure that the requirements of Part 11 Subpart C are addressed.

Below are some key questions to determine whether the computerized system complies with Part 11 requirements.

• Is the electronic signature permanently linked to the respective record?
• Is the name of the signer, the time, the date, and the meaning (e.g., review, approval) clearly indicated?
• Is each electronic signature unique to one individual?
• Are identification controls in place?
• Are there controls for password management?

Any gaps identified during this step should be remediated before the system can be confirmed as compliant with Part 11 electronic signature requirements.

6. Determine Computer System Validation Approach

Determining the appropriate computerized system validation approach ensures that the system validation meets FDA expectations and supports consistent, reliable performance, including the ability to detect invalid or modified records. Assessing the computerized system validation approach requires analyzing the system’s role in regulated processes and its potential impact on product quality, patient safety, and data integrity. The justification for the selected validation approach should be supported by a documented risk assessment.

Below are the main questions to determine if a computer system must be validated.

• What predicate rule requirements are in place regarding the validation of the computer system?
• What is the potential impact of the system on the integrity, availability, and authenticity of required records and signatures?
• Does the computer system have a direct or indirect impact on patient safety, product quality, or data integrity?

Part 11 clause 11.10(a) requires validation to ensure accuracy, reliability, consistent intended performance, and the ability to detect invalid or altered records. Part 11 clause 11.1(e) states that computer systems, controls, and documentation must be available for FDA inspection. Part 211, clause 211.68 requires reliable system performance and accurate input/output. Part 820, clause 820.70(i) explicitly requires computer system validation for medical device manufacturers.

The computer system must be validated to demonstrate reliable performance and suitability for intended use if it supports FDA-regulated processes and affects product quality, patient safety, or data integrity.

What Factors Should You Consider During the FDA 21 CFR Part 11 Applicability Assessment?

The main factors that a company should consider during the FDA 21 CFR Part 11 applicability assessment are listed below.

• Predicate Rule Requirements: Evaluate whether the system manages records mandated for retention under FDA predicate rules, such as Parts 58, 210–211, or 820.
• Intended Use and Reliance: Confirm if the software is used in an FDA-regulated process, such as medical production or pharmaceutical quality control.Determine if the organization relies on the system’s electronic records or signatures as the official, authoritative source for regulatory decisions and compliance activities.
• Electronic Records Management: Verify whether the system creates, modifies, stores, or transmits electronic records that must comply with Part 11 Subpart B.
• Electronic Signature Functionality: Assess whether the system applies electronic signatures in place of handwritten ones and if those signatures meet Subpart C requirements.
• System Type (Open vs. Closed): Identify whether the system is open or closed, as open systems require additional controls.
• Document Control and Data Integrity Requirements: Review how the system manages version control, audit trails, and secure storage and archiving of records.
• Impact on Regulated Process: Assess whether the system influences product quality, patient safety, or data integrity in an FDA-regulated process.
• System Validation Requirements: Confirm system validation requirements to ensure accuracy, reliability, and suitability for its intended use, based on its GxP role and Part 11 requirements.
• Training and Personnel Requirements: Ensure that staff using and managing the system are properly trained and that responsibilities for system management and compliance are clearly defined and assigned.

What Should You Do After Completing the FDA 21 CFR Part 11 Applicability Assessment?

After completing the FDA 21 CFR Part 11 applicability assessment, the following steps should be taken.

1. Document and Approve the Assessment Outcome: Create a written and auditable record of the applicability assessment and secure approval from responsible personnel.
2. Conduct a Gap Analysis and Risk Assessment: Identify compliance gaps against Part 11 requirements and evaluate associated risks to product quality, patient safety, and data integrity.
3. Develop a Detailed Remediation Plan: Outline corrective actions, timelines, and responsibilities to address identified gaps.
4. Perform Computer System Validation: Validate the computerized system, as per the assessment conclusion.
5. Implement Security and Access Control Measures: Apply role-based access, password controls, and authentication procedures to restrict access to authorized users.
6. Activate Audit Trails: Enable audit trail functionality to capture who performed each action, when it occurred, and what was changed.
7. Establish Standard Operating Procedures: Develop SOPs describing system use, personnel responsibilities, access privileges, and security controls.
8. Train Relevant Personnel: Ensure staff are trained on Part 11 requirements, the system use, and SOPs to maintain compliance in daily operations.

How Can Your Organization Ensure Ongoing Compliance with the FDA 21 CFR Part 11?

To ensure ongoing compliance with FDA 21 CFR Part 11 requirements, an organization should follow the steps mentioned below.

1. Establish a Robust Quality Management System (QMS): Develop and maintain a structured QMS with defined roles, procedures, and records that support compliance with FDA requirements, including Part 11.
2. Ensure Data Integrity: Protect electronic records data integrity by enforcing ALCOA+ principles: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available.
3. Execute Scheduled and Documented Audit Trail Reviews: Review audit trails on a routine basis to confirm that all system activities are traceable and compliant.
4. Implement Change Control and Configuration Management: Control changes to systems and processes to ensure that their impact on system performance or compliance has been properly assessed.
5. Investigate Incidents and Apply CAPA: Investigate deviations, non-conformities, errors, or system failures and, if necessary, take corrective and preventive actions to prevent recurrence.
6. Perform Regular System Reviews: Conduct periodic reviews of system functionality and compliance status.
7. Ensure a Reliable Data Backup, Archive, and Disaster Recovery Process: Maintain secure backups and archives while establishing validated recovery procedures to protect regulated data.
8. Monitor Regulatory Updates: Stay current with FDA requirements and guidance to update procedures and systems in line with evolving expectations.

Is There a Practical Checklist for 21 CFR Part 11 Compliance?

Yes, organizations can use a practical checklist to ensure they meet the main requirements of FDA 21 CFR Part 11. An FDA 21 CFR Part 11 compliance checklist is a structured list of questions that helps companies evaluate their level of compliance with Part 11 requirements.

You can download our FDA 21 CFR Part 11 compliance checklist to support your applicability assessment and compliance gap analysis activities.

How Does SimplerQMS Help Life Science Companies Comply with the FDA 21 CFR Part 11?

SimplerQMS is an electronic Quality Management System (eQMS) built for life science organizations. SimplerQMS integrates technical and operational controls that enable companies to conform to FDA 21 CFR Part 11 requirements, while streamlining critical quality processes.

SimplerQMS is an FDA 21 CFR Part 11-compliant software. Specifically, SimplerQMS fulfills the Part 11 requirements listed below, among others.

• Audit Trail: SimplerQMS embeds secure, time-stamped, system-generated audit trails that capture creation, modification, and deletion of records.
• Electronic Signature: In the SimplerQMS platform, each user has a unique, verifiable signature. The electronic signatures are linked to the respective records as required by Part 11.
• User Access Control: SimplerQMS enforces role-based permissions and authentication to restrict unauthorized access.
• Standardized Workflows: SimplerQMS has operational system checks to enforce the permitted sequencing of steps.
• System Validation: SimplerQMS is delivered as a fully validated system in accordance with ISPE GAMP 5 guidance, with continuous revalidation to maintain compliance following system updates.
• Document Control: SimplerQMS ensures version control and easy availability of current approved documents.
• Data Retention and Retrieval: SimplerQMS archives records securely. Records remain retrievable and available for audits and inspections.

SimplerQMS provides broad QMS process support, including robust document control, training management, CAPA management, change control management, audit management, supplier management modules, and others. SimplerQMS helps life science companies comply not only with 21 CFR Part 11 but also with other relevant requirements, such as FDA 21 CFR Parts 210–211, and 820, as well as EU requirements, including EU-GMP, EU MDR, EU IVDR, and international standards such as ISO 9001 and ISO 13485.