What Is 21 CFR Part 11?

21 CFR Part 11 is an FDA (Food and Drug Administration) regulation that establishes the criteria under which electronic records and electronic signatures are as reliable, trustworthy, and equivalent to paper records.

If your pharmaceutical operations create electronic records (manufacturing data, batch records, test results, quality approvals), Part 11 compliance is mandatory. Without it, electronic records cannot be used in regulatory submissions or audits.

Key Part 11 Requirements

Part 11 requires:

• System Validation: Proof that electronic systems are reliable and perform as intended
• Audit Trails: Complete record of who accessed data, when, and what changes were made
• Electronic Signatures: Equivalent to handwritten signatures with unique identifiers and passwords
• Data Integrity: Records must be accurate, complete, and unaltered (ALCOA+ principles)
• Access Controls: Only authorized users can view and modify records
• Disaster Recovery: Systems must protect against data loss and be recoverable

What Is Annex 11?

Annex 11 is a European Commission guidance document defining requirements for computerized systems in pharmaceutical manufacturing. It's stricter than Part 11 and applies to anyone operating in the EU or exporting to EU markets.

Annex 11 covers both electronic and paper systems, and requires GAMP 5 validation methodology — more rigorous than Part 11 alone.

Part 11 vs. Annex 11: Key Differences

Data Integrity: ALCOA+ Principles

Both Part 11 and Annex 11 require that electronic data meet ALCOA+ standards:

• Attributable: Who created/modified the record? Electronic data must be traceable to an individual.
• Legible: Data must be readable and understandable, not corrupted or lost.
• Contemporaneous: Records must be created at the time the activity occurs, not backdated.
• Original: The first recording of data is the original; copies are clearly marked as copies.
• Accurate: Data must be correct, complete, and not altered without authorization.
• Accessible: Records must be retrievable throughout their retention period.
• Complete: Nothing is missing; all related data is present.
• Consistent: Data format and structure are consistent across the system.
• Enduring: Records survive system changes, migrations, and technology obsolescence.

Electronic Signatures Under Part 11

Electronic signatures replace handwritten signatures and must:

• Identify the signer uniquely (user ID)
• Bind the signer to the record (timestamp, action)
• Prevent repudiation (signer cannot deny signing)
• Be created before final submission (Part 11 requires "originator" approval)
• Use secure authentication (passwords, biometrics, certificates)

Audit Trails & System Controls

Part 11 and Annex 11 require comprehensive audit trails:

• What happened: Which data was accessed, created, or modified
• Who did it: User ID or electronic signature
• When: Date and time of the action (to system clock accuracy standards)
• Before/after values: What changed (required by Annex 11, recommended by Part 11)
• Why: Reason for change (Annex 11 requires this)

Annex 11 requires MORE granular audit trails than Part 11. For example, if someone changes a test result from 98.5 to 99.2, Annex 11 requires logging both the old and new values plus the reason. Part 11 requires logging the action but is less prescriptive about details.

Common Part 11 & Annex 11 Compliance Failures

• Incomplete audit trails: Systems don't log who accessed data or what changed. FDA and EU inspectors flag this immediately.
• Inadequate electronic signatures: Shared passwords violate Part 11 (must be unique to user). No audit trail of who signed what.
• No data integrity controls: Systems allow data modification without logging or approval.
• Outdated system validation: Systems validated 10 years ago may not meet current Part 11/Annex 11 standards.
• Poor change control: Software updates happen without validation, risking data integrity.
• Inadequate backup/recovery: No documented disaster recovery plan violates Part 11 requirements.

Which Standard Do You Need?

21 CFR Part 11 only: If you operate only in the US and don't export to EU markets.

Annex 11 only: If you manufacture in the EU or export only to EU countries. (Unlikely — most pharma companies use Part 11 too.)

Both Part 11 + Annex 11: If you operate in US and export to or manufacture in EU. This is the most common scenario for global pharma companies. The good news: Annex 11 compliance automatically covers Part 11, because Annex 11 is stricter.

Implementation Checklist

• ☐ Inventory all electronic systems that create regulatory records
• ☐ Validate that systems meet Part 11 or Annex 11 requirements
• ☐ Implement unique user identifiers and electronic signature controls
• ☐ Configure comprehensive audit trail logging
• ☐ Establish documented change control procedures
• ☐ Train all users on data integrity and system access rules
• ☐ Plan disaster recovery and data backup procedures
• ☐ Document validation and compliance evidence for audits

FAQ: Part 11 & Annex 11