21CFR11

Subject Home

The FDA's Part 11 Electronic Records and Electronics Signatures Regulation

In 1997, in an effort to modernize the processes associated with clinical research and regulatory submissions, the FDA enacted a rule to regulate electronic records and their authentication.  Since that time, a substantial body of knowledge has developed regarding both industry best practices and the implementation of the Part 11 Rule.

What is 21 CFR 11 - What Does It Address?

Part 11 has five central components.  These are:

• Validation
• Glossary of Terms
• Time Stamps
• Maintenance of Electronic Records
• Electronic Copies of Electronic Records

In summary, the Rule requires certain functional requirements associated with processes that:  collect, maintain, transmit, authenticate, and secure, regulatory data.  These elements form a framework of system and application requirements, that may be challenging for system and software designers.

Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach - A part of the FDA's Pharmaceutical cGMP initiative, which was launched on August 21, 2002, applied to human drug and biological drug products and veterinary drugs and had several objectives, including to encourage the early adoption of new technological advances by the pharmaceutical industry.

Part 11 plays a pivotal role in this initiative, and in the overall strategy of the FDA in moving towards exclusive electronic records and submissions.  However, part 11 is also a complex set of requirements that have proven challenging in their implementation.  While Part 11 includes, and refers to numerous industry Best Practices in both application and system design, as well as Information Assurance, the specific language offers unique problems.

Current Status Of Part 11:

As an outgrowth of its current good manufacturing practice (CGMP) initiative for human and animal drugs and biologics,⁴ FDA is re-examining part 11 as it applies to all FDA regulated products. The FDA anticipates new changes to Part 11 as a result.

The FDA's recent guidance explains how the FDA  will now change its interpretation of Part 11. While the FDA's  re-examination is under way, they intend to exercise enforcement discretion with respect to certain part 11 requirements. That is, not intend to enforce compliance with the validation, audit trail, record retention, and record copying requirements of part 11 as explained in this guidance. However, records must still be maintained or submitted in accordance with the underlying predicate rules, and the Agency can take regulatory action for noncompliance with such predicate rules.  In addition, they intend to exercise their discretion and do not intend to take action to enforce any part 11 requirements for systems that were operational before August 20, 1997 (the effective date of part 11 - commonly known as legacy systems).

Analysis

The Part 11 Rule was originally intended to improve the reliability and integrity of the processes involved in data gathering, analysis, and submission.  However, much has changed since 1997, and in our view, this re-evaluation is a natural modernization of the requirements to reflect current best practices.

Unfortunately, this can also result in a trap of significant scope.  Application and System vendors who are reluctant to implement compliance with the Rule may face significant challenges down stream when the final changes are implemented.  It is therefore advisable to fully implement Part 11 now, and the current Best Practices coming from sources such as NIST (www.NITS.gov )  so as to be fully prepared.

Title 21 Code of Federal Regulations
21 CFR Part 11
Electronic Records / Electronic Signatures
Regulation and Guidance

Issued:  March, 2000

UPDATE:

• The Current Status of 21 CFR Part 11 Guidance is located under Regulations and Guidance at: http://www.fda.gov/cder/gmp/index.htm (see background: http://www.fda.gov/OHRMS/DOCKETS/98fr/03-4312.pdf )
• FDA Guidance Documents - A subject list of open dockets for guidance documents concerning 21 CFR Part 11.
• Public Meeting June 19-20, 2000 on Industry Experience Implementing Technical Provisions of 21 CFR Part 11, Federal Register (FR), February 22, 2000; also available in PDF Version
  FDA Summary of the Public Meeting
• Enforcement Policy Compliance Policy Guide, FR, July 21, 1999
  also available in PDF version

BACKGROUND:

• Electronic Submissions to FDA Docket 92S0251 Contents 
• Final Rule (text file 76 pages), FR, March 20, 1997
  PDF version
• Docket 92S0251 (text file) Established, FR Notice, March 20, 1997
  PDF Version
• Side by Side Comparison of Proposed and Final Rules
  PDF Version
• Proposed Rule, FR, August 31, 1994
  PDF Version
• Advance Notice of Proposed Rulemaking (text file), FR, July 21, 1992
  PDF Version
• FDA E-Sig Working Group Report (WP V6), February 24, 1992
  PDF Version