Guide
21 CFR Part 11 explained: electronic records and signatures
21 CFR Part 11 is the FDA rule that decides when an electronic record or electronic signature is as trustworthy as its paper equivalent. If you keep quality or clinical records electronically — and almost every device company now does — Part 11 sets the conditions those records must meet.
The core requirements
What the rule actually asks for
Trustworthy, reliable records
Records must be accurate and retrievable throughout the retention period. That means controlled storage, protection from unauthorised change, and the ability to produce readable copies for FDA inspection.
Audit trails
Computer-generated, time-stamped audit trails must record creation, modification and deletion of records — who changed what and when — without obscuring earlier values.
Electronic signatures
Signatures must uniquely identify the signer, be applied only by the signer, and include the printed name, date and time and the meaning of the signature (reviewed, approved, and so on).
System controls
Access control, authority checks and device limits keep the right people in the right roles. Systems must also be validated for their intended use — the FDA's 2003 guidance scopes validation to the risk the records carry.
Making it real
A practical path to Part 11 compliance
- 1Inventory the records you keep electronically and decide which are Part 11 records.
- 2Prefer vendors whose systems already provide audit trails, unique accounts and signature manifestation — then validate your configuration.
- 3Write the procedures Part 11 expects: account management, signature use, record retention and copies for inspection.
- 4Train users so signatures stay personal, and review audit trails periodically rather than only when something goes wrong.
- 5Reassess when systems change — upgrades, migrations and new integrations all need a validation look.
Where Qevatrix fits
Part 11 controls built into the quality system
QualityOS applies Part 11-style controls across the quality record: unique named accounts, audit trails on every record, and electronic signatures that carry the signer's name, time and signature meaning — with nobody able to approve their own work.
More guides
See all guidesQualityOS
FDA QMSR transition guide
What changes as 21 CFR Part 820 aligns with ISO 13485:2016, and how to prepare your quality system.
QualityOS
ISO 13485 in 2026
What is being worked on in the standard, what stays the same, and what to plan for.
QualityOS
Medical device quality management system
The processes a device QMS needs, how they connect, and a practical order to build them in.
This guide is an orientation, not regulatory advice. Read 21 CFR Part 11 and the FDA's Part 11 scope-and-application guidance directly, and confirm your implementation with your quality and regulatory team.