Part 11 questions SaMD, CDS and AI device teams actually ask

Part 11 applies to electronic records and electronic signatures that a predicate rule — another FDA regulation — already requires you to maintain or submit. For a SaMD manufacturer that usually means design history and design controls, complaint and CAPA records, software validation evidence, training records and release approvals held electronically. It is not a blanket rule over everything your product stores; it is a rule about records the regulations already require. Work through the applicability checker in the full guide if you want a structured verdict.

A predicate rule is any FDA regulation that requires a record to be created, maintained or submitted — for device companies, chiefly the Quality Management System Regulation (21 CFR Part 820, harmonised with ISO 13485 from February 2026), Medical Device Reporting (Part 803) and the registration and listing rules. Part 11 attaches to those records when you keep them electronically instead of on paper. No predicate rule, no Part 11 obligation for that record.

The recommendation shown to a clinician is generally patient-care data governed by other rules, not a Part 11 record. But the records that prove how that output was produced and controlled — the model version in production, release approval, configuration, validation evidence, complaint handling — are quality-system records, and when you keep them electronically Part 11 applies to them. Non-device CDS under the 21st Century Cures carve-out has fewer predicate rules, which narrows the scope further.

FDA's scope-and-application guidance draws the line at records required by predicate rules that are maintained in electronic form. Working drafts that never become part of a required record are generally out of scope — until they are used to make a regulated decision or relied on as evidence. The practical rule: if a draft influences a design decision, a test result or a release, treat it as in scope, because working records have a habit of becoming evidence in an inspection.

No. Part 11 is indifferent to where the system runs. Cloud hosting usually makes your system open rather than closed — access is not fully controlled by the people responsible for the records — which adds expectations such as encryption and clear vendor agreements. You remain responsible for validation, access control and audit trails even when a vendor operates the infrastructure.

Yes, if you market devices in the US. Part 11 follows the predicate rules, and the predicate rules follow the device into the US market regardless of where your servers or offices sit. A German or UK SaMD company with FDA-registered products needs Part 11-compliant electronic records for its FDA-facing quality system just as a US company does.

Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available. Part 11 controls are how you get there: unique user accounts make records attributable, computer-generated timestamps make them contemporaneous, immutable audit trails keep them original and complete, and retention plus export controls keep them enduring and available. The ALCOA+ readiness scorecard in the full guide scores your system on each attribute.

Yes, where they function as design and release evidence. A model version register, dataset lineage documentation and the approval record that put a model into production are quality-system records under design controls, so when held electronically they are Part 11 records: attributable authorship, audit-trailed changes, controlled retention. Raw training data itself is usually supporting material; the provenance record describing it is the Part 11 record.

It depends on their role. If inference logs are used for post-market surveillance, complaint investigation or performance monitoring required by your quality system, they are predicate-rule records and Part 11 applies to their integrity and retention. If they are purely operational telemetry never relied on for a regulated decision, they sit outside Part 11 — but define that boundary in writing before an inspector asks.

A Predetermined Change Control Plan commits you to specific modifications with an update protocol. Every executed change — retraining, redeployment, performance assessment — generates records, and those records need Part 11-grade audit trails: who approved the change, what changed, verification evidence, timestamps. The PCCP guide covers the documentation anatomy; the audit trail underneath it is Part 11 territory.

The retention period comes from the predicate rule, not from Part 11. For device quality-system records, 21 CFR 820.180 requires retention for the expected life of the device and no less than two years from release. Part 11 adds that the records — and their audit trails — must remain retrievable, readable and exportable for that entire period, which is a real constraint when you migrate systems or sunset a vendor.

Only if they preserve the record's full content and meaning, including its metadata and audit trail. A screenshot of a dashboard rarely captures who created the entry, when, or what it replaced — so it fails the complete and accurate tests. Exports are acceptable when they carry the audit trail and signature manifestations with the record; verify that before you rely on an export as evidence.

Secure, computer-generated, time-stamped entries recording who did what and when for create, modify and delete actions on electronic records — including the previous value when a record was changed. The trail must not obscure earlier entries, must be retained at least as long as the record itself, and must be available for FDA review and copying. User-entered change reasons are good practice on top of the automatic capture, not a substitute for it.

Your own quality function on a defined schedule, and FDA on request. Audit trail review is expected to be a routine quality-system activity — typically risk-based, focused on high-impact records such as release approvals and test results — not something that only happens in an inspection. The trail must be exportable in a human-readable form, not locked inside a proprietary database only your engineers can query.

No. The audit trail must be computer-generated and independent of the operator — a switch that lets a user disable it is itself a finding. Administrators should not be able to edit or delete trail entries either; privileged actions like configuration changes should appear in the trail, not bypass it. If a superuser can alter records without trace, the system is not Part 11 compliant regardless of what the rest of it does.

Part 11 requires trails for operator actions that create, modify or delete records — not routine reads. Logging reads is common in healthcare systems for privacy reasons (HIPAA access accounting), but that is a different driver. For Part 11, concentrate capture on write actions; add read logging only where your own risk assessment or privacy obligations call for it.

Three things working together: the signature is unique to one individual and never reused by anyone else; the signer's identity is verified before the signature is established; and signing uses at least two distinct identification components, typically a username and password, with the components checked each signing (or at first signing in a continuous session, with one component thereafter). The signature must be linked to the record so it cannot be excised or transferred.

The printed name of the signer, the date and time of signing, and the meaning of the signature — author, reviewer, approver, or similar. These must appear on any human-readable form of the record: screen display, printout and export. If your PDF rendering shows a record as approved but does not show who approved it and when, the manifestation requirement is not met.

Yes. Under 21 CFR 11.100(c), before or at the time you first use electronic signatures you must certify to FDA, on paper with a traditional handwritten signature, that electronic signatures in your organisation are the legally binding equivalent of handwritten ones. It is a one-off, organisation-level certification sent to FDA's Office of Regional Operations — not one letter per system, and not an email.

Only if the controls around it meet the requirements. A typed name in a shared spreadsheet fails on uniqueness and verification. A click-to-sign inside a validated system, behind an authenticated session re-confirmed with a second component, with the manifestation recorded and linked to the record, can meet them. The form does not matter; the identity binding, linking and manifestation do.

Not under that colleague's identity — ever. Sharing credentials or signing as another person breaks the uniqueness requirement and is treated as falsification. The compliant pattern is delegation: the system records that a different, authorised individual signed, with their own credentials, and the meaning field or change reason records the delegation. Build delegation into the workflow rather than tolerating shared passwords.

A closed system is one where access is controlled by the people responsible for the records; an open system is one where it is not, such as records processed through third parties you do not control. Most cloud SaaS quality systems are treated as open or hybrid. Open systems need everything closed systems need, plus additional measures — typically encryption in transit and at rest, and where appropriate digital signature standards — so the classification decides your control set.

Unique accounts for every individual, role-based authority checks so users can only perform actions their role permits, documented procedures for granting and revoking access, and safeguards like lockout after failed attempts and session timeouts. Shared logins are disqualifying. Access reviews on a defined cadence — and prompt revocation when someone leaves — are what turn the control from a configuration into evidence.

FDA's CSA guidance, final in September 2025, shifts the measure from documentation volume to risk. Features whose failure could affect product quality or patient safety get scripted testing with recorded evidence; lower-risk features can be covered by unscripted or ad hoc testing with leaner records. Part 11 obligations themselves are unchanged — you still validate the system — but the effort follows the risk instead of a template.

You need documented evidence that the system remains in a validated state after each change — which is not the same as re-running everything. Under CSA thinking, a release triggers a risk assessment: changes touching high-risk features get targeted scripted testing, while untouched low-risk areas may need only regression checks and a rationale. What you cannot do is release silently with no assessment at all.

No specific vendor or FDA-certified system, no blockchain, no biometric signatures, no wet-ink lookalikes, and no requirement to keep paper copies alongside electronic ones. Part 11 sets outcomes — trustworthy records and signatures — and leaves the technology to you. A vendor's Part 11 compliant badge describes capability; compliant use of that capability in your validated environment is still yours to demonstrate.

Yes, though usually as part of quality-system inspections rather than standalone Part 11 audits. Investigators cite audit trail gaps, shared accounts, missing signature manifestations and unvalidated spreadsheets under the predicate rules with Part 11 as the basis. The 2003 scope guidance narrowed enforcement discretion, it did not suspend the rule — and QMSR alignment with ISO 13485 has kept data integrity squarely on the inspection agenda.

No. Immutability in Part 11 terms means entries cannot be altered or deleted by users and earlier entries are never obscured — a property you can achieve with append-only storage, access controls and hashing. Blockchain adds nothing an inspector asks for and complicates retention and export. Choose boring, verifiable technology you can explain in an inspection.

No. There is no requirement for a drawn squiggle, a scanned signature image or a signature font. Those images actually weaken the control because they imply the picture is the signature. What matters is the underlying identity binding, the two-component authentication, the recorded meaning, and the permanent link between signature and record.

Findings typically appear as Form 483 observations tied to the predicate rule the record belongs to — inadequate design controls, complaint handling or CAPA records — with the Part 11 deficiency as the mechanism. Data integrity findings escalate quickly because they cast doubt on every other record you show. Remediation usually means retrospective review of affected records, system remediation with validation, and sometimes third-party audits before FDA closes the observation.