21 CFR Part 11 and electronic records compliance for SaMD, CDS and AI-enabled devices

What 21 CFR Part 11 actually covers

Part 11 sets the conditions under which FDA accepts electronic records and electronic signatures as equivalent to paper records and handwritten signatures. It is not a standalone obligation to keep records. It attaches to records that another regulation — the predicate rule — already requires you to maintain or submit. For a device software company the predicate rules are the quality system requirements now harmonised with ISO 13485 under the Quality Management System Regulation, plus reporting and complaint requirements.

That single point decides most scoping arguments. If a regulation requires the record and you keep it electronically, Part 11 applies: validate the system, control access, keep a secure computer-generated audit trail, and if anyone signs it, apply the signature controls. If no regulation requires it, Part 11 does not apply — although good data integrity practice still does, because working records have a habit of becoming evidence.

ALCOA+ data integrity, attribute by attribute

ALCOA+ is the language inspectors use when they ask whether your records can be trusted. Part 11 controls are how you answer. Each attribute below is paired with the control that evidences it in a software product.

Attribute	What it means	Control that proves it
Attributable	You can tell who created or changed the record	Unique named accounts, no shared logins, identity bound to every write
Legible	The record can be read and understood for its full life	Human-readable export, documented field meanings, stable formats
Contemporaneous	Recorded at the time of the activity	Server-generated timestamps with a fixed time source, no back-dating
Original	The first capture, or a verified true copy	Write-once storage of the source record and its checksum
Accurate	The record reflects what actually happened	Input validation, review workflow, reconciliation against source systems
Complete	Nothing is silently dropped, including repeats and failures	Append-only audit trail capturing deletions and superseded values
Consistent	Sequence and format hold across systems	One time zone of record, controlled vocabularies, shared identifiers
Enduring	The record survives for its retention period	Retention policy, backup and restore testing, media migration plan
Available	It can be produced for review when asked	Inspector-ready search and export of records with their audit trails

Validation: from CSV volume to risk-based assurance

Part 11 requires validation of systems holding regulated records. FDA's Computer Software Assurance guidance changed how that effort should be spent: identify the intended use, assess the risk if the feature fails, then choose an assurance activity proportionate to that risk and keep only the record needed to show it happened. The chart below is the shape teams should aim for.

Illustrative distribution of effort, not a regulatory allocation.

Part 11 and EU Annex 11 side by side

Teams selling in both markets rarely need two systems, but they do need to know where the expectations differ. Annex 11 is more explicit about supplier oversight and periodic review; Part 11 is more prescriptive about signature mechanics.

For device-side European requirements, see the EU MDR and UKCA guide.

Interactive Part 11 tools

Four tools you can use straight away. Everything runs in your browser — nothing is stored, sent or logged, and you do not need an account.

21 CFR Part 11 electronic records control outline
Device type: Software as a medical device (SaMD)
System type: Closed system
Risk level: Direct safety or quality impact

1. Record inventory and scope
   - List each regulated record the system creates, holds or submits.
   - State the predicate rule behind each one.
   - Mark which are Part 11 records and which are working copies.

2. System validation
   - Scripted testing with recorded objective evidence and independent review.
   - Full requirement-to-test traceability, including negative and boundary cases.
   - Define the change control that re-triggers assurance activity.

3. Access control and identity
   - Unique named accounts, no shared logins, documented role permissions.
   - Joiner, mover and leaver process with periodic access review.
   - Authority checks so only permitted roles can sign or release.

4. Audit trail
   - Secure, computer-generated, time-stamped entries for create, modify and delete.
   - Previous values retained; earlier entries never obscured or overwritten.
   - Audit trail retained at least as long as the underlying record.
   - Defined review cadence, and a documented reviewer for exception events.

5. Electronic signatures
   - Two distinct identification components at first signing in a session.
   - Signature manifestation showing printed name, date and time, and meaning.
   - Signature permanently linked to its record and not transferable.
   - 11.100(c) certification letter to FDA on file, with the date it was sent.

6. Records retention, copies and availability
   - Retention period per record type, tied to the predicate rule.
   - Human-readable and electronic copies available for inspection.
   - Backup, restore testing and media migration plan.

7. People and procedures
   - Training records for everyone who creates, modifies or signs records.
   - Written policy holding individuals accountable for their signatures.
   - Deviation, incident and data integrity escalation route.

Educational outline only. It is not regulatory advice and does not replace your
quality system procedures or a review by your regulatory lead.

These tools are educational. They are not regulatory advice and do not replace your quality system procedures or review by a qualified regulatory professional.

Frequently asked questions

The eight questions below are the short version. For the full set — scope, ALCOA+ records, audit trails, signatures, validation and enforcement myths — see the dedicated Part 11 FAQ.

Does 21 CFR Part 11 apply to software as a medical device?

Part 11 applies to electronic records and electronic signatures that a predicate rule requires you to keep or submit. For a SaMD manufacturer that usually means design history and design controls, complaint and CAPA records, software validation records, training and release approvals held electronically. It is not a blanket rule over everything your product stores; it is a rule about records the regulations already require.

Is a clinical decision support output a Part 11 record?

The recommendation itself is generally patient-care data governed by other rules, not a Part 11 record. But the records that prove how that output was produced and controlled — model version in production, release approval, configuration, validation evidence, complaint handling — are quality-system records, and when you keep them electronically Part 11 applies to them.

What does ALCOA+ mean in practice?

Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available. It is the data integrity vocabulary inspectors use. Part 11 controls are how you achieve it: unique user accounts make records attributable, computer-generated timestamps make them contemporaneous, immutable audit trails keep them original and complete, and retention and export controls keep them enduring and available.

What must an audit trail capture?

Secure, computer-generated, time-stamped entries that record who did what and when for create, modify and delete actions on electronic records, including the previous value where a record was changed. The audit trail must not obscure earlier entries, must be retained at least as long as the record itself, and must be available for review and copying by an inspector.

Do I need to send FDA a letter about electronic signatures?

Yes. Before or at the time you first use electronic signatures, 21 CFR 11.100(c) requires you to certify to FDA, in paper form with a handwritten signature, that electronic signatures in your organisation are the legally binding equivalent of handwritten signatures. It is a one-off certification covering the organisation, not one letter per system.

How does Computer Software Assurance change validation?

FDA's Computer Software Assurance guidance shifts effort from documentation volume to risk. High-risk features that directly affect product quality or patient safety get scripted testing and recorded evidence; low-risk features can be covered by unscripted or ad hoc testing with lighter records. The Part 11 obligations themselves are unchanged — you still validate, you just allocate the effort where the risk is.

What is the difference between an open and a closed system?

A closed system is one where access is controlled by the people responsible for the records. An open system is one where it is not — for example records exchanged through a third party you do not control. Open systems need the same controls plus additional measures such as document encryption and, where appropriate, digital signature standards.

Does Part 11 tell me which vendor or technology to use?

No. Part 11 sets outcomes, not products. There is no FDA-certified Part 11 system, no blockchain requirement, and no obligation to make an electronic signature look like a handwritten one. A vendor claim of being Part 11 compliant describes capability; the compliant use of that capability is still yours to demonstrate.