21 CFR Part 11 — Electronic Records

21 CFR Part 11 is the FDA regulation that governs the electronic records and the electronic signatures a regulated manufacturer creates, maintains, or submits under the GxP regulations, and it is the rule that lets an electronic record carry the legal weight of a paper one when the controls are met. The four pillars are the audit trail — the time-stamped, user-attributable, computer-generated, and secure record of every create, read, update, and delete — the access controls that limit who sees and who signs, the system validation that proves the software does what it claims under the use it is put to, and the electronic-signature controls that bind the signature to the record and the signer with the two-component identity and the meaning of the signature.

Part 11 is what makes the modern GxP record possible, because the paper batch record and the paper signature do not scale to the volume and the complexity the regulator now expects, and the electronic record is only acceptable when the audit trail and the validation back it. The non-compliance is the one that invalidates the submission and triggers the FDA Form 483 observation or the Warning Letter, and the inspection is where the auditor asks for the audit trail, the validation evidence, and the e-signature controls on the system that holds the record. The relationship to NCR and CAPA is direct: the deviation, the corrective action, and the change control on a validated system run under Part 11, with the audit trail and the e-signature on every action. See NCR and CAPA.