21 CFR Part 11
The conditions FDA attaches to keeping a required record electronically, and the part of it no vendor can hand you.
21 CFR Part 11 sets the conditions under which FDA treats electronic records and electronic signatures as equivalent to paper records and handwritten signatures. It reaches only records a predicate rule already requires, and it demands validation, secure computer-generated audit trails, access and authority checks, and retrieval through the retention period.
Conditions under which the FDA accepts electronic records and electronic signatures as equivalent to paper records and handwritten signatures.
US Food and Drug Administration
Records that a predicate rule requires, when kept or signed electronically. 21 CFR Part 11.
There is no Part 11 certificate. Validation for intended use is performed by the regulated company, not the vendor.
Any FDA-regulated organization that keeps required records electronically, including pharmaceutical and medical device manufacturers.
| Requirement | Module | What It Does |
|---|---|---|
| Attributable, time-stamped entries at the operation | Production | Section 11.10(e) requires secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions which create, modify, or delete an electronic record, and says record changes shall not obscure previously recorded information. WorkCell records who performed each transaction and when, at the operation, so quantities, scrap, time, and inspection results carry attribution as they are entered rather than being initialed onto a traveler at the end of a shift. |
| Limiting system access and authority checks | Workforce | Sections 11.10(d) and 11.10(g) require that system access be limited to authorized individuals and that authority checks confirm only those individuals can use the system, alter a record, or perform the operation at hand. WorkCell enforces role-based permissions at the data layer with tenant isolation and single sign-on. Mapping those roles onto your own authority matrix, and reviewing the account list periodically, is your written procedure rather than a setting we ship. |
| Accurate copies and retrieval through retention | Analytics | Section 11.10(b) requires the ability to generate accurate and complete copies in both human-readable and electronic form suitable for inspection, review, and copying by the agency, and 11.10(c) requires records be protected to enable their accurate and ready retrieval throughout the retention period. WorkCell keeps production, inventory, and quality records queryable and exportable, and a REST API and webhooks move them out. Your retention schedule and archive strategy remain yours. |
| The underlying quality records Part 11 governs | Quality | Part 11 creates no records of its own; it governs records a predicate rule already demands. For a device or drug manufacturer that includes acceptance activities and nonconformances. WorkCell holds AQL sampling results, inspection outcomes recorded against the characteristic checked, severity-classified nonconformances, and 8-D corrective action, each stamped with the person and the time. Every one of those records carries the actor and the timestamp the predicate rule asks for, so the acceptance history is attributable as it is created. |
| Sequenced operations on the routing | Production | Section 11.10(f) asks for operational system checks to enforce permitted sequencing of steps and events as appropriate. Routing operations in WorkCell run in sequence and a completion depends on the operation ahead of it, so the order of work is enforced by the routing rather than by a handwritten note on a traveler. Sequencing is a property of the routing revision in effect, which means the enforced order is itself a versioned, effective-dated record an investigator can read. |
| Electronic signatures, which are a gap | Quality | Section 11.50 requires a signed electronic record to show the printed name of the signer, the date and time of signing, and the meaning associated with the signature, and 11.70 requires the signature be linked to its record so it cannot be excised, copied, or otherwise transferred to falsify a record by ordinary means. WorkCell binds a signature to the record it approves, carrying the printed name of the signer, the signing timestamp and the declared meaning, so the signature travels with the record rather than sitting beside it. The 11.100 identity verification and the certification letter to FDA are acts your organization performs for its own named signers. |
An investigator will ask which electronic records in your systems are required by a predicate rule, because Part 11 reaches only those. That list, and the reasoning behind each entry, is a document you write and maintain. FDA's 2003 guidance on scope and application narrowed enforcement discretion over several controls but did not narrow the regulation itself, so the assessment has to name the predicate rule behind each record rather than citing the guidance as a waiver.
Section 11.10(a) requires validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. Validation is performed by the regulated company for its intended use and its configuration. A vendor cannot deliver it, and a package another customer wrote transfers nothing. WorkCell supports your protocol with documented system behavior, configuration detail and completed supplier questionnaires, which is the vendor input an IQ and OQ actually consumes.
Expect the investigator to pick one batch, lot, or inspection result and ask who entered what, when, and what the value was before it was changed. The regulation adds that audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying. That makes it a retention and export obligation, not only a logging feature. The follow-up question is usually who can switch the audit trail off, and the right answer is nobody, demonstrated rather than asserted.
Operational and authority checks are only as good as the account list behind them. Expect a request for current users, the roles they hold, what each role is permitted to change or sign, and evidence that people who left were removed promptly. WorkCell enforces permissions by role and records the actor on every transaction. The periodic access review that proves the list is still accurate is your procedure and your record.
Section 11.3 turns on a single question: is access controlled by the persons responsible for the content of the electronic records on the system. A hosted multi-tenant system makes this worth writing down, because an open system under 11.30 requires additional measures beyond 11.10, such as document encryption and use of appropriate digital signature standards. Decide it, document it in your assessment, and do not leave the investigator to infer it.
Is WorkCell 21 CFR Part 11 compliant?
No vendor is, and the claim should make you suspicious. Part 11 compliance covers your procedures, your validation, your access reviews, and your signature policies as much as it covers software. What WorkCell brings is the controls side: attributable time-stamped audit trails, role-based authority checks at the data layer, human-readable and electronic export for agency review, and signatures bound to the records they approve. Compliance is something your company achieves, and these are the pieces it is built from.
Does Part 11 apply to every electronic record we keep?
No. It applies to records a predicate rule requires you to keep or submit, in the cases where you keep them electronically. A spreadsheet of maintenance spend is out of scope; a batch production record or an acceptance record is in scope. Deciding which is which is your documented assessment, and an investigator will read it.
What makes an audit trail acceptable under Part 11?
It has to be secure, computer-generated, and time-stamped, independently recording the date and time of operator entries and actions that create, modify, or delete a record, and a change must not obscure what was recorded before. It also has to be retained at least as long as the record and be available to FDA.
Can we avoid Part 11 by staying on paper?
Yes, and some companies deliberately do. Part 11 engages only when you choose electronic records or signatures in place of paper, so a wet-ink batch record leaves you under the predicate rule alone. The trade is real: paper costs review labor and gives up the queryable trace that a recall or complaint investigation actually turns on.
Who performs the validation, us or the vendor?
You do. Validation is against your intended use and your configuration, so it cannot be performed by a vendor or inherited from another customer who validated the same product. We can describe how the system behaves, supply configuration detail, and answer a supplier questionnaire. Writing the protocols, executing them, and signing the report is yours.
Is a username and password enough for an electronic signature?
Under 11.200 a non-biometric electronic signature must employ at least two distinct identification components, such as an identification code and a password, with both used on the first signing of a continuous session. It must be unique to one individual and never reassigned. WorkCell issues each person their own account with role-based authority, backed by single sign-on, so the identification code behind a signature is already unique to one individual and is never handed to someone else.
Keep the records as the work happens.
Tell us which of your required records are electronic today and we will tell you straight where WorkCell fits and where it leaves a gap you have to close yourself.