21 CFR Part 11 Audit Checklist (2026 Edition)

Part 11 in one paragraph

21 CFR Part 11 sets the conditions under which FDA treats electronic records and electronic signatures as equivalent to paper records and handwritten signatures. It applies when a predicate rule (such as Part 211 or Part 820) requires a record and you keep it electronically. The current text is on eCFR.

Section	What it covers
§ 11.10	Controls for closed systems, items (a) to (k): validation, copies, record protection, access, audit trails, operational, authority and device checks, training, accountability policies, documentation controls
§ 11.30	Controls for open systems: the § 11.10 controls plus additional measures
§ 11.50	Signature manifestations: “printed name of the signer,” “date and time when the signature was executed,” and its “meaning (such as review, approval, responsibility, or authorship)”
§ 11.70	Signatures “shall be linked” to their records
§ 11.100	Each e-signature is “unique to one individual and shall not be reused by, or reassigned to, anyone else”; certification to FDA
§ 11.200	Non-biometric signatures use “at least two distinct identification components such as an identification code and password”
§ 11.300	Controls for identification codes and passwords

What FDA actually enforces

FDA’s 2003 guidance “Part 11, Electronic Records; Electronic Signatures — Scope and Application” narrowed enforcement. FDA does not intend to enforce the validation, audit trail, record retention and record copying requirements of Part 11 as written, but predicate rules still apply. FDA continues to enforce “all other provisions of part 11,” including access limits, system checks, training, accountability, documentation controls and e-signatures (FDA).

In practice, validation and audit trails are still expected through predicate rules and FDA’s data integrity guidance, which calls for review of audit trails based on risk (FDA, 2018).

2026 context

Clinical investigations. FDA finalized “Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers” on October 2, 2024 (FDA).
Software assurance. For device production and quality system software, FDA’s Computer Software Assurance guidance (updated February 3, 2026) sets a risk-based approach that covers cloud and AI/ML tools (FDA).
EU alignment. The 2025 draft revision of EU GMP Annex 11 adds detailed sections on identity and access management, audit trails and periodic review, and recommends stronger authentication for e-signatures (NSF; GMP Insiders). It is still a draft.

The Part 11 audit checklist

Scope

Inventory of systems holding records required by predicate rules
Each system classified as closed or open, with a documented risk assessment

§ 11.10 Closed system controls

§ 11.30 Open systems

Additional measures protect records in transit and at rest, such as encryption and digital signatures

Electronic signatures (§§ 11.50–11.300)

Signed records show printed name, date and time, and meaning of the signature
Signatures cannot be removed, copied or transferred to falsify records
Each signature is unique to one person and never reassigned
Identity verified before issuing signature credentials; FDA certification letter on file
Non-biometric signatures use two distinct components (ID and password)
Password aging, lockout and loss-management procedures are in place

Beyond the regulation text

Audit trail review frequency defined by risk and performed
Cloud and SaaS suppliers assessed; agreements cover access, retention and audit rights
Periodic review confirms the system remains in a validated, secure state

Audit your procedures, not just your systems

Many Part 11 findings start with procedures that do not mention audit trail review, account deactivation or e-signature meaning. AI document assessment can read your computerized system SOPs and validation documents against each Part 11 section, flag missing controls and cite the passage behind every finding.

Run a sample regulatory document assessment on one computerized system SOP. AskDona shows the evidence; your team decides.

FAQ

Does Part 11 apply to every electronic record? It applies to records required by FDA predicate rules that are kept electronically, and to electronic signatures on them.

Does FDA still enforce audit trail requirements? Under the 2003 guidance, FDA exercises enforcement discretion on Part 11’s audit trail requirement, but predicate rules and data integrity expectations still require reliable, reviewable records (FDA).

What must an electronic signature show? The signer’s printed name, the date and time, and the meaning of the signature (eCFR § 11.50).

Is a username and password enough? For non-biometric signatures, Part 11 requires at least two distinct identification components, such as an ID code and password (eCFR § 11.200).

References

All pages opened and checked by October 9, 2026.

Source	Type	Date	Used for
eCFR: 21 CFR Part 11	Regulation text	Current	All section requirements
FDA: Part 11 Scope and Application	Regulator guidance	Sep 2003	Enforcement discretion
FDA: Data Integrity Q&A	Regulator guidance	Dec 2018	Audit trail review
FDA: Electronic systems in clinical investigations Q&A	Regulator guidance	Oct 2, 2024	Clinical context
FDA: CSA for Production and QMS Software	Regulator guidance	Feb 3, 2026	Risk-based assurance
NSF: Revised EU GMP drafts	Industry news	Jul 21, 2025	Annex 11 draft
GMP Insiders: 2025 EU GMP drafts	Industry analysis	Jul 7, 2025	E-signature authentication