The Real-World Guide to 21 CFR Part 11 Examples
21 CFR Part 11 examples span a wide range of electronic records and signatures used across FDA-regulated industries. Here is a quick reference of the most common ones:
Category Part 11 Examples In Scope Training records, Design History Files (DHF), Device History Records (DHR), Electronic Batch Records (EBR), Bill of Materials (BOM), Software Problem Resolution records, distribution records Out of Scope Scanned paper originals, simple customer name lists, raw data logs not relied upon, Excel used only as a tracking tool, research-use-only data Systems Covered QMS, LIMS, ERP, DMS, ELN, MES, CTMS, EDC Open System Examples Email, cloud storage platforms
The shift from paper to digital records has been transformative for life sciences — but it has also created real compliance complexity. Many validation managers are still unsure which of their electronic records actually fall under 21 CFR Part 11, and which do not. Get it wrong in either direction and you either expose yourself to FDA findings or waste resources over-complying with records that were never in scope.
The regulation itself, issued in March 1997 and effective August 20, 1997, is intentionally broad. And while the FDA's 2003 guidance narrowed its interpretation significantly, plenty of confusion remains — especially around predicate rules, hybrid paper-electronic systems, and newer standards like IEC 62304.
I'm Stephen Ferrell, Chief Product Officer at Valkit.ai, with over 20 years of hands-on experience in computerized system validation, GxP quality systems, and 21 CFR Part 11 examples across pharmaceutical, biotech, and medical device environments — including contributing to ISPE GAMP 5 Second Edition. In this guide, I'll walk you through exactly which records and systems are in scope, what the controls look like in practice, and where companies most often get it wrong.
Understanding the Scope: What Counts as a Part 11 Record?
To understand 21 cfr part 11 examples, we first have to talk about "predicate rules." These are the underlying FDA regulations—like 21 CFR Part 820 for medical devices or Parts 210/211 for pharmaceuticals—that require you to maintain certain records in the first place.
If a predicate rule says you must keep a record, and you choose to maintain that record in electronic format rather than paper, then 21 CFR Part 11 applies. This is the "narrow interpretation" the FDA adopted in its 2003 guidance to prevent the industry from being crushed by the cost of over-compliance.
Under 21 CFR Part 11.10 Controls for closed systems, the FDA expects these electronic records to be just as trustworthy as their paper ancestors. This means ensuring record authenticity, integrity, and, when necessary, confidentiality. We also see many "hybrid systems" where companies use a mix of paper and digital. In these cases, if the electronic version is the one relied upon for regulated activities, it’s a Part 11 record.
Real-World 21 CFR Part 11 Examples of Regulated Records
Identifying which documents are in scope is the first step toward a clean audit. Here are specific 21 cfr part 11 examples of records that typically fall under the regulation:
- Training Records: If these records are used to prove personnel competency as required by a predicate rule and are stored digitally, they are in scope—even if they aren't signed.
- Design History File (DHF): For medical device companies, documents like Software Requirements Specifications (SRS) that live in a digital repository are core Part 11 records.
- Device History Record (DHR): Electronic travelers, installation records, and service reports are critical for traceability.
- Bill of Materials (BOM): Often managed within an ERP or PLM system, these are essential for manufacturing and quality.
- Electronic Batch Records (EBR): In pharma, the digital version of the batch record is the ultimate "source of truth."
- Software Problem Resolution (IEC 62304): While IEC 62304 is a standard and not a rule, these records often support device change requirements under Part 820, making them Part 11 records.
Record Type Part 11 Status Why? Signed Data Intake Form In Scope Required by predicate rule; maintained electronically. Excel Database In Scope If it's the primary storage for GxP data. Distribution Records In Scope Required by 21 CFR 820.160. Scanned Copy of Paper Out of Scope If the paper original is the "official" record.
Records Generally Excluded from 21 CFR Part 11 Examples
Not every byte of data in your facility needs to be Part 11 compliant. The FDA provides some breathing room for:
- Scanned Paper Records: If you maintain the paper original as your evidence of compliance and just send a PDF scan to the FDA, the PDF usually isn't considered a Part 11 record.
- Simple Customer Lists: Unless specifically intended to fulfill a distribution record requirement (like 820.160), a basic list of names is generally out of scope.
- Excel as a Tracking Tool: If you use Excel just to track where paper files are located, but the actual data is in the paper files, the spreadsheet isn't a Part 11 record.
- Research-Use-Only (RUO) Data: Data generated in early-stage R&D that isn't used to support a regulatory submission or quality decision is typically exempt.
Open vs. Closed Systems: Compliance Requirements and Examples
The FDA distinguishes between two types of environments. The difference comes down to who controls access to the system.
According to the 21 CFR 11.3(b)(4) Closed system definition, a closed system is an environment where system access is controlled by the people responsible for the content of the electronic records. This is your typical internal network or a dedicated vendor-managed QMS.
Conversely, the 21 CFR 11.3(b)(9) Open system definition describes an environment where the people responsible for the record content do not control system access. Think of general-purpose email or public cloud storage where anyone can potentially create an account.
Closed System Examples and Controls
Most life sciences software falls into the closed system category. Examples include:
- Quality Management Systems (QMS): Managing CAPAs, deviations, and change controls.
- Laboratory Information Management Systems (LIMS): Storing analytical test results.
- Enterprise Resource Planning (ERP): Handling manufacturing and distribution data.
- Document Management Systems (DMS): Controlling SOPs and batch records.
For these systems, you must implement strict controls: audit trails that are secure and time-stamped, authority checks to ensure only authorized users can perform certain actions, and device checks to verify the validity of data input sources.
Open System 21 CFR Part 11 Examples and Extra Controls
If we use an open system—like sending a regulated document via a standard email provider—the FDA requires everything a closed system needs, plus additional measures to ensure data integrity and "non-repudiation" (meaning the signer can't claim they didn't sign it).
Extra controls for open systems include:
- Data Encryption: Protecting the record while it's in transit across the open internet.
- Digital Certificates: Using cryptographic methods to verify the sender's identity.
- Multi-Factor Authentication (MFA): Ensuring that even if a password is stolen, the system remains secure.
- Read-Only Formats: Ensuring the record cannot be altered once it reaches its destination.
Core Controls and Enforcement Discretion
While the 2003 guidance introduced "enforcement discretion" for things like time-stamped audit trails and legacy systems (those in place before August 1997), it didn't give us a free pass. The FDA still expects a risk-based approach.
According to ISPE data, missing or incomplete validation is consistently one of the top issues flagged during inspections. Even if the FDA is exercising "discretion" on the way you validate, they still expect you to prove the system works as intended.
Key controls we must always maintain:
- System Validation: Documented evidence that the software performs its functions accurately and reliably.
- Audit Trails: Secure, computer-generated records of "who, what, when, and why" for every entry or change.
- Record Retention: Ensuring records are accessible and human-readable for as long as required by the predicate rule.
- Copies of Records: Being able to provide the FDA with electronic copies in common formats (like PDF or XML) that preserve the record's meaning.
Strict Enforcement Areas for Life Sciences
There are certain areas where the FDA has zero "discretion." We must be airtight on:
- System Access: Limiting access to authorized individuals only.
- Personnel Qualifications: Ensuring everyone using the system is trained and that training is documented.
- Accountability: Written policies that hold individuals accountable for actions taken under their electronic signatures.
- SOPs for IT Infrastructure: Having clear procedures for system maintenance, security, and disaster recovery.
Lessons from the Field: 21 CFR Part 11 Examples of Violations
Learning from others' mistakes is much cheaper than learning from your own. FDA Warning Letters and Form 483 observations frequently highlight 21 cfr part 11 examples of non-compliance.
Common violations include:
- Shared Passwords: Multiple users logging in with a single "Admin" account, making it impossible to attribute actions to a specific person.
- Audit Trail Gaps: Discovering that the audit trail was turned off or that users had the ability to delete or modify logs.
- Missing Validation Protocols: Implementing a new QMS or LIMS without performing proper IQ/OQ/PQ (Installation, Operational, and Performance Qualification).
- Unauthorized Changes: Making "hotfixes" to a production database without going through a formal change control process.
- Data Integrity Failures: Records being "backdated" or created after the fact to cover up missed steps in a process.
Frequently Asked Questions about 21 CFR Part 11
Is a Software Problem Resolution record subject to Part 11?
Yes, in most cases. While the IEC 62304 standard itself isn't an FDA predicate rule, these resolution records usually supplement the Design History File (DHF) or device change records required by 21 CFR 820. Because they support a predicate rule and are typically maintained electronically, they fall squarely within Part 11 scope.
Can cloud-based software be Part 11 compliant?
Absolutely. The FDA is "technology neutral," meaning they don't care if your server is in your basement or in a high-tech data center. However, the responsibility for validation remains with you, the regulated company. You must ensure the SaaS vendor has appropriate access controls, audit trails, and data protection measures in place, and you must validate the system for your specific intended use.
What is the difference between an electronic and digital signature?
Think of "electronic signature" as the broad legal term. It can be a username/password combination, a biometric scan (like a fingerprint), or even a scanned image of a handwritten signature.
A "digital signature" is a specific type of electronic signature that uses cryptographic authentication. It’s like a digital seal that breaks if the document is tampered with, providing a higher level of security and identity verification.
Conclusion
Navigating 21 cfr part 11 examples doesn't have to be a nightmare of paperwork and technical jargon. At its heart, the regulation is about ensuring that your digital data is just as reliable and trustworthy as a signed piece of paper. By understanding your predicate rules, distinguishing between open and closed systems, and maintaining core controls like audit trails and validation, you can build a compliant, efficient digital environment.
At Valkit.ai, we believe that compliance should accelerate your business, not slow it down. Our AI-powered digital validation platform is designed specifically for the pharmaceutical, biotech, and medical device industries. We help companies reduce validation costs by up to 80% and turn weeks of manual testing into hours of automated, compliant work.
Through smart cloning and automated compliance tools, we make it easier than ever to manage your 21 cfr part 11 examples and maintain a constant state of audit-readiness. Learn more about our validation services and how we can help you move from paper to pixels with confidence.
