21 CFR Part 11 defines the conditions under which electronic records and electronic signatures can be considered trustworthy and generally equivalent to paper records and handwritten signatures in FDA-regulated activities.
For sponsors and CROs, Part 11 is therefore much more than an IT requirement. It affects how clinical data are created, changed, reviewed, approved, retained and presented during an inspection.
A poorly controlled system can make it difficult to reconstruct what happened to a record, demonstrate who approved it or establish whether the data remained reliable.
The result may be inspection observations, corrective work, delays and questions about the credibility of the study documentation.
The FDA’s final 2024 guidance on electronic systems, records and signatures in clinical investigations confirms the relevance of these controls to sponsors, CROs, investigators, institutional review boards and other research stakeholders.
H2 What does 21 CFR Part 11 require?
“21 CFR” refers to Title 21 of the US Code of Federal Regulations, which contains federal rules concerning food and drugs.
Part 11 deals specifically with electronic records and electronic signatures used to meet FDA requirements.
For closed systems, where access is controlled by the people responsible for the records, 21 CFR 11.10 requires procedures and controls designed to protect:
- record authenticity and integrity;
- confidentiality when appropriate;
- record availability throughout the retention period;
- access by authorised individuals only;
- the production of accurate, complete and readable copies;
- the detection of invalid or altered records;
- the attribution of actions to the people who performed them.
Compliance cannot therefore be reduced to a single software feature.
Passwords, audit trails and electronic signatures are essential components, but they must operate within a controlled environment supported by defined roles, procedures, training and lifecycle documentation.
How Part 11 relates to European clinical trials
Part 11 is a US regulation, but it may also matter for European studies when electronic records support FDA-regulated work or submissions.
In parallel, the EMA guideline on computerised systems and electronic data in clinical trials addresses validation, security, user management, audit trails and data integrity in the European context. ICH E6(R3) also reinforces a proportionate, risk-based approach throughout the data lifecycle.
For an international study, the useful question is not “Part 11 or GCP?”. It is “How will we demonstrate that our systems and processes meet every applicable requirement?”.
ACTide brings data collection, controls, traceability and operational tools together in an ecosystem designed for clinical research.
Request a demo to review audit trails, signatures, access management and validation workflows against a use case relevant to your study.
What makes an electronic signature valid?
A compliant electronic signature is not simply a typed name, a selected checkbox or an image of a handwritten signature.
The system must associate the signature with a uniquely identified person and the record being signed. Under 21 CFR 11.50, a signed electronic record must clearly show:
- the signer’s printed name;
- the date and time of signing;
- the meaning of the signature, such as review, approval, responsibility or authorship.
This information must also appear in the human-readable version of the record. 21 CFR 11.70 requires the signature to remain linked to its record so that it cannot be excised, copied or transferred for fraudulent purposes.
For non-biometric electronic signatures, 21 CFR 11.200 specifies at least two distinct identification components, such as an identification code and password, with requirements depending on whether the signing takes place during one continuous controlled session.
Technology is only part of the answer
Sponsors and CROs also need governance for:
- account creation, amendment and deactivation;
- identity verification before credentials are assigned;
- prevention of shared accounts;
- user training;
- compromised credentials;
- the meaning of each signing action;
- individual accountability for signed actions.
Non-repudiation results from identification, authentication, signature manifestation, record linkage and organisational controls working together. It is not created by one button.
Why the audit trail is central to compliance
An audit trail reconstructs the history of the data. It should securely and automatically document actions that create, modify or delete electronic records, recording the date and time without obscuring previously entered information.
In an eCRF, showing the current value is not enough. During monitoring or inspection, reviewers may need to establish:
- who entered or changed a value;
- when the action occurred;
- what the previous value was;
- why the change was made;
- which queries, reviews or approvals followed;
- whether the sequence was consistent with assigned roles and procedures.
Audit-trail records must be retained for at least as long as the corresponding electronic records and be available for regulatory review.
Scientific research continues to investigate ways of strengthening traceability: a published study of secure audit trails for clinical-trial data illustrates the growing importance of verifiable data provenance in digital research.
An audit trail must also be usable
Recording thousands of events adds limited value if sponsors, monitors and inspectors cannot retrieve or interpret them. A platform assessment should therefore cover:
- filters and search functions;
- export in readable format;
- links between events, users, dates and records;
- capture of the reason for a change;
- consistent time-zone handling;
- protection against log alteration;
- availability after study closure.
ACTide eCRF provides online audit trails, configurable user profiles, monitoring and SDV tools, and real-time data exports.
These capabilities can support traceability, but they still need to be configured and operated within the validated framework of the study.
Computer system validation and Part 11
Part 11 requires systems to be validated for accuracy, reliability, consistent intended performance and the ability to identify invalid or altered records.
Computer system validation is not a generic certificate that applies to every implementation and use case.
It should provide documented evidence that the system, in its actual configuration, is fit for its intended purpose.
A practical validation approach will normally address:
- clear, testable user requirements;
- risk assessment;
- functional and configuration specifications;
- testing with documented results and deviations;
- traceability between requirements and tests;
- change control;
- update and release management;
- periodic review of the validated state;
- backup, recovery and business-continuity procedures.
Software may include Part 11-ready capabilities and still be used non-compliantly if it is configured incorrectly, tested inadequately or operated outside approved procedures.
ACTide Designer supports the configuration of studies and data-collection instruments within the ACTide ecosystem. That configuration must remain part of a controlled, verified and documented process before production use.
A suitable technology partner should offer more than a commercial compliance checklist. It should help sponsors and CROs obtain evidence showing how requirements, configuration, testing and change control fit together.
What to assess in compliant platform
There is no single “Part 11 certification” that automatically transfers compliance from a vendor to a sponsor or CRO.
Vendor qualification must assess both the technology and the quality system supporting it.
Access controls
Confirm that the platform supports:
- individual user accounts;
- granular roles and permissions;
- least-privilege access;
- controlled activation and deactivation;
- session controls;
- risk-appropriate authentication;
- logging of access attempts and critical activities.
Records and audit trails
Ask how complete, readable and exportable copies are created. Confirm that audit trails and signatures remain linked to the underlying records and available throughout the retention period.
Integrity, backup and continuity
Backup and disaster-recovery processes should be documented and tested. Ask about recovery objectives, test frequency, incident management and the return or migration of data at contract termination.
Validation and change control
The provider should make documentation, test evidence and release information available to support system assessment. Responsibilities for validating the core software, study configuration and integrations must be unambiguous.
Native integrations and controlled data flows
When EDC, randomisation and safety tools operate in separate environments, interfaces and transfers become critical control points.
Integrated capabilities such as ACTide RTSM and ACTide Safety Tool may reduce fragmentation, but every flow must still be specified, tested, monitored and included in the validation scope.
4 questions to ask your vendor
Before entrusting regulated study data to a platform, sponsors and CROs should ask:
- What validation evidence do you provide for the core software, study configuration and updates?
- How are the signer, signing time, meaning of the signature and signed record linked?
- Can we reconstruct and export a complete, readable and tamper-protected audit trail?
- How do you manage access, backups, incidents, system changes and data retention?
The answers should be supported by documents, procedures and demonstrations—not merely a claim of compliance.
ACTide brings data collection, controls, traceability and operational tools together in an ecosystem designed for clinical research.
Request a demo to review audit trails, signatures, access management and validation workflows against a use case relevant to your study.