Guidance for Industry FDA 21 CFR Part 11, Electronic Records; Electronic Signatures — Scope and Application
III. DISCUSSION
A. Overall Approach to Part 11 Requirements:
As described in more detail below, the approach outlined in this guidance is based on three main
elements:
- Part 11 will be interpreted narrowly; we are now clarifying that fewer records will be considered subject to part 11.
- For those records that remain subject to part 11, we intend to exercise enforcement discretion with regard to part 11 requirements for validation, audit trails, record retention, and record copying in the manner described in this guidance and with regard to all part 11 requirements for systems that were operational before the effective date of part 11 (also known as legacy systems).
- We will enforce all predicate rule requirements, including predicate rule record and recordkeeping requirements.
It is important to note that FDA's exercise of enforcement discretion as described in this guidance is limited to specified part 11 requirements (setting aside legacy systems, as to which the extent of enforcement discretion, under certain circumstances, will be more broad). We intend to enforce all other provisions of part 11 including, but not limited to, certain controls for closed systems in § 11.10. For example, we intend to enforce provisions related to the following controls and requirements:
- limiting system access to authorized individuals
- use of operational system checks
- use of authority checks
- use of device checks
- determination that persons who develop, maintain, or use electronic systems have the education, training, and experience to perform their assigned tasks
- establishment of and adherence to written policies that hold individuals accountable for actions initiated under their electronic signatures
- appropriate controls over systems documentation
- controls for open systems corresponding to controls for closed systems bulleted above (§ 11.30)
- requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)
We expect continued compliance with these provisions, and we will continue to enforce them. Furthermore, persons must comply with applicable predicate rules, and records that are required to be maintained or submitted must remain secure and reliable in accordance with the predicate rules.
FDA 21 CFR Part 11 Guidelines for Pharmaceuticals: Background: