Facts checked October 27, 2026.
When does Part 11 apply?
Part 11 applies to records in electronic form that must be kept or submitted under other FDA regulations (the predicate rules) [1]. FDA's 2003 Scope and Application guidance interprets this narrowly. It focuses on records that are required by a predicate rule and that are maintained or relied on electronically [2]. For clinical investigations, FDA's October 2024 final guidance, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers, covers EDC, DHTs and eCOA [3].
What does FDA enforce today?
Under the Scope and Application guidance, FDA intends to exercise enforcement discretion for certain Part 11 requirements: validation, audit trails, record retention and record copying. FDA does, however, still enforce the predicate rules [2]. FDA notes that "part 11 remains in effect" and that the discretion is limited to what the guidance identifies [2]. Access controls, signature controls and the other requirements still apply.
What are the key requirements?
Controls for closed systems (§ 11.10) [1]:
- (a) system validation
- (b) accurate and complete copies
- (c) record protection for the retention period
- (d) limiting access to authorized individuals
- (e) secure, computer-generated, time-stamped audit trails that don't obscure prior entries
- (f) operational checks
- (g) authority checks
- (h) device checks
- (i) trained personnel
- (j) written accountability policies
- (k) controls over system documentation
Other sections:
- Open systems (§ 11.30): the closed-system controls plus measures such as encryption and digital signature standards where appropriate [1].
- Signature manifestations (§ 11.50): the printed name, the date/time and the meaning of the signature (e.g., review or approval) [1].
- Signature/record linking (§ 11.70) [1].
- General e-signature requirements (§ 11.100): each signature is unique to one individual, identity is verified, and organizations must certify to FDA that their e-signatures are the legally binding equivalent of handwritten signatures [1].
- E-signature components (§ 11.200) and ID/password controls (§ 11.300) [1].
Checklist for eCOA, wearable and EDC startups
- Map which records are predicate-rule records. Examples: source data, eCOA responses, wearable data used as a study endpoint.
- Use risk-based validation: requirements, testing and traceability, scaled to the risk to data integrity.
- Use immutable, time-stamped audit trails for create, modify and delete actions, recording who, what, when and why.
- Use role-based access, unique user IDs, and session and password controls.
- For e-signatures, show the name, date/time and meaning, link the signature to the record, and send the non-repudiation letter to FDA.
- Plan data retention and export: human-readable and electronic copies for inspectors.
- For wearable DHT data, define what the source record is, such as raw sensor data vs derived metrics, and preserve provenance through processing [3].
- Assess vendors and cloud providers, and put quality agreements in place.
- Keep training records and SOPs.
How PAHL helps
Palo Alto Health Labs helps teams design audit-ready data architecture for eCOA, wearable and research platforms:
- audit trails,
- access control,
- data provenance, and
- validation plans.
We draw on hands-on experience building clinical research platforms. We don't certify compliance or replace your QA or regulatory function. Book a 30-minute scoping call.
Sources (accessed October 27, 2026)
- eCFR, 21 CFR Part 11, Electronic Records; Electronic Signatures: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11
- FDA, Part 11, Electronic Records; Electronic Signatures — Scope and Application (August 2003): https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application
- FDA, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 2024, final): https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-systems-electronic-records-and-electronic-signatures-clinical-investigations-questions
Frequently asked questions
Is Part 11 still in force?
Yes. FDA states that "part 11 remains in effect," with enforcement discretion for specified requirements.
Does a consumer wellness app need Part 11?
Not unless it creates or holds records required by an FDA predicate rule, for example when it is used in a clinical investigation.
Do I need to notify FDA about e-signatures?
Yes. § 11.100(c) requires a certification signed by hand and submitted to FDA.
Are electronic signatures and biometrics allowed?
Yes. §§ 11.200 and 11.300 set the controls.
Related
Questions
Is Part 11 still in force?
Yes. FDA states that "part 11 remains in effect," with enforcement discretion for specified requirements.
Does a consumer wellness app need Part 11?
Not unless it creates or holds records required by an FDA predicate rule, for example when it is used in a clinical investigation.
Do I need to notify FDA about e-signatures?
Yes. § 11.100(c) requires a certification signed by hand and submitted to FDA.
Are electronic signatures and biometrics allowed?
Yes. §§ 11.200 and 11.300 set the controls.