FDA 21 CFR Part 11: Compliance Essentials You Should Know

It decides whether your electronic records will stand up as evidence.

For pharmaceutical, food and medical-device companies that export — or plan to — "FDA 21 CFR Part 11" is a phrase that comes up constantly yet is often only half-understood. This article explains in plain language what it really is, why it matters and how AQAC helps you meet it.

What It Actually Is

Issued by the U.S. FDA in 1997, 21 CFR Part 11 sets out the rules for Electronic Records and Electronic Signatures. It states that within FDA-regulated industries, electronic records must carry the same legal weight as paper records, subject to a defined set of technical and procedural safeguards.

Three Core Pillars

• Trustworthy records — original, complete and traceable.

• Valid electronic signatures — uniquely bound to an individual and tamper-evident.

• Complete audit trail — who, when and what, captured for every action.

Five Common Compliance Pitfalls

• System clocks drift by more than one minute from the official timestamp.

• Raw data is overwritten; only post-processed reports survive.

• Shared accounts make it impossible to attribute actions.

• Electronic signatures have no password policy or are never rotated.

• Audit logs are missing, incomplete or can be cleared manually.

AQAC systems are built for Part 11 from the ground up: the audit trail cannot be disabled, signatures leverage PKI digital certificates, and timestamps are synchronised via NTP. Combined with our complete CSV documentation package, customers can meet both domestic and overseas requirements in a single deployment.