If you work on control systems for a pharmaceutical, biotech, or medical device manufacturer, you’ve probably heard the phrase “the system needs to be Part 11 compliant” tossed around in a project kickoff meeting, usually without much explanation of what that actually means for your PLC program, your HMI, or your historian.
What is 21 CFR Part 11 about?
21 CFR Part 11 is the FDA regulation that governs when electronic records and electronic signatures can be treated as equivalent to paper records and handwritten signatures.
It doesn’t dictate how you build a control system, but it does dictate what your system has to be able to prove about the data it creates, stores, and lets people sign off on.
This article breaks down what Part 11 actually requires, who it applies to, and, since this is a controls-focused site, what it means in practice for the PLCs, SCADA platforms, and MES/historian layers you’re specifying or programming.
What Is 21 CFR Part 11?
21 CFR Part 11 is Title 21, Part 11 of the U.S. Code of Federal Regulations, issued by the FDA in 1997.
It applies to any organization regulated by the FDA pharmaceutical manufacturers, biologics and biotech companies, medical device makers, and food producers falling under FDA oversight, that chooses to keep records electronically instead of on paper or that uses electronic signatures instead of wet-ink ones.
The regulation exists because electronic records are trivially easy to alter without leaving a trace, unless the system is specifically designed to prevent that.
Part 11 sets the baseline controls that make an electronic record trustworthy enough to stand in for a paper one during an FDA inspection or a product liability dispute.
It’s split into two main subparts.
- Subpart B covers electronic records, creation, modification, maintenance, retention, and retrieval.
- Subpart C covers electronic signatures, how a system verifies who signed something and binds that signature to the specific record.
Who Does Part 11 Apply To?
Part 11 applies to FDA-regulated companies and, by extension, to their suppliers and integrators. In practice, that means.
- Pharmaceutical and biopharmaceutical manufacturers (batch records, cleaning validation, environmental monitoring).
- Medical device manufacturers (device history records, quality records).
- Biotech and cell/gene therapy producers.
- Food and beverage companies subject to FDA rules (less commonly, but it does happen).
- The systems integrators, OEM machine builders, and controls engineers who build or program equipment for the above are also involved.
If you’re building a skid, a filling line, or a bioreactor control panel that will run under a GxP quality system, Part 11 compliance is your customer’s problem, but it becomes your problem the moment they hand you a validation requirements document.
The Core Requirements, in Plain Language
Part 11 is written in regulatory language, but the requirements translate into a fairly specific set of engineering features. Here’s what a compliant system actually has to do.
Audit Trails
Every creation, modification, or deletion of a regulated electronic record has to be captured automatically in a secure, computer-generated, time-stamped audit trail.
The audit trail must record who made the change, what was changed, and when, and, critically, it must not overwrite or obscure the previous data.
You need the old value, the new value, and the reason for the change if the system prompts for one.
For a controls engineer, this means your historian, MES, or batch execution system needs audit trail functionality built in and enabled, not bolted on after the fact.
Most modern SCADA and historian platforms (Ignition, FactoryTalk, PI System, and Wonderware/AVEVA) support this functionality natively, but it has to be configured and validated, not just present.
System Validation
The system has to be validated to ensure accuracy, reliability, and the ability to detect invalid or altered records.
This phase is where controls work intersects with quality. Your IQ/OQ/PQ (Installation, Operational, and Performance Qualification) documentation is how you demonstrate this to an auditor.
Access Controls
The system must limit access to authorized individuals. That means individual user accounts (not shared logins), role-based permissions, and the ability to prove that only the right people could have made a given change.
Generic “Operator” or “Admin” logins shared across a shift are one of the most common Part 11 findings in an audit.
Electronic Signatures
Where the regulated process requires a signature releasing a batch, approving a deviation, or confirming a setpoint change, the electronic signature has to include the signer’s printed name, the date and time, and the meaning of the signature (e.g., “reviewed by,” “approved by”).
It must be unique to one individual, not reassignable, and cryptographically or procedurally linked to the record it signs.
Part 11 also requires two distinct identification components for a signature, typically a username and a password used together, not a single factor.
Record Retention and Retrievability
Records have to be retained for as long as required by the applicable predicate rule (the underlying FDA regulation, like 21 CFR Part 211 for drug manufacturing) and must remain accurate and readily retrievable throughout that period, including after software upgrades or system migrations.
Operational System Checks
The system should enforce the correct sequence of steps and events where that sequence matters, for example, not letting an operator record a “cleaning complete” step before “cleaning started” has been logged.
Part 11 and the Controls Stack: Where It Actually Lives
Part 11 doesn’t care about PLC programming style. It cares about the electronic records your system produces. But those requirements land on specific layers of a typical automation architecture:
| Layer | Part 11: Relevance |
|---|---|
| PLC / PAC | Generally not itself the “system of record,” but if it holds recipe parameters, setpoints, or interlocks that feed a batch record, its data integrity is important. |
| HMI | Should not allow silent overwrites of process data; operator actions affecting quality should be logged upstream. |
| SCADA / Historian | Primary layer for audit trails, data retention, and electronic record storage. |
| MES / Batch Execution | Where electronic signatures, e-batch records, and workflow enforcement typically live. |
| LIMS / QMS | Handles lab data and quality records, often the most heavily audited system. |
A common mistake on greenfield projects is treating Part 11 as a software licensing checkbox: “Our SCADA platform has an audit trail module, so we’re compliant.”
The FDA doesn’t certify software as Part 11 compliant; there’s no such thing as a “Part 11-certified” PLC or HMI.
Compliance is a property of the validated system as configured and used, not a feature you can buy off a spec sheet.
Common Part 11 Compliance Gaps in the Field
From a controls engineering standpoint, these are the issues that most often surface during validation or audit:
- Shared operator logins on HMIs, breaking the individual accountability requirement.
- Unenforced password complexity or expiration, weakening signature integrity.
- Audit trail review is not happening. The feature is enabled, but nobody’s periodically reviewing it.
- Time synchronization gaps across PLCs, historians, and MES, making timestamps inconsistent.
- Uncontrolled changes to PLC logic in a validated system without a formal change control record.
- Hybrid systems, paper printouts of electronic data used as the “official” record, which creates ambiguity about which version is authoritative
Part 11 vs. Related Standards
Part 11 often gets mentioned in the same breath as other compliance and quality frameworks. Here’s how it fits.
| Standard | Focus | Relationship to Part 11 |
|---|---|---|
| GAMP 5 | Risk-based approach to validating computerized systems | The practical playbook most companies use to achieve Part 11 compliance. |
| ALCOA+ | Data integrity principles (Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, and Available). | The underlying data-integrity philosophy that Part 11 requirements are built to enforce. |
| 21 CFR Part 211 | cGMP for finished pharmaceuticals. | A “predicate rule,” Part 11, governs the electronic records that Part 211 requires you to keep |
| EU Annex 11 | EU equivalent for computerized systems in GMP environments. | Similar intent, different regulatory body. Many global companies design to satisfy both. |
FAQ
Does Part 11 apply if I still use paper records?
No. If a process is entirely paper-based and uses wet-ink signatures, Part 11 does not apply to that process.
It only applies once you choose to use electronic records or electronic signatures in place of paper.
Is there an official “Part 11 certification” for software?
No. The FDA does not certify or approve specific software products as Part 11 compliant. Vendors may market features that support compliance, but compliance is determined by how the system is configured, validated, and used at your site.
Does a PLC need to be Part 11 compliant?
The PLC itself is rarely the system of record for Part 11 purposes, but if PLC-held data (recipes, setpoints, interlocks) feeds a system that produces regulated records, its data integrity and change control still matter to the overall compliance picture.
What happens if a company isn’t Part 11 compliant?
FDA inspectors can issue a Form 483 observation or a warning letter, and in serious cases, records found to lack integrity can be excluded as evidence of compliance — which can hold up product approval or trigger a recall.
Does Part 11 require biometric signatures?
No. Part 11 allows non-biometric electronic signatures as long as they use at least two identification components (like a username and password) combined and controlled so they can only be used by their genuine owner.
