Part 11 applies to records that other FDA regulations require (the predicate rules) when those records are kept in electronic form, and to electronic signatures used in place of handwritten ones. Its core requirements include validated systems, secure and time-stamped audit trails, access controls, and electronic signatures that are unique to one individual and linked to their record.
Why it matters for labeling
Software used to review, compare or approve labeling creates records that support a release decision, such as comparison reports and approvals. Those records, and the signatures on them, fall under Part 11 when they support an FDA-regulated activity. A tool that can't show who reviewed which version, when, and what changed leaves a gap in the evidence an inspector asks for.
Common mistakes
- Treating a log of logins as a Part 11 audit trail, when it needs to record what changed and not only who accessed the system
- Using shared logins or role-based signatures instead of signatures unique to one person
- Validating a system at go-live and never revisiting it
- Assuming Part 11 compliance also covers EU requirements, which add their own expectations under Annex 11