Document Management for Life Sciences: FDA 21 CFR Part 11 & GMP Records
FDA 21 CFR Part 11 sets the criteria under which electronic records and electronic signatures are considered trustworthy and equivalent to paper (§ 11.1). For closed systems, § 11.10 requires system validation, human-readable and electronic copies for the agency, protected retrieval, access limits, and secure time-stamped audit trails. cGMP 21 CFR 211.180 requires batch records to be kept at least one year past expiration and permits accurate reproductions, the basis for digitizing paper records into a validated repository.
Most writing about "21 CFR Part 11" comes from software vendors selling a cloud license. This guide is written from the implementer's chair: an Emmaus-based records partner that actually digitizes paper batch records and validation protocols, configures the validated ECM, and stands up the SOP, training, CAPA, and change-control workflows on-site for regional life-sciences manufacturers. The question we answer is how a regulated records system is built and inspection-readied — not which tool to buy.
What 21 CFR Part 11 actually requires
21 CFR Part 11 sets the criteria under which FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper (§ 11.1). Part 11 § 11.3 defines an electronic record as any combination of text, graphics, data, audio, pictorial, or other information in digital form created, modified, maintained, archived, retrieved, or distributed by a computer system; and an electronic signature as a data compilation of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of that individual's handwritten signature.
The closed-system controls in § 11.10
For closed systems, § 11.10 lays out the controls a document management system has to provide. These are the line items an FDA inspector measures the system against:
The audit-trail rule (11.10(e)) is non-negotiable: changes must not obscure previously recorded information, and audit-trail documentation must be retained for at least as long as the subject electronic records and be available for agency review and copying. A repository without an independent, time-stamped, tamper-evident audit trail is not Part 11-ready.
cGMP record retention: the predicate rule
Part 11 does not exist in a vacuum — it attaches to whatever record an FDA 'predicate rule' requires. For drug manufacturers, the predicate rule is cGMP. Under 21 CFR 211.180(a), any production, control, or distribution record specifically associated with a batch of a drug product must be retained for at least one year after the batch's expiration date — or, for certain OTC drug products without expiration dating, three years after distribution of the batch. Critically, 211.180(d) allows those records to be kept either as original records or as true copies such as photocopies, microfilm, microfiche, or other accurate reproductions, which is the regulatory basis for digitizing and scanning batch records.
| Record type | Minimum retention | Citation |
|---|---|---|
| Batch production / control / distribution record | At least 1 year after batch expiration date | 21 CFR 211.180(a) |
| Certain OTC products without expiration dating | 3 years after distribution of the batch | 21 CFR 211.180(a) |
| Permitted formats for any cGMP record | Original OR true copy (photocopy, microfilm, microfiche, accurate reproduction) | 21 CFR 211.180(d) |
History and the risk-based turn
The Part 11 final rule was published March 20, 1997 and became effective August 20, 1997, establishing FDA's framework for electronic records and electronic signatures. In 2003, FDA's guidance 'Part 11, Electronic Records; Electronic Signatures — Scope and Application' narrowed Part 11's scope and introduced a risk-based approach, tying Part 11 controls to the underlying predicate-rule requirements and signaling enforcement discretion for certain Part 11 requirements where records are trustworthy and other controls exist. More recently, in October 2024 FDA published final guidance on electronic systems, records, and signatures in clinical investigations, updating how Part 11 applies to systems used in clinical research.
An inspector does not certify your software. They evaluate the validated system you operate — the configuration, the audit trail, the SOPs, and the training records around it.
How Reynolds builds a Part 11-ready records system
Reynolds' life-sciences 21 CFR Part 11 documentation systems provide electronic records and signatures meeting FDA requirements, with document control, training records, and batch documentation backed by complete audit trails. Reynolds configures Laserfiche for life sciences as a Part 11-compliant ECM with electronic signatures, automated retention, and version-controlled SOPs — paired with the procedural controls an inspector expects alongside the technology.
Reynolds Business Systems brings 55+ years in business and a stated 100% client retention rate to the work — the kind of stability a regulated manufacturer needs from the partner that holds its records system.
Where to go next
If you manufacture in a regulated environment and need a records system that holds up to inspection, start with Reynolds' life sciences records & compliance solutions to see how a validated ECM, GMP workflows, and FDA documentation scanning come together.
To dig into the platform that runs it, review Reynolds' Laserfiche ECM for regulated records, or learn how paper batch records and validation protocols are converted with our
document scanning & digitization services. Request an assessment to map your current records to a Part 11-ready system.
Sources Cited
7 REFS- U.S. Government Publishing Office (GovInfo)
- Cornell Law School, Legal Information Institute
- Electronic Code of Federal Regulations (eCFR)
- U.S. Food & Drug Administration
- Reynolds Business Systems
