21 CFR Part 11 software for compliant electronic records and signatures

What 21 CFR Part 11 software actually has to do

21 CFR Part 11, finalised in 1997 and clarified by the 2003 "Scope and Application" guidance, applies whenever an electronic record or electronic signature is used to satisfy a predicate rule — a Part 210/211, 820, 610, 606 or similar FDA recordkeeping requirement. In practice that covers most of what a GxP-regulated business does with software.

The technical controls Part 11 requires are well understood: validated systems, secure and role-based access, tamper-evident audit trails, operational and authority checks, uniquely attributable e-signatures managed to prevent repudiation, and the ability to produce accurate and complete copies of records in both human-readable and electronic form on inspector request.

Getting these controls right in software is not the hard part. Getting them right without breaking the day-to-day experience of the QA, validation and manufacturing teams who use the software — that is where most Part 11 tools fall down.

Part 11 controls cGen implements out of the box

• Uniquely attributable, re-authenticated e-signatures — the user re-enters credentials on every signature event, not just at session start
• Every signature carries a meaning: Authored, Reviewed, Approved, Witnessed, or Rejected
• Every controlled edit demands a reason-for-change entry before the record can be saved
• MFA on the signature (not just the login) for higher-risk records
• Append-only, tamper-evident audit trail with cryptographic signature hash on every entry
• Human-readable and electronic export of records — including signed PDF/A-3 with embedded XML — for inspector delivery
• ALCOA++ data-integrity markers rendered inline on every record display
• Role-based access with authority checks per operation, not just per module