21 CFR Part 11 for manufacturers: what it demands of your systems
21 CFR Part 11 is the FDA regulation governing electronic records and electronic signatures. In practice, a system has to guarantee that every record can be tied to a clearly identified person, that any change can be detected, and that all of that evidence can be traced and shown to an auditor. In our view, compliance is not a setting you switch on: it has to be part of how the software is designed and how every piece of data is recorded, changed, and audited.
What the rule is for
21 CFR Part 11 is the US FDA regulation governing the use of electronic records and electronic signatures.
It answers one question. When a paper record with a wet-ink signature is replaced by digital data, what has to be true for that record to remain trustworthy and carry the same weight?
It applies primarily to organisations in FDA-regulated industries such as pharmaceuticals, medical devices, biotech, and parts of food production.
Outside those industries, the same principles are increasingly adopted anyway. Customers, auditors, and certification bodies expect a similar level of data integrity.
The regulation is long. From a system’s point of view, what it demands comes down to three things.
It must be clear who created or approved a record. Records must be trustworthy and any change detectable. All of that evidence must be traceable and presentable to an auditor.
The three properties
1. Attributable: it is clear who did it
Every record must tie back to a clear, identified user. Not a shared account like “operator”, not a terminal, and not just a department name.
That means the system needs unique credentials, enforced password complexity and expiry, and account lockout after failed login attempts. Role-based access has to be enforced on every significant action, not only at the login screen.
Relevant clauses: §11.10(d) and (g) on access control, and §11.300 on credential controls.
2. Tamper-evident: changes can be detected
The audit trail must be secure, computer-generated, time-stamped, and must not remove or obscure previously recorded information.
In practice that means an append-only approach. When a correction is made, the system writes a new record without overwriting the previous one.
One of the strongest approaches is a hash chain. Each entry stores a cryptographic hash of the entry before it, so altering anything mid-chain breaks every link that follows.
The goal is not to make changes impossible, but to make sure they are detectable. That is the principle the regulation actually asks for.
Relevant clause: §11.10(e).
3. Verifiable: it can be checked independently
This is the part most often missed.
If the audit trail can only be inspected by logging into the system that produced it, the auditor is still being asked to trust that system.
A stronger approach is to provide records that carry a verification hash, so their authenticity can be checked against the original data without any access to the system.
Relevant clause: §11.200 on electronic signatures.
What you actually hand the auditor
The three properties above describe how the system should behave. During an audit the question is far more concrete: what evidence can you show for one specific batch?
The Electronic Batch Record (EBR) brings together every important record for a batch. Each lot consumed with its quantity, operator, timestamp, and the scale it was weighed on. Each process parameter with its pass or fail result. Each electronic signature with its content hash.
EDHR applies the same concept at unit level rather than batch level. Alongside them, a generic report can cover any other production view or time range an audit calls for.
The record is hashed the moment it is generated, and that hash is printed in the document footer.
That hash connects the document back to Verify Integrity, so an auditor can check its authenticity without needing an account on your system.
What this looks like in an MES
| Requirement | What the system has to do |
|---|---|
| Audit trail | Record every change down to field level: previous value, incoming value, timestamp, and the user who made it. The history is append-only, with no edit or delete path at any permission level, administrators included. |
| Electronic signature | Each signature is bound to the record it signs and is cryptographically chained. Signatures are applied at defined control points, such as production step completion, quality disposition, or maintenance sign-off. |
| Integrity verification | A printed document carries a hash that a third party can verify without any access to the system. |
| System access log | Record logins, logouts, failed login attempts, account lockouts, and signature verification activity, so all of it is ready for review during an audit. |
| Access control | Role-based access control enforced server-side on every action, rather than by hiding buttons in the interface. |
One principle is worth holding onto.
Append-only has to be part of how the feature is built, not merely a permission that can be changed.
If a security control can still be switched off by an administrator, its strength ultimately depends on the security of that administrator account.
What is the vendor actually responsible for?
No software can make an organisation compliant on its own. Part 11 alignment means the system provides the controls it needs to. Demonstrating compliance remains a shared responsibility.
On the organisation’s side, several things still have to be done:
- Computer system validation (CSV) gives documented evidence that the system performs the functions you have defined, in the configuration you actually run.
- SOPs are written procedures describing how the system is used and how the related processes are carried out.
- Training records show that everyone using the system or signing records has been trained appropriately.
- Periodic review confirms on an ongoing basis that the controls and processes in place still work as intended.
So treat any vendor selling “compliance” as a feature with caution. What you should be looking for is controls and capabilities that support your organisation in meeting the requirements.
Where VECHR MES stands
VECHR MES applies the same signature and audit mechanism consistently across production, quality, and maintenance.
One platform, one audit trail, not strict controls in production and looser ones everywhere else.
- Electronic signatures are hash-chained and designed so that any change can be detected.
- Record integrity can be verified independently, without logging into the system that created the record.
- The audit trail and system access log are append-only, with no edit or delete path, administrators included.
- Access control is enforced on every action, server-side.
Alignment with Part 11 does not mean automatic certification or compliance.
Compliance still depends on how your organisation validates the system, follows its SOPs, and manages its internal processes.
VECHR provides the technical controls that support those requirements, including a clause-by-clause compliance matrix that can be made available to QA and validation teams.
Frequently Asked Questions
If we use a Part 11-aligned MES, are we automatically compliant?
No. Using a Part 11-aligned system does not make an organisation compliant by itself. The system provides the technical controls; your organisation still owns computer system validation (CSV), SOPs, training records, and periodic review. That is why a vendor should offer controls that support compliance, rather than promising compliance itself.
Is an electronic signature just a password prompt?
No. A password prompt only shows that someone entered a credential. An electronic signature has to be bound to a specific record and show who signed, what they signed, when the signature was applied, and in what context. The integrity of the signature must also remain verifiable if the record is altered after signing.
What is a hash-chained audit trail?
Each audit trail entry stores a cryptographic hash of the entry before it. If an earlier entry is altered, its hash changes and breaks every link that follows. The goal is not to make tampering impossible, but to make sure it can be detected.
Can an administrator delete an audit trail entry?
No. In a correctly designed system the audit trail is append-only, meaning records that have been created cannot be edited or deleted, administrators included. That has to be part of the system design, not merely a permission that can be changed.
Does Part 11 apply to maintenance records too?
If maintenance activity can affect product quality or the status of equipment used in a regulated process, its records can form part of the quality record. So activities such as maintenance sign-off should use the same signature and audit trail mechanism as production and quality.