21 CFR Part 11 and Electronic Signatures on Procurement Records

21 CFR Part 11 is the US FDA rule that sets out when electronic records and electronic signatures can be trusted as the equivalent of paper and handwritten signatures. It applies to records that other FDA rules, called predicate rules, require a company to keep, when those records are kept electronically or relied on to do regulated work. At a GMP site, that can include some procurement and vendor records, such as those used to approve suppliers of drug components, while ordinary commercial purchasing usually falls outside it.

This is general information, not legal advice. Your quality and legal teams decide how Part 11 applies to your records.

Why this matters now

More approvals now happen inside procurement and supplier management software rather than on paper. That brings the question of electronic signatures into purchasing teams that never had to think about it. FDA's 2003 guidance narrowed how it applies Part 11, but it did not narrow everything: requirements for electronic signatures, access limits, system checks and training are still enforced in full [1]. FDA's 2018 data integrity guidance adds the expectation that people who review GMP records review the related audit trails too [2].

Part 11 in plain words

Scope. Part 11 sets the criteria for electronic records and signatures to be "trustworthy, reliable" and generally equivalent to paper [3]. FDA's guidance says it interprets that scope narrowly: Part 11 records are those that predicate rules require and that you keep electronically instead of on paper, or keep in both forms but rely on electronically, plus electronic signatures that replace handwritten ones [1]. Records no predicate rule requires are not Part 11 records, even when they are electronic [1].

Closed systems. A closed system is one where access is controlled by the people responsible for the content of the records on it [3]. A company's own procurement platform, or a supplier's platform operated under the company's access control, is normally treated this way.

Controls. Section 11.10 lists controls for closed systems, including validation, accurate copies, record protection, limited access, audit trails, operational, authority and device checks, trained users and control of system documentation [4]. FDA applies enforcement discretion to some of these, such as the specific Part 11 rules on validation, audit trails, copies and retention, while the predicate rules behind them still apply [1].

Signatures. A signed record must show the signer's printed name, the date and time, and the meaning of the signature, such as review or approval, including in printouts and screen displays [5]. Signatures must be linked to their records so they cannot be cut, copied or moved to falsify another record, must be unique to one person and never reassigned, and, for non biometric signatures, must use at least two distinct identification components such as an ID code and a password [3]. Companies must also certify to FDA, on paper, that their electronic signatures are the legal equivalent of handwritten ones [3].

Which procurement records are in scope

The test is always the same: does a predicate rule require this record, and do you keep or rely on it electronically? For example, the US drug CGMP rules let a manufacturer accept a supplier's certificate of analysis instead of full testing only if it carries out at least one identity test and establishes the reliability of the supplier's analyses through validation at appropriate intervals [6]. The records that show that supplier reliability are therefore required records.

FDA recommends deciding in advance, and documenting, which version of a record you rely on when you keep both paper and electronic forms [1]. Do the same for procurement: list the records your site treats as GMP records, and where they live.

What to check in a procurement tool

1. Unique user accounts, with no shared logins, and access limited by role.
2. Audit trail that is secure, computer generated and time stamped, and does not obscure earlier entries [4], with a way to review and export it. See our guide to GMP audit trail requirements.
3. Signature manifestation: name, date, time and meaning shown on screen and in exports.
4. Signature linking: a signature cannot be copied to another record.
5. Two identification components at signing, with credentials entered again for each signing outside a continuous session.
6. Copies and retention: readable exports, such as PDF, that preserve content and meaning; FDA's guidance suggests common formats such as PDF or XML [1].
7. Supplier evidence to support your own validation for your intended use. A tool can support Part 11 use; it cannot be "Part 11 compliant" on its own, because compliance depends on how you configure, validate and operate it.

For the principles behind trustworthy records, see ALCOA+ data integrity.

The EU equivalent: Annex 11

In the EU, GMP Annex 11 covers the same ground. It says electronic signatures should have the same impact as handwritten signatures within the boundaries of the company, be permanently linked to their record, and include the time and date they were applied [7]. Annex 11 also requires audit trails of GMP relevant changes and deletions, based on risk, with a documented reason [7]. A site serving both markets should design one approach that meets both.

Hybrid records: paper and electronic together

Many sites still print an approval, sign it by hand and scan it back into a system. That hybrid approach is allowed, but it needs care. FDA's guidance says that printing records from a system generally does not bring Part 11 into play if the paper meets the predicate rules and is the record you rely on [1]. The risk comes when nobody is sure which version is the official one: the signed paper, the scan, or the electronic record that may have changed since. Write down which is the record of truth for each document type, and make sure the electronic version cannot drift from the signed one without a trace.

Questions to agree with your quality team

• Which procurement and supplier records does our site treat as GMP records?
• Which of those are kept or relied on electronically, and in which system?
• Who may sign what, and what does each signature mean: review, approval or release?
• How often are audit trails on those records reviewed, and by whom?
• Has our company sent FDA the electronic signature certification, and does it cover the systems we use?
• What evidence do we need from each software supplier to support our own validation?

Settling these once, in a short procedure, saves arguing about them on every project.

Practical example

In this illustrative example, a quality manager approves a new supplier of a drug component in the site's procurement system. A sound signature record would show:

Two common failures would undermine it: a shared "quality" login used by several people, which makes the signature unattributable, and an image of a handwritten signature pasted into a PDF, which is not linked to the record and can be copied anywhere.

Where ChemCapital fits

ChemCapital's Trust Centre describes its electronic signatures as Part 11 style, meaning the signer authenticates again at signing and a signed manifest PDF is produced, and does not claim Part 11 compliance. It also describes a tamper evident audit log using a hash chain, with every action linked to the person who took it. Whether any system is suitable for Part 11 records at your site is for your own validation and quality team to decide, and ChemCapital's documentation is a starting point for that assessment, not a substitute for it.

Ready to keep supplier approvals and decisions in one traceable record? Start free with ChemCapital.