21 CFR Part 11: complete guide for non-US researchers

What 21 CFR Part 11 is

21 CFR Part 11 is the FDA regulation that sets criteria under which electronic records and electronic signatures are acceptable as paper substitutes in FDA-regulated contexts (clinical trials, pharma manufacturing, medical devices).

Does it apply to me outside the US?

Maybe yes, maybe no. It depends on:

• Will data be submitted to FDA? If the study seeks US approval, yes.
• Is there a US sponsor? Generally yes even if executed in the EU.
• Local registry without regulatory intent? Probably no — but Annex 11 (EU GMP) or ICH E6(R2) usually applies.

In practice, if you design the system to meet Part 11, you automatically meet Annex 11. They're not mutually exclusive.

Key requirements to meet

• §11.10(a) System validation — the EDC must be validated (development lifecycle, tests, change control).
• §11.10(b) Ability to generate copies — records exportable in human-readable form.
• §11.10(c) Records protection — integrity preserved throughout the required retention period.
• §11.10(d) Access limitation — RBAC mandatory.
• §11.10(e) Audit trail — computer-generated, timestamped, append-only.
• §11.200 Electronic signatures — bound to the signer with at least two identification components.

What you should do as an investigator

1. Choose an EDC that explicitly documents its Part 11 stance (Trialinx does at /compliance/21-cfr-part-11).
2. Request the system validation package. A well-informed sponsor will ask for it during setup.
3. Document SOPs for using the system: who publishes forms, who signs, how queries are managed.
4. Train your team on electronic signature responsibilities. Never share credentials.
5. Archive records after study closure per sponsor policy (typically 15+ years).

The most common mistake

Thinking that "buying" an EDC covers Part 11 on its own. It doesn't: Part 11 compliance is a shared responsibility between the vendor (technical controls) and the user (organizational procedures + use validation).

Conclusion

Part 11 isn't optional if your data go to FDA. But it's not incompatible with a modern EDC. Trialinx is designed from the first commit assuming records are electronic, indefinite retention, granular audit trail by default — exactly what Part 11 asks for.