21 CFR Part 11: What Labs Actually Get Wrong
July 20, 2026 · Matt Citardi
Part 11 compliance is frequently misunderstood — either over-engineered into paralysis or under-implemented until an audit surfaces the gaps. Here's a grounded take.
21 CFR Part 11 has been in effect since 1997. It governs the use of electronic records and electronic signatures in FDA-regulated environments. Nearly three decades later, I still encounter labs that are either treating it as a binary pass/fail checkbox or building elaborate compliance architectures around requirements that don't actually apply to them.
The regulation is not complicated. The implementation is complicated. Here are the four areas where labs most consistently get it wrong.
1. Scope confusion
Part 11 applies to electronic records required by FDA regulations or submitted to the FDA. It does not apply to every electronic document in a regulated facility. I've seen labs spend months validating systems with no Part 11 obligation, and I've seen labs leave actual Part 11 records in spreadsheets with no audit trail. Start with scope. Map your records. Identify which ones are predicate rule records. That exercise alone will focus your resources where they belong.
2. Audit trails treated as optional
Section 11.10(e) requires computer-generated, time-stamped audit trails that record what changed, when, and by whom — with the previous value preserved. Logging that a record was changed is not enough. I still encounter LIMS implementations where audit trail functionality was never enabled, misconfigured, or disabled post-go-live and never re-enabled. In an FDA inspection, that is a serious finding.
3. Electronic signatures misconfigured
Part 11 electronic signatures are not a typed name in a field. Section 11.50 requires the printed name of the signer, date and time, and the meaning of the signature. Section 11.100 requires each signature be unique to one individual and never reassigned. Many LIMS systems support compliant e-signatures but are not configured to be compliant by default. The difference between a system that can support Part 11 and one that is configured to meet it is a validation exercise — and it is not a small one.
4. Treating validation as a document exercise
A binder full of validation documents does not make a system validated. Validation means demonstrating with documented evidence that a system does what it is supposed to do, consistently, in its intended environment. IQ, OQ, and PQ protocols that test real functions. Requirements traceability that connects user requirements to test cases. Change control that ensures modifications are assessed and documented. The FDA's expectation is not a specific format — it's a demonstration that you understood the risk and tested appropriately.
A focused LIMS health assessment looking at your Part 11 obligations, audit trail configuration, e-signature setup, and validation documentation is usually a half-day exercise for someone who knows what they're looking at.
If you're heading into an audit and aren't confident in your posture, that's a fixable problem. Book a free 30-minute call and we'll figure out where you stand.