Part 11,clause by clause.
Fifteen citations: what each asks for and what the platform does. Written for a quality group to check, not to take on trust.
The regulation
What Part 11actually requires.
The conditions under which the FDA treats an electronic record and signature as paper and ink. Failing to show them costs a Form 483 observation, or data an agency will not accept.
10
Record controls
§11.10, (a) to (k)
5
Signature sections
§11.50 to §11.300
0
Configurations that turn them off
Architectural, on every deployment
Subpart B
Electronic records,§11.10.
Pick a clause. Each one is on in every deployment.
§11.10(a) · Validation
Validation of systems to ensure accuracy, reliability and consistent intended performance
An automated compliance suite continuously checks hash-chain integrity, signature-record binding, access-control enforcement and lock immutability.
§11.10(b) · Copies
Ability to generate accurate and complete copies of records in human-readable and electronic form
Exports to PDF, Excel, CSV, ODM XML and tab-delimited, each with its audit trail, plus a regulatory endpoint that packages a submission-ready set.
§11.10(c) · Retention
Protection of records to enable accurate and ready retrieval throughout the retention period
AES-256 encrypted backups with key rotation, geographic redundancy, point-in-time recovery and checksum verification.
§11.10(d) · Access
Limiting system access to authorized individuals
39 permissions scoped per study and per site, enforced at the API layer rather than only in the interface, so a hidden button is never the control.
§11.10(e) · Audit trail
Secure, computer-generated, time-stamped audit trails that do not obscure previously recorded information
An append-only log records timestamp, identity, field, prior value, new value and a mandatory reason, each entry hash-chained to the one before so tampering is detectable rather than merely unlikely.
§11.10(f) · Sequencing
Operational system checks to enforce permitted sequencing of steps and events
Field rules run at entry, cross-form checks catch conflicting values, and visit sequencing comes from the study schedule rather than from site discipline.
§11.10(g) · Authority
Authority checks to ensure only authorized individuals can use the system and access an operation or device
Device fingerprinting flags an unrecognized browser, a new login invalidates the previous session, and idle timeout forces re-authentication.
§11.10(h) · Devices
Device checks to determine the validity of the source of data input or operational instruction
Every request is authenticated, origins are restricted by CORS policy, rate limits bound automated abuse, and mutations carry CSRF protection.
§11.10(i) · Training
Persons who use the system have the education, training and experience to perform their tasks
A training module assigns curricula, tracks progress and holds certification records, and completion is itself audit-logged so the evidence is retrievable.
§11.10(k) · Documentation
Controls over systems documentation, including revision and change control
A closed system carrying the full §11.10 control set, with document-level encryption available for the open-system case §11.30 contemplates.
Signatures
Electronic signatures,§11.50 to §11.300.
A signature binds to the version it signed. Edit the record and watch it stop vouching for it.
Signed by the investigator, bound to version 3.
The record changed after signing. The signature still names version 3; version 4 needs its own.
§11.50 · Manifestation
Signature manifestations must show printed name, date and time of signing, and the meaning of the signature
Every signature record carries the signer’s full name, a server-generated timestamp and a mandatory reason, all three visible on the signed document.
§11.70 · Linking
Signature and record linking, so signatures cannot be excised, copied or otherwise transferred
A signature is cryptographically bound to the exact record version it signed, so it cannot be applied retroactively, copied or transferred.
§11.100 · Uniqueness
Each electronic signature is unique to one individual and is not reused or reassigned
Unique credential pairs are enforced system-wide, with complexity, expiry and rotation policies, and an identity is never reassigned.
§11.200 · Two components
Signatures not based on biometrics must employ at least two distinct identification components
Both username and password are re-entered at the moment of signing, in a session already bound to a fingerprinted device.
§11.300 · Passwords
Controls over identification codes and passwords to ensure their security and integrity
Unique identification codes, password aging and rotation, lockout after repeated failures, and temporary passwords that must be changed on first use.
AI under Part 11
Part 11 predates generative models.The controls still apply.
An AI action is an action: attributed, timestamped and reviewable on the same terms as a human one.
- Recorded
- Every prompt, suggestion, acceptance, rejection and edit, in the same hash-chained trail.
- Reviewed
- A suggestion is never applied on its own. A qualified person applies it.
- Traceable
- Ask where a rule came from and the trail answers in order.
FAQ
Part 11,answered plainly.
Are the Part 11 controls on by default?
Yes. Audit trail, e-signature, access control and session management are architectural, enabled on every deployment, and not sold as an optional module. There is no configuration in which they are off.
How is audit trail integrity protected?
Entries are append-only and hash-chained, so each one depends on the one before it. No user, administrators included, can edit or delete an entry, and timestamps are server-generated so a client clock cannot be used to reorder history.
What happens during an FDA BIMO inspection?
Audit-ready exports can be produced on demand for any subject, visit or form, and the compliance suite provides dated evidence of ongoing system validation. Signature records carry all three §11.50 manifestation elements.
Can AI-generated content be used on a regulated study?
A suggestion is a recommendation, not an automated decision, and the trail captures the whole chain from prompt to applied value. Human authorization is required for every change that reaches a live study.
Is this a claim of certification?
No. Part 11 is a regulation a sponsor demonstrates compliance with, not a certificate a vendor holds. What we can provide is the control set above, the validation evidence behind it, and documentation to support your own qualification.
Send this to your quality groupand let them push back.
Validation approach, compliance posture and security summary on request. Thirty minutes with our team if they want to argue with it.
Or email us: jgui@accuratrials.com