AccuraTrials
Sign inBook a walkthrough

Part 1121 CFR

21 CFR Part 11, clause by clause.

Fifteen citations, what each one asks for, and what this platform does about it. Written so a quality group can check it rather than take it on trust.

Request the documentsCompliance overview

Regulationwhat it governs

What the regulation actually requires.

Part 11 sets the conditions under which the FDA treats an electronic record and signature as equivalent to paper and ink, and the cost of not being able to demonstrate it is a Form 483 observation or data an agency will not accept. The two tables below map Subpart B and Subpart C to specific implementation, and say which controls are architectural rather than configurable, because that difference is what a quality group is actually asking about.

Subpart Belectronic records

Electronic records, §11.10.

CitationWhat it requiresWhat we do
§11.10(a)Validation of systems to ensure accuracy, reliability and consistent intended performanceAn automated compliance suite continuously checks hash-chain integrity, signature-record binding, access-control enforcement and lock immutability.
§11.10(b)Ability to generate accurate and complete copies of records in human-readable and electronic formExports to PDF, Excel, CSV, ODM XML and tab-delimited, each with its audit trail, plus a regulatory endpoint that packages a submission-ready set.
§11.10(c)Protection of records to enable accurate and ready retrieval throughout the retention periodAES-256 encrypted backups with key rotation, geographic redundancy, point-in-time recovery and checksum verification.
§11.10(d)Limiting system access to authorized individuals39 permissions scoped per study and per site, enforced at the API layer rather than only in the interface, so a hidden button is never the control.
§11.10(e)Secure, computer-generated, time-stamped audit trails that do not obscure previously recorded informationAn append-only log records timestamp, identity, field, prior value, new value and a mandatory reason, each entry hash-chained to the one before so tampering is detectable rather than merely unlikely.
§11.10(f)Operational system checks to enforce permitted sequencing of steps and eventsField rules run at entry, cross-form checks catch conflicting values, and visit sequencing comes from the study schedule rather than from site discipline.
§11.10(g)Authority checks to ensure only authorized individuals can use the system and access an operation or deviceDevice fingerprinting flags an unrecognized browser, a new login invalidates the previous session, and idle timeout forces re-authentication.
§11.10(h)Device checks to determine the validity of the source of data input or operational instructionEvery request is authenticated, origins are restricted by CORS policy, rate limits bound automated abuse, and mutations carry CSRF protection.
§11.10(i)Persons who use the system have the education, training and experience to perform their tasksA training module assigns curricula, tracks progress and holds certification records, and completion is itself audit-logged so the evidence is retrievable.
§11.10(k)Controls over systems documentation, including revision and change controlA closed system carrying the full §11.10 control set, with document-level encryption available for the open-system case §11.30 contemplates.

Subpart Ce-signatures

Electronic signatures, §11.50 to §11.300.

CitationWhat it requiresWhat we do
§11.50Signature manifestations must show printed name, date and time of signing, and the meaning of the signatureEvery signature record carries the signer’s full name, a server-generated timestamp and a mandatory reason, all three visible on the signed document.
§11.70Signature and record linking, so signatures cannot be excised, copied or otherwise transferredA signature is cryptographically bound to the exact record version it signed, so it cannot be applied retroactively, copied or transferred.
§11.100Each electronic signature is unique to one individual and is not reused or reassignedUnique credential pairs are enforced system-wide, with complexity, expiry and rotation policies, and an identity is never reassigned.
§11.200Signatures not based on biometrics must employ at least two distinct identification componentsBoth username and password are re-entered at the moment of signing, in a session already bound to a fingerprinted device.
§11.300Controls over identification codes and passwords to ensure their security and integrityUnique identification codes, password aging and rotation, lockout after repeated failures, and temporary passwords that must be changed on first use.
AccuraTrials audit trail listing timestamped, attributed entries with prior and new values
Append-only audit trail §11.10(e)
AccuraTrials electronic signature dialog requiring username and password re-entry with a reason for signing
Two components at signing §11.200

AIunder Part 11

Part 11 predates generative models. The controls still apply.

Protocol parsing, rule drafting and anomaly detection are model-driven here, and none of them are exempt from the controls above. An AI action is an action: attributed, timestamped and reviewable on the same terms as a human one.

Recorded
Every prompt, suggestion, acceptance, rejection and edit is written to the same hash-chained audit trail with a timestamp and an identity attached.
Reviewed
A suggestion is never applied on its own. A qualified person applies it, and that act is the authorizing event in the record.
Traceable
Asked where a rule came from, the trail answers in order: model suggested, person reviewed, person modified, person applied, rule activated.

How the semantic layer makes that checkable

FAQthe questions

Part 11 questions.

Are the Part 11 controls on by default?

Yes. Audit trail, e-signature, access control and session management are architectural, enabled on every deployment, and not sold as an optional module. There is no configuration in which they are off.

How is audit trail integrity protected?

Entries are append-only and hash-chained, so each one depends on the one before it. No user, administrators included, can edit or delete an entry, and timestamps are server-generated so a client clock cannot be used to reorder history.

What happens during an FDA BIMO inspection?

Audit-ready exports can be produced on demand for any subject, visit or form, and the compliance suite provides dated evidence of ongoing system validation. Signature records carry all three §11.50 manifestation elements.

Can AI-generated content be used on a regulated study?

A suggestion is a recommendation, not an automated decision, and the trail captures the whole chain from prompt to applied value. Human authorization is required for every change that reaches a live study.

Is this a claim of certification?

No. Part 11 is a regulation a sponsor demonstrates compliance with, not a certificate a vendor holds. What we can provide is the control set above, the validation evidence behind it, and documentation to support your own qualification.

Morerelated

Nextthe ask

Send this to your quality group and let them push back.

Validation approach, compliance posture and security summary available on request. Thirty minutes with both founders if they want to argue with it.

Request the documentsSee the platform