Insight Brief · 21 CFR Part 11 · EU Annex 11

21 CFR Part 11 applicability:
documenting the decision.

Applicability must be decided per system, recorded with rationale, and reviewed when the system changes. Undocumented assumptions, in either direction, are gaps an inspector will find.

Book a Call ← Back to Insights
The Core Issue

A decision that is
assumed rather than documented.

The Part 11 applicability question should have a clear, recorded answer for every system in your GxP landscape. In practice, it often exists only as an informal consensus: present in institutional memory, absent from any document an inspector can review.

01
What Part 11 actually coversElectronic records created, modified, maintained, archived, retrieved or transmitted under an FDA requirement, and electronic signatures that substitute for handwritten signatures on those records. The scope is defined by the regulatory requirement generating the record, not by the system type.
02
Why assumptions in either direction create risk"We assumed it applied" and "we assumed it didn't" are equally inadequate answers. Without a documented determination, there is no evidence that a considered, risk-based decision was ever made, and inspectors treat undocumented assumptions as gaps, not good faith.
03
When the determination must be revisitedApplicability is not a one-time exercise. If the system changes (new functionality, new user roles, new regulated data flows), the determination must be reviewed. The review itself must be documented with a dated rationale.
What Good Looks Like

A defensible applicability
determination covers three things.

The determination should be documented in a system-specific record, typically within the validation plan or a dedicated regulatory applicability assessment. It is reviewed whenever the system or its intended use changes materially.

01
Scope confirmationDoes this system create, modify, maintain, archive, retrieve or transmit records under an FDA regulatory requirement? The answer must reference the specific regulatory obligations, not just assert compliance.
02
Electronic signature assessmentDoes the system use electronic signatures that substitute for handwritten signatures on regulated records? If yes, which Part 11 signature requirements apply and how are they implemented?
03
Control mappingFor each applicable Part 11 requirement, what is the specific technical or procedural control that demonstrates compliance? This control mapping turns the applicability determination into actionable evidence, not just a scope declaration.
Common Questions

Frequently asked.

Do we need a separate document for each system?
System-by-system, not one blanket statement
Applicability decisions must be made per system. A blanket "all systems are Part 11 compliant" statement does not constitute a documented determination. Each system needs its own recorded rationale based on its specific intended use and regulatory context.
What about EU Annex 11: is the applicability question the same?
Broader scope, similar principle
Annex 11 applies to all computerised systems used in GMP-regulated activities, a broader scope than Part 11's record-specific trigger. In a dual-regulated environment, both frameworks require applicability assessment, and the control frameworks that satisfy each differ in important respects.
What if applicability decisions are missing from existing documentation?
Remediation is legitimate and necessary
Retroactive documentation of applicability decisions is standard remediation. Review each system, assess applicability, document the determination and record the review as a formal quality record. The starting point is now, not reconstructing the past.

Facing a similar challenge?
Let's talk directly.

A focused 30-minute call, no sales process, no commitment. A direct conversation about your environment and where the risk actually sits.

Book a Call Now Prefer to write first? Send a question →