Understanding Part 11 in FDA Inspections: Key Considerations for Pharmaceutical and Medical Device Companies

The Myth of “Part 11-Specific Inspections”

When conducting consultations and seminars for medical device companies, one question inevitably arises: how to prepare for Part 11 inspections. While Part 11 compliance is indeed important, it’s crucial to understand that Part 11 compliance is a means to an end, not an end in itself.

The fundamental truth is this: there is no such thing as a “Part 11-specific inspection.” FDA does not conduct standalone inspections focused exclusively on 21 CFR Part 11 compliance. Rather, inspections are conducted according to the applicable quality system regulations, and Part 11 requirements are evaluated as part of these broader inspections.

How Part 11 Fits into FDA Inspections

For Pharmaceutical Companies

Inspections of pharmaceutical companies are conducted in accordance with current Good Manufacturing Practice (cGMP) regulations, primarily under 21 CFR Parts 210 and 211. During these inspections, if issues are identified with the reliability or integrity of electronic records, inspectors may cite 21 CFR Part 11 as the regulatory basis for their observations.

For Medical Device Companies

Medical device manufacturers are inspected under the Quality System Regulation (QSR), codified as 21 CFR Part 820. Important regulatory update: As of February 2, 2026, the QSR will be superseded by the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. This harmonization with international standards represents a significant regulatory evolution, though the fundamental principles of quality management and data integrity remain consistent.

During inspections under either QSR or the new QMSR, when electronic record integrity issues are discovered, Part 11 serves as the regulatory foundation for related observations.

The Inspector’s Approach: Integration, Not Isolation

FDA inspectors do not arrive at facilities with a “Part 11 checklist” as their primary inspection tool. Instead, they assess the overall quality system—examining manufacturing processes, design controls, corrective and preventive actions (CAPA), complaint handling, and other system elements. Electronic records are evaluated within this broader context.

When inspectors encounter electronic records during their review of quality system processes, they assess whether these records are trustworthy, reliable, and equivalent to paper records. If deficiencies are found—such as inadequate audit trails, insufficient access controls, or inability to prevent record manipulation—Part 11 provides the regulatory framework for citing these deficiencies.

The Misguided “Paper as Official Record” Strategy

Many pharmaceutical and medical device companies, concerned about Part 11 citations, have adopted a strategy of designating paper records as the “official” or “master” records. This approach, however, can create more problems than it solves and may even provoke FDA scrutiny.

Why FDA Prefers Electronic Records

FDA has a clear preference for electronic records during inspections for several practical reasons:

1. Speed of Access: Electronic records can be retrieved and reviewed immediately, whereas paper documents must be physically located, copied, and provided to inspectors—a time-consuming process.
2. Volume Management: When inspectors need to review or copy extensive documentation, electronic formats are far more manageable than large volumes of paper.
3. Data Integrity Assessment: Electronic systems with proper controls (audit trails, access restrictions, time stamps) actually provide stronger evidence of data integrity than paper records.
4. Efficiency and Modernization: FDA recognizes that electronic systems, when properly implemented, offer better oversight, traceability, and quality assurance than paper-based systems.

The Reality of “Paper as Official” Claims

Even when companies officially designate paper as their official records, if the actual work processes rely on electronic systems, FDA will likely consider the electronic records as the true source records. This determination is based on practical reality rather than procedural designation.

For example, if laboratory instruments generate electronic data that is then printed for signatures, or if manufacturing batch records are created electronically and then printed, FDA will view the electronic versions as the actual source data—regardless of any company policy stating otherwise.

Critical Understanding: Process-Based Application of Part 11

A crucial point that companies often misunderstand is this: Part 11 applies based on how records are created and managed during processes, not solely on the final format of the record.

If electronic records are created, modified, maintained, archived, retrieved, or transmitted at any point in a regulated process—even if the final output is paper—then Part 11 requirements apply to those electronic records throughout their lifecycle.

Practical Examples:

• Laboratory Testing: If an analytical instrument generates electronic data that is reviewed on screen before being printed and signed, Part 11 applies to the electronic data, even if the printed report is filed as the “official” record.
• Batch Manufacturing: If batch manufacturing records are created in an electronic system, reviewed electronically, and then printed for final approval, Part 11 applies to the electronic records throughout this process.
• Document Management: If procedures, specifications, or protocols are drafted, reviewed, and approved electronically—even if they are ultimately printed for use on the production floor—Part 11 applies to the electronic document management system.

Current Regulatory Landscape and Recent Developments

2024 FDA Guidance on Electronic Systems

In October 2024, FDA finalized comprehensive guidance on “Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers.” While this guidance focuses on clinical trials, it reflects FDA’s current thinking on electronic records generally and reinforces several key principles:

• Electronic records and signatures must be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures
• A risk-based approach to validation and controls is appropriate
• Data integrity—ensuring records are complete, consistent, and accurate throughout their lifecycle—is paramount
• Audit trails, access controls, and electronic signature controls remain essential

The Quality Management System Regulation (QMSR)

The transition from QSR to QMSR represents a major regulatory harmonization effort. Key aspects include:

Effective Date: February 2, 2026

Core Change: Incorporation of ISO 13485:2016 by reference, making compliance with this international standard a legal requirement

Part 11 Relevance: The QMSR maintains explicit requirements for signatures and dates on approvals (even though ISO 13485:2016 does not specifically require them), confirming that Part 11 continues to apply to medical device companies using electronic systems

Continuity of Requirements: While the structure and terminology change, the fundamental requirements for quality management and data integrity remain substantially similar

Data Integrity: The Underlying Priority

While companies often focus narrowly on Part 11 compliance, FDA’s broader concern is data integrity. The agency’s 2018 guidance “Data Integrity and Compliance with Drug CGMP: Questions and Answers” emphasizes that data must be:

• Attributable: Clearly linked to the person who generated it
• Legible: Readable and understandable throughout the record lifecycle
• Contemporaneous: Recorded at the time of the activity
• Original: The first or source recording (or a certified true copy)
• Accurate: Free from errors or editing without documentation

Part 11’s technical and procedural controls—validation, audit trails, access controls, electronic signatures—serve these fundamental data integrity principles. Companies that focus solely on technical Part 11 compliance while overlooking basic data integrity risk missing the point entirely.

Best Practices for Managing Part 11 in Inspections

1. Embrace Electronic Records Appropriately

Rather than avoiding electronic records out of fear of Part 11 citations, companies should implement robust electronic systems with proper controls. Well-designed electronic quality management systems (eQMS) can actually strengthen compliance and improve inspection outcomes.

2. Understand the Regulatory Framework

Recognize that Part 11 works in conjunction with predicate rules (the underlying regulations requiring records, such as cGMP or QSR/QMSR). Both sets of requirements must be met.

3. Focus on Data Integrity Fundamentals

Ensure that your systems and processes support the ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available).

4. Maintain System Documentation

Be prepared to demonstrate to inspectors:

• System validation documentation
• Standard operating procedures for electronic record management
• Training records for system users
• Audit trail reviews
• Access control procedures
• Electronic signature controls

5. Prepare for Realistic Inspection Scenarios

Train your team to respond to inspector requests for electronic records efficiently. Ensure that:

• Systems can generate accurate and complete copies of records in both human-readable and electronic formats
• Records are readily retrievable throughout their retention period
• Audit trails are available and reviewable
• Metadata is preserved and accessible

6. Conduct Regular Internal Assessments

Periodically assess your electronic systems against Part 11 requirements and data integrity principles. Address gaps proactively rather than waiting for an inspection to reveal deficiencies.

Conclusion

The notion of a specialized “Part 11 inspection” is a misconception that can lead companies astray. Part 11 requirements are integral to broader quality system inspections, whether conducted under cGMP for pharmaceutical companies or under QSR/QMSR for medical device manufacturers.

Companies should move beyond the outdated strategy of designating paper as official records while conducting actual work electronically. FDA’s clear preference for electronic inspection, combined with the practical advantages of properly implemented electronic systems, makes a strong case for embracing electronic records with robust Part 11 controls.

The key is understanding that Part 11 compliance is not about checking boxes on a compliance list—it’s about ensuring that electronic records are trustworthy, reliable, and capable of supporting data integrity throughout their lifecycle. When companies grasp this fundamental principle and implement electronic systems accordingly, they not only meet Part 11 requirements but also build stronger, more efficient quality systems that serve both compliance and business objectives.

As the medical device industry transitions to the QMSR and aligns with ISO 13485:2016, and as pharmaceutical companies continue to modernize their operations, electronic systems will become increasingly central to quality management. Companies that develop mature Part 11 capabilities now will be well-positioned for both current inspections and future regulatory evolution.