The Birth of 21 CFR Part 11: A Historical Perspective

In 1997, the United States Food and Drug Administration (FDA) announced a groundbreaking regulation that would revolutionize the pharmaceutical industry. This regulation, known as “21 CFR Part 11,” would be etched in history as the world’s first paperless regulatory requirement, recognizing electronic records and electronic signatures as equivalent to paper records and handwritten signatures. But why and how was this groundbreaking regulation born? Behind it lay a dialogue between the industry and regulatory authorities, and the demands of the times.

The Pharmaceutical Industry in the Early 1990s: Buried in Paper

Imagine a pharmaceutical manufacturing site in the early 1990s. Manufacturing records, quality control data, analytical results, approval signatures—all of these were managed on paper. Giant document storage facilities housed decades worth of records, and it was not uncommon for it to take half a day just to locate a specific record.

At that time, the introduction of computer systems was already advancing. Manufacturing equipment was automated, analytical instruments output digital data, and management systems managed information through databases. However, ultimately, everything had to be printed on paper, signed by hand, and filed. This was because FDA inspectors only recognized “paper records.”

This situation created a significant contradiction for pharmaceutical companies. Despite the progress of digital technology making more accurate and efficient data management possible, regulatory requirements were hindering it.

Voices from the Industry: A Call for Change

It was the pharmaceutical companies themselves who first raised their voices about this contradiction. Beginning around 1991, multiple industry associations and companies began requesting that the FDA establish regulations to formally recognize electronic records and electronic signatures.

Their argument was clear. They advocated that electronic systems offered the following advantages:

Enhanced Data Integrity: Paper records carry risks of tampering and loss. In contrast, properly designed electronic systems automatically record all change histories and can completely track who changed what and when.

Improved Efficiency: Data can be searched, aggregated, and analyzed instantly. Inspection responses are also greatly streamlined, as necessary records can be presented immediately.

Cost Reduction: The enormous costs associated with printing, storing, and managing paper can be reduced.

Environmental Consideration: Reducing the use of large amounts of paper is important from an environmental protection perspective.

However, the FDA was cautious. Accepting electronic records could potentially create new risks.

FDA Concerns: Ensuring Safety and Reliability

The FDA’s caution regarding the adoption of electronic records stemmed from its responsibility as a regulatory authority. Records that ensure the safety and efficacy of pharmaceuticals require absolute reliability. Electronic systems posed the following concerns:

Risk of Tampering: Digital data can potentially be altered more easily than paper from a technical standpoint. Mechanisms to prevent malicious manipulation are necessary.

System Vulnerabilities: Computer systems are exposed to risks such as failures, virus attacks, and hacking.

Risk of Impersonation: In electronic signatures, how can identity verification be guaranteed?

Long-term Preservation Challenges: Pharmaceutical records need to be preserved for decades. Due to technological evolution, there is a possibility that data created on old systems may become unreadable.

Dialogue and Consultation: The Regulatory Development Process

In July 1992, the FDA published an Advance Notice of Proposed Rulemaking (ANPRM) regarding electronic records and electronic signatures, soliciting broad input. From this stage, dialogue began with a wide range of stakeholders, including industry, academic institutions, and technical experts.

The comments received numbered 53, covering a wide range of topics. In August 1994, a Proposed Rule reflecting comments on the ANPRM was published, generating an additional 49 comments. Voices from the field regarding technical feasibility, specific methods for security measures, impacts on business processes, and cost considerations were reflected in the regulatory proposal.

Particularly important was the principle of technology neutrality. Rather than specifying particular technologies, the regulation focused on defining the security and reliability standards that should be achieved. This resulted in a flexible regulation that could adapt to technological evolution.

On March 20, 1997, the FDA published 21 CFR Part 11 as a final rule in the Federal Register, which became effective on August 20, 1997. This rule became the world’s first comprehensive regulation recognizing electronic records and electronic signatures as equivalent to paper records and handwritten signatures.

The Core of 21 CFR Part 11: What Does It Require?

The finally established 21 CFR Part 11 defines the following main requirements:

Requirements for Electronic Records

Electronic record systems must be accurate, complete, reliable, and consistent. Specifically, all changes must be recorded as an audit trail, making it possible to track who changed what and when. Additionally, access to the system must be appropriately controlled, with mechanisms in place to prevent operations by unauthorized persons.

Requirements for Electronic Signatures

Electronic signatures must reliably verify the signer’s identity and guarantee the authenticity of the signature. This includes the use of user ID and password combinations, and where necessary, multi-factor authentication such as biometric authentication. Additionally, electronic signatures must be permanently linked to the record and cannot be separated later.

Implementation of Validation

Electronic systems must undergo appropriate validation (verification and validation) to verify that they function as intended. This applies throughout the entire lifecycle, from system design through operation and maintenance.

Global Impact: Toward a Global Standard

The establishment of 21 CFR Part 11 had an impact not limited to the United States but on pharmaceutical regulations worldwide. In Europe, Japan, and other regions, regulations and guidelines based on this were successively established.

In Europe, the European Medicines Agency (EMA) introduced EU GMP Annex 11 (Computerised Systems) in 1992 and carried out a major revision in January 2011. Furthermore, in 2025, a revised proposal to address new technologies such as cloud computing, cybersecurity, and AI technology was published, with finalization scheduled for 2026.

In Japan, on April 1, 2005, the Ministry of Health, Labour and Welfare issued “Regarding the Use of Electronic Records and Electronic Signatures in Applications for Approval or Permission of Pharmaceuticals, etc.” (ER/ES Guideline, Notification No. 0401022). Based on the same concepts as 21 CFR Part 11, this organizes the requirements for electronic records from the three perspectives of “authenticity,” “readability,” and “preservation.” Additionally, through the e-Document Law (enacted in December 2004, enforced in April 2005) and Ministry of Health, Labour and Welfare Ordinance No. 44 (promulgated in March 2005), the digitization of documents based on the Pharmaceutical and Medical Device Act became possible.

Thus, 21 CFR Part 11 became the foundation for the global standard of electronic record management in the pharmaceutical industry.

Impact on Practice: The Beginning of a Paradigm Shift

The implementation of 21 CFR Part 11 brought about significant changes in the pharmaceutical industry. Companies reviewed existing systems and made investments to adapt to new requirements.

In the initial stage, many companies struggled with compliance. There was a mountain of tasks to tackle, including modifying existing systems, introducing new systems, employee education and training, and establishing procedures. However, by taking time to advance compliance efforts, the benefits gradually became apparent.

Improved data searchability significantly reduced inspection response time. Automatic recording of audit trails improved data reliability. And most importantly, by being freed from paper record management, employees could concentrate on higher-value tasks.

Challenges and Evolution: Regulatory Review

While 21 CFR Part 11 was a groundbreaking regulation, various challenges also became apparent during implementation. Interpretations of the regulation differed among companies, and cases of excessive compliance were observed.

In September 2003, the FDA issued guidance “Part 11, Electronic Records; Electronic Signatures – Scope and Application” to clarify the scope of application of Part 11 and presented the concept of a risk-based approach. It put forth a policy that rather than uniformly demanding strict management for all electronic records, appropriate levels of management should be conducted according to the importance of the records.

Furthermore, as the 2010s arrived, new technical challenges arose with the evolution of cloud computing and mobile technology. The FDA continues to update guidance to respond to changing times.

In October 2024, the FDA finalized the latest guidance on electronic systems and records in clinical trials, titled “Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers,” which also addresses the use of digital health technologies (DHT) and AI technology.

Future Outlook: Accelerating Digital Transformation

As of 2025, the pharmaceutical industry is in the midst of an even greater wave of digital transformation. New technologies such as artificial intelligence (AI), machine learning, and blockchain technology are being introduced into quality control and manufacturing processes.

The foundation of electronic record management built by 21 CFR Part 11 serves as the base for supporting the introduction of such new technologies. AI-based anomaly detection systems, predictive quality management, real-time data analysis—all of these are only possible with reliable electronic record systems.

Additionally, regulatory authorities themselves are advancing digitization. Electronic submissions, electronic inspections, electronic data submissions—exchanges between regulatory authorities and companies are also becoming increasingly digitized. Furthermore, in September 2022, the FDA issued draft guidance on Computer Software Assurance (CSA), and in September 2025, finalized this guidance, promoting a paradigm shift from traditional Computer System Validation (CSV) to risk-based software assurance.

Milestone	Date	Event
Industry Request Begins	1991	Pharmaceutical companies begin requesting FDA acceptance of electronic records
ANPRM Published	July 1992	FDA publishes Advance Notice of Proposed Rulemaking (53 comments received)
Proposed Rule Published	August 1994	FDA publishes Proposed Rule (49 comments received)
Final Rule Published	March 20, 1997	21 CFR Part 11 published in Federal Register
Effective Date	August 20, 1997	21 CFR Part 11 becomes effective
Scope and Application Guidance	September 2003	FDA issues risk-based interpretation guidance
Japan ER/ES Guideline	April 1, 2005	Japan issues ER/ES Guideline (Notification No. 0401022)
EU GMP Annex 11 Revision	January 2011	Major revision of EU GMP Annex 11 becomes effective
CSA Draft Guidance	September 13, 2022	FDA issues draft guidance on Computer Software Assurance
Clinical Investigation Guidance	October 2, 2024	FDA finalizes guidance on electronic systems in clinical investigations
CSA Final Guidance	September 24, 2025	FDA finalizes Computer Software Assurance guidance
EU Annex 11 Revision (Expected)	2026	Expected finalization of revised EU GMP Annex 11

Conclusion

21 CFR Part 11 is a historic regulation that crystallized from the demands of the industry and the responsible response of the regulatory authority. Starting from sites buried in paper in the 1990s, through the initiation of dialogue with industry in 1991, the 1992 ANPRM, the 1994 proposed rule, and the 1997 final rule publication, it crystallized as the world’s first paperless regulatory requirement.

Behind the birth of this regulation was not merely the pursuit of efficiency, but larger goals: improving data integrity, ensuring patient safety, and building sustainable pharmaceutical manufacturing systems.

What is important is that 21 CFR Part 11 became not merely a technical regulation, but a catalyst that transformed the culture of the pharmaceutical industry itself. The transition from paper to digital fostered not only operational efficiency but also a culture of data-based decision-making, preventive quality management, and continuous improvement.

Today, the fact that we can access safe and high-quality pharmaceuticals is the result of such regulatory evolution and the diligent efforts of the industry to respond. More than a quarter century has passed since the birth of 21 CFR Part 11, yet the spirit of this regulation—data integrity, transparency, and ensuring patient safety—continues to form the foundation of pharmaceutical regulation in the digital age.

As we look toward the future, the ongoing evolution of regulations such as the finalization of the CSA guidance, the expected revision of EU GMP Annex 11, and the increasing integration of AI and digital health technologies, demonstrates that the foundational principles established by 21 CFR Part 11 remain as relevant and critical today as they were at its inception. The pharmaceutical industry continues to build upon this solid regulatory framework, ensuring that innovation and patient safety advance hand in hand.