Scope and origin of each framework
21 CFR Part 11 is a US FDA regulation (1997, with the 2003 scope-and-application guidance) governing electronic records and electronic signatures used in lieu of paper for records required under FDA predicate rules. It is record-and-signature-centric: trustworthiness, integrity, attribution, and equivalence to handwritten signatures.
EU GMP Annex 11 (Computerised Systems) is part of EudraLex Volume 4 GMP, applicable to medicinal products for human and veterinary use within the EU and aligned regions. It is system-and-lifecycle-centric: validation, supplier oversight, periodic review, business continuity, and operational use of computerised systems in GMP. PIC/S Annex 11 mirrors the EU text for participating PIC/S authorities.
Both frameworks predate modern cloud architectures. Both have been re-interpreted through industry guidance (PIC/S PI 041, ISPE GAMP 5, FDA CSA draft) without changing the underlying regulations.
Side-by-side: where the frameworks differ
Most teams think of Part 11 and Annex 11 as overlapping. The differences matter when scoping a validation effort, an SOP set, or a procurement evaluation.
| Topic | 21 CFR Part 11 (FDA) | EU GMP Annex 11 |
|---|---|---|
| Scope | Electronic records and signatures used to satisfy FDA predicate rules. | All computerised systems used in GMP-regulated activities (production, QC, distribution, GMP-relevant data). |
| Validation | Implicit. §11.10(a) requires validation of systems "to ensure accuracy, reliability, consistent intended performance". | Explicit. Annex 11 clauses 1, 4 require risk-based validation across the system lifecycle, with documented evidence. |
| Risk management | Not directly named; relies on the 2003 scope-and-application guidance and broader FDA risk doctrine. | Annex 11 clause 1 names risk management as a foundational principle. |
| Audit trail | §11.10(e): secure, computer-generated, time-stamped audit trails for record creation, modification, deletion. Audit trail must be available for review and copying. | Clause 9: audit trails must capture all GMP-relevant changes and deletions, with reasons. Audit trail review is a defined activity. |
| Electronic signatures | Subpart C (§11.100-§11.300): identity, signature components, controls for ID/password, controls for biometric. §11.50 ties signed records to their meaning. | Clause 14: e-signatures must have the same impact as handwritten ones, be permanently linked to the record, and include date and time. |
| Supplier oversight | Not directly addressed. | Clause 3: explicit IT supplier and service provider oversight; written agreements; supplier audit expected for high-risk systems. |
| Periodic review | Not specified as a discrete activity. | Clause 11: periodic evaluation of computerised systems is required. |
| Business continuity | §11.10(c): protection of records throughout retention period. | Clauses 16 (incident management), 17 (archiving), 12.4 (backup): explicit continuity, archiving, and incident expectations. |
| Data lifecycle | Record-centric. | System-centric, covering specification, validation, operation, change, retirement. |
| Inspection emphasis | Record integrity, signature meaning, audit trail availability. | Validation evidence, supplier control, change control, periodic review, risk-based effort. |
References: FDA 21 CFR Part 11 (1997), FDA Scope & Application guidance (2003), EudraLex Vol. 4 Annex 11 (2011), PIC/S PI 041-1 Good Practices for Data Management and Integrity (2021).
Where Annex 11 pushes further
If the buying conversation only covers Part 11, several Annex 11 expectations may be missed entirely:
- Supplier oversight (clause 3). Cloud-hosted systems and SaaS eQMS deployments require a written agreement and assessment of the IT service provider. Part 11 has no direct equivalent.
- Periodic review (clause 11). Annex 11 expects a recurring evaluation that the system still meets its requirements, that controls remain effective, and that the validated state is intact.
- Risk management (clause 1). Risk-based effort is a regulatory expectation, not just a vendor convenience.
- Lifecycle thinking. Annex 11 explicitly covers specification, validation, operational use, change, and retirement. Part 11 leaves much of that to the predicate rules and broader GMP.
What this means for software selection
Regulated buyers should not treat Part 11 support as the complete answer. A stronger procurement process asks the same platform to satisfy both record/signature integrity (Part 11) and lifecycle/supplier/periodic-review controls (Annex 11).
Cross-check software choices against the Part 11 buyer guide, the validation approach, the Annex 11 validation playbook, and the how to evaluate an FDA-validated eQMS page.