Scope and origin of each framework
21 CFR Part 11 is a US FDA regulation (1997, with the 2003 scope-and-application guidance) governing electronic records and electronic signatures used in lieu of paper for records required under FDA predicate rules. It is record-and-signature-centric: trustworthiness, integrity, attribution, and equivalence to handwritten signatures.
EU GMP Annex 11 (Computerised Systems) is part of EudraLex Volume 4 GMP, applicable to medicinal products for human and veterinary use within the EU and aligned regions. It is system-and-lifecycle-centric: validation, supplier oversight, periodic review, business continuity, and operational use of computerised systems in GMP. PIC/S Annex 11 mirrors the EU text for participating PIC/S authorities.
Both frameworks predate modern cloud architectures. Both have been re-interpreted through industry guidance (PIC/S PI 041, ISPE GAMP 5, FDA's CSA Final Guidance) without changing the underlying regulations. A draft revision of Annex 11 was published for public consultation in 2025 and is expected to modernize the annex substantially; until it is adopted, the 2011 text remains the binding version compared below.
Side-by-side: where the frameworks differ
Most teams think of Part 11 and Annex 11 as overlapping. The differences matter when scoping a validation effort, an SOP set, or a procurement evaluation.
| Topic | 21 CFR Part 11 (FDA) | EU GMP Annex 11 |
|---|---|---|
| Scope | Electronic records and signatures used to satisfy FDA predicate rules. | All computerised systems used in GMP-regulated activities (production, QC, distribution, GMP-relevant data). |
| Validation | Implicit. §11.10(a) requires validation of systems "to ensure accuracy, reliability, consistent intended performance". | Explicit. Annex 11 clauses 1, 4 require risk-based validation across the system lifecycle, with documented evidence. |
| Risk management | Not directly named; relies on the 2003 scope-and-application guidance and broader FDA risk doctrine. | Annex 11 clause 1 names risk management as a foundational principle. |
| Audit trail | §11.10(e): secure, computer-generated, time-stamped audit trails for record creation, modification, deletion. Audit trail must be available for review and copying. | Clause 9: audit trails must capture all GMP-relevant changes and deletions, with reasons. Audit trail review is a defined activity. |
| Electronic signatures | Subpart C (§11.100-§11.300): identity, signature components, controls for ID/password, controls for biometric. §11.50 ties signed records to their meaning. | Clause 14: e-signatures must have the same impact as handwritten ones, be permanently linked to the record, and include date and time. |
| Supplier oversight | Not directly addressed. | Clause 3: explicit IT supplier and service provider oversight; written agreements; supplier audit expected for high-risk systems. |
| Periodic review | Not specified as a discrete activity. | Clause 11: periodic evaluation of computerised systems is required. |
| Business continuity | §11.10(c): protection of records throughout retention period. | Clauses 16 (business continuity), 13 (incident management), 17 (archiving), 7.2 (backup): explicit continuity, incident, archiving, and backup expectations. |
| Data lifecycle | Record-centric. | System-centric, covering specification, validation, operation, change, retirement. |
| Inspection emphasis | Record integrity, signature meaning, audit trail availability. | Validation evidence, supplier control, change control, periodic review, risk-based effort. |
References: FDA 21 CFR Part 11 (1997), FDA Scope & Application guidance (2003), EudraLex Vol. 4 Annex 11 (2011), PIC/S PI 041-1 Good Practices for Data Management and Integrity (2021).
Where Annex 11 pushes further
If the buying conversation only covers Part 11, several Annex 11 expectations may be missed entirely:
- Supplier oversight (clause 3). Cloud-hosted systems and SaaS eQMS deployments require a written agreement and assessment of the IT service provider. Part 11 has no direct equivalent.
- Periodic review (clause 11). Annex 11 expects a recurring evaluation that the system still meets its requirements, that controls remain effective, and that the validated state is intact.
- Risk management (clause 1). Risk-based effort is a regulatory expectation, not just a vendor convenience.
- Lifecycle thinking. Annex 11 explicitly covers specification, validation, operational use, change, and retirement. Part 11 leaves much of that to the predicate rules and broader GMP.
A worked example: which framework applies to you
The scoping question arrives on day one of any eQMS or validation project. The honest answer for most companies is "both, with one leading" — but which one leads changes what you write first.
| Your situation | What governs, and what leads |
|---|---|
| US-market device or pharma company, no EU operations | Part 11 governs your records and signatures under FDA predicate rules. Annex 11 does not apply directly — but its lifecycle expectations (supplier assessment, periodic review) are still what good validation looks like, and FDA's own inspection focus has moved the same direction. |
| EU manufacturing or QC site, product for the EU market | Annex 11 governs the computerised system end to end; Part 11 is irrelevant unless records also serve an FDA submission or predicate rule. |
| Selling into both markets | Both. Design the system and SOP set to the union: Part 11's record/signature integrity plus Annex 11's lifecycle controls. The overlap is large; the deltas are exactly the rows in the table above. |
| CDMO or contract lab serving global sponsors | Effectively both, imported through sponsor quality agreements — a sponsor audit will test you against whichever framework its market requires, sometimes both in the same week. |
| Site in a PIC/S country outside the EU | PIC/S Annex 11 — textually the EU annex — applies through your national inspectorate. Treat EU Annex 11 guidance as directly relevant. |
Build to the union and let the audit prove the subset. A system that satisfies Annex 11's lifecycle controls and Part 11's record and signature integrity does not need re-architecting when a new market, sponsor, or inspector arrives — the gap analysis becomes a mapping exercise instead of a remediation project. The Annex 11 validation playbook walks the lifecycle half of that union clause by clause.
What this means for software selection
Regulated buyers should not treat Part 11 support as the complete answer. A stronger procurement process asks the same platform to satisfy both record/signature integrity (Part 11) and lifecycle/supplier/periodic-review controls (Annex 11).
Cross-check software choices against the Part 11 buyer guide, the validation approach, the Annex 11 validation playbook, and the how to evaluate an FDA-validated eQMS page.