21 CFR Part 11

​

Overview

21 CFR Part 11 is the US FDA regulation governing electronic records and electronic signatures in FDA-regulated industries. It applies to pharmaceutical, biotechnology, medical device, and clinical research organisations that create, modify, maintain, archive, retrieve, or transmit electronic records that are required to be maintained under any FDA regulation. Part 11 requires that electronic records be trustworthy, reliable, and equivalent to paper records. The core mechanism for achieving this is audit trail integrity: the system must generate computer-generated, date-and-time-stamped audit trails that are protected from modification. ROOTKey’s blockchain anchoring provides the strongest available implementation of this requirement.

---

​

Regulatory Requirements and Coverage

​

§11.10 - Controls for Closed Systems

​

§11.50 - Signature Manifestations

For records requiring electronic signatures, §11.50 requires that signed electronic records include the printed name of the signer, the date and time of signing, and the meaning of the signature. ROOTKey anchors:

• Signature events at the time of signing - blockchain timestamp proves the signature time
• The signed document hash - proof that the signed version has not been altered post-signature

​

§11.70 - Signature/Record Linking

§11.70 requires that electronic signatures be linked to their electronic records such that the signatures cannot be excised, copied, or otherwise transferred. ROOTKey anchors both the signature and the document hash in a single transaction - the link is cryptographic and cannot be severed without detection.

---

​

Audit Trail Requirements in Detail

§11.10(e) is the central audit trail requirement. The FDA expects audit trails that:

---

​

Predicate Rule Integration

21 CFR Part 11 applies to records required by predicate rules - other FDA regulations that mandate record-keeping. ROOTKey is applicable across the major predicate rules:

---

​

Computer System Validation (CSV) and 21 CFR Part 11

Part 11 compliance begins with system validation. ROOTKey supports the validation lifecycle:

---

​

EU Equivalent: Annex 11

For EU pharmaceutical operations, the equivalent regulation is EU GMP Annex 11 (Computerised Systems). ROOTKey’s audit trail capabilities address the same core requirements - particularly paragraph 9 (audit trail) and paragraph 7 (data integrity and storage). → See also: Healthcare & Life Sciences use case

---