In October 2024 FDA finalised a Q&A guidance that replaced its 2007 computerised systems guidance and explains how 21 CFR Part 11 applies to modern trial technology. Here is what it covers, what it asks of sponsors, investigators and IT service providers, and how it compares with the EMA guideline. General information, not legal advice.
Free sandbox · No credit card · 21 CFR Part 11 aligned
Electronic records
Electronic systems deployed by regulated entities
Information technology service providers and services
Digital health technologies
Electronic signatures
29 questions and answers, glossary and references appendix
The guidance in one page
The document
21 CFR Part 11, issued in 1997, sets criteria for when FDA treats electronic records and electronic signatures as trustworthy and equivalent to paper. In 2003 FDA narrowed how it would enforce the rule, and in 2007 it published guidance on computerised systems used in clinical investigations. Trials then moved to cloud software, electronic consent, patient-reported outcomes on personal phones, wearables and electronic health records. The 2007 text did not speak to most of that.
The 2024 Q&A format is FDA's answer. It is written as questions a sponsor, investigator or IRB might ask, grouped by topic. Reporting on the final version stresses that it finalises the March 2023 draft, is non-binding and intends to clarify rather than add obligations. It also clarifies how Part 11 relates to real-world data sources and to clinical investigations conducted outside the United States. The Federal Register notice and the guidance itself are the primary sources; the summaries here come from the notice and from trade and law-firm commentary, so read the document before you rely on a detail.
If you want the rule rather than the guidance, see our 21 CFR Part 11 compliant EDC page and Part 11 compliance checklist.
Section by section
The table pairs each topic area with the practical question it raises for a trial team. Descriptions are summaries, not quotations. Confirm wording in the guidance.
| Topic area | The practical question | What to have ready |
|---|---|---|
| Electronic records | Which records does FDA expect to reconstruct the trial, and how do you keep them trustworthy? | Data flow diagram, list of critical records, audit trail, retention plan. See data archiving and retention. |
| Systems deployed by regulated entities | How do you decide a system is fit for its purpose and prove it stays that way? | Risk assessment, URS, validation or supplier assessment, change control, user access reviews. See URS template. |
| IT service providers and services | What do you remain responsible for when a vendor hosts or runs the system? | Written agreement, supplier audit or assessment, hosting location, exit and data return. See vendor audit checklist. |
| Digital health technologies | How is data from wearables and personal devices captured, secured and traced to the participant? | Device verification evidence, data transfer description, repository location. See FDA DHT guidance. |
| Electronic signatures | How do you show a signature belongs to one person, means what it says and cannot be lifted from the record? | Unique credentials, signature manifestation, link to the signed record, procedures for certification to FDA. See electronic signatures. |
Topic list from the guidance's published structure as reported by secondary sources. Not legal advice.
The themes
Read the questions closely and four ideas repeat. They are useful even if you never read the full text, because inspectors reason the same way.
The guidance builds on the risk-based approach to validation that FDA described in its 2003 Part 11 scope and application guidance. A system that holds the primary endpoint or safety data warrants more rigorous validation than a scheduling aid. Document why you chose the depth you did. The practical tools are a validation plan, a requirements document, tests traced to requirements and a change process. See computer system validation and GAMP 5 validation.
FDA lists updating its recommendations on data integrity and data security, including audit trails and protection of records, among the aims of the revision. Audit trails should record who changed what, when and, where relevant, why, without obscuring earlier values. Our audit trail software guide and the ALCOA+ checklist show how this is checked in practice.
The section on IT service providers reflects a point GCP has long made: you can delegate tasks, not accountability. Contracts, qualification of the provider and oversight of changes remain the regulated party's job. This is the same position the EMA takes, which is why a good supplier file serves both regulators.
Commentary on the final guidance reports that electronic health record systems and similar sources of real-world data are not themselves assessed against Part 11, but once the data enter a sponsor's EDC system, Part 11 considerations apply to the record there. For you, the point to take is practical: know where each data element first becomes a controlled trial record and make sure the system at that point carries the controls.
Open the free sandbox, change a value, read the audit trail, apply an electronic signature and run an export. Check each against what the guidance asks of you before you sign a contract.
FDA and EMA together
Many trials fall under both. The two documents differ in form more than in substance. The EMA text is a guideline of the GCP Inspectors Working Group; the FDA text is a guidance interpreting a US regulation.
| Aspect | FDA Q&A (final October 2024) | EMA guideline (EMA/INS/GCP/112288/2023) |
|---|---|---|
| Form | Questions and answers, non-binding guidance on Part 11 | Structured guideline with principles, system and data sections and annexes. See our EMA guideline guide. |
| Legal anchor | 21 CFR Part 11 and predicate rules | EU GCP requirements and the Clinical Trials Regulation |
| Validation | Risk-based; fit for intended use | Sponsor responsible; validation of computerised systems with annex on validation |
| Audit trail | Data integrity and security controls including audit trails | Audit trail and expectation of risk-based audit trail review |
| Providers | Dedicated section on IT service providers | Annex on agreements with service providers |
| Signatures | Dedicated section on electronic signatures | Principles on electronic signatures within the system and data sections |
| Specific tools | Digital health technologies section | Annex covering eCOA and ePRO, IRT and electronic informed consent |
High-level comparison from published summaries. For a formal gap analysis, read both texts. See also [Annex 11 versus Part 11](/solutions/annex-11-vs-21-cfr-part-11).
How Capture maps to it
Capture provides 21 CFR Part 11-aligned controls. Whether a system is validated for your use is a shared responsibility between the platform and you, so treat the list below as inputs to your own assessment.
| Capture control | Your evidence | |
|---|---|---|
| Audit trails and record protection | Field-level, append-only trail | Export sample, review SOP |
| Access and user management | Roles, 2FA, timeouts | User list, access review log |
| Electronic signatures | Re-authentication, meaning, hash to content | Signature manifest, procedure |
| IT service provider | Hosted platform | Agreement and supplier assessment |
| Digital health technology | OAuth wearable sync | Device verification file |
Putting it to work
Use it as a starting point for a gap review. It is not a substitute for reading the guidance.
List every system that creates, modifies, stores or transmits trial records, including ePRO, eConsent, imaging and wearables.
Rate impact on participant safety and data reliability; set validation depth accordingly.
A written URS and a traceability matrix, see the URS template.
Roles, hosting, change notification, audit rights and exit, plus a vendor audit where risk justifies it.
A defined, risk-based review process, with the trail exportable for inspectors.
Unique accounts, role approvals, prompt removal when staff leave, periodic review.
Unique to one person, meaning shown, linked to the record, and any certification to FDA handled per your SOP.
Define certified copies, export formats and the archive plan, see archiving and retention.
Prepare the files an inspector would ask for, see the FDA inspection checklist.
It is a final Q&A guidance announced in the Federal Register on 2 October 2024 (docket FDA-2017-D-1105). It explains how FDA applies 21 CFR Part 11 to electronic systems, records and signatures in clinical investigations, and replaces FDA's May 2007 computerised systems guidance.
No. It is non-binding guidance that describes FDA's current thinking. The binding requirements are in regulations such as 21 CFR Part 11 and the predicate rules. Sponsors can use alternative approaches that satisfy the regulations.
Reporting on the final version says it reflects a risk-based approach to validation, updates recommendations on data integrity and security including audit trails, and adds topics such as IT service providers, digital health technologies and electronic signatures. It also clarifies Part 11 for real-world data sources and for trials outside the US.
Commentary on the final guidance says EHR and similar real-world data sources are not themselves assessed under Part 11, but once the data enter the sponsor's EDC system the record there is. Check the guidance text for the exact wording.
Both expect validated, secure systems with audit trails and clear provider responsibility. FDA's is a Q&A on Part 11; EMA's is a structured guideline with annexes covering agreements, validation, user management, security and tools like eCOA, IRT and eConsent. A strong supplier file and validation package serve both.
Capture provides 21 CFR Part 11-aligned controls, including a field-level audit trail, role-based access and electronic signatures. FDA does not certify software, and validated use is shared with the sponsor, so assess the platform against your own risks and requirements.
On FDA's guidance pages and in the Federal Register notice of 2 October 2024 (FR Doc 2024-22562). Always read the primary text before relying on a summary.
Keep exploring
21 CFR Part 11 compliant EDC
What Part 11 asks of software.
21 CFR Part 11 compliance checklist
Control-by-control checklist.
EMA computerised systems guideline
The EU counterpart.
Annex 11 vs 21 CFR Part 11
Side-by-side comparison.
Computer system validation
Sponsor validation duties.
GAMP 5 EDC validation
A risk-based validation model.
Electronic signatures for clinical trials
How signatures work.
FDA digital health technologies guidance
The DHT guidance.
Free sandbox with every feature. No credit card, and you pay only when you go live with real participants.