Part 11 neither certifies nor bans Excel. A workbook can be used under validation and procedure, but its file-based design makes a trustworthy audit trail, access control and version control hard to evidence.
Free sandbox · No credit card · 21 CFR Part 11 aligned
weeks
Repeats
The direct answer
The question behind the question
Searching for a verdict on Excel usually ends in contradictory advice, because the right answer is conditional. 21 CFR Part 11 asks that an electronic records system is validated, limits access to authorised individuals, keeps secure computer-generated, time-stamped audit trails, and links signatures to records. ICH E6(R2) section 5.5.3 asks that electronic trial data systems are validated, have SOPs, maintain an audit trail and protect against unauthorised access. The EU's Annex 11 (a GMP annex that inspectors and the EMA's guideline on computerised systems in clinical trials use as a reference point) adds expectations on change and configuration management, security and archiving. None of these names Excel. All of them ask what you did with it.
Excel's design makes the "what you did" part heavy. The unit of control is the file. A data manager can protect a sheet, restrict editing and add data validation lists, but the workbook still travels by email, USB stick and shared drive, and each copy is a new object to control. For a pilot with a handful of non-identifiable values this may be acceptable if your sponsor agrees in writing. For a participant database it is a lot to evidence.
Teams considering the move can read how to migrate from Excel spreadsheets and the general Capture vs Excel comparison. This page focuses on the compliance reasoning and on what auditors will ask.
Control by control
Regulatory references are general; Excel statements come from secondary sources checked on 13 October 2026 and should be confirmed in Microsoft's documentation for your version and licence.
| Expectation | Where Excel needs work | Capture |
|---|---|---|
| Audit trail (11.10(e); Annex 11 s.9) | Show Changes needs OneDrive or SharePoint storage and covers a limited recent window; Version History is file-level snapshots, not a per-field record with reasons. Local and e-mailed copies have none. | Field-level, append-only, hash-chained; user, timestamp, old and new value, reason |
| Validation (11.10(a); Annex 11 s.4) | Formulas, lookups, conditional formats and VBA macros all need specification and test evidence; Excel version updates may change behaviour. | Sponsor validation and UAT documentation for enterprise customers; shared responsibility |
| Change control (Annex 11 s.10) | Anyone who can unprotect a sheet can change logic. Is each change reviewed, tested and recorded? | Draft to approved lifecycle; approved forms locked for live use |
| Access limitation (11.10(d)) | Passwords on sheets and workbooks are weak controls and are shared; no per-user rights inside the file. | Role-based access, row-level security, two-factor authentication for staff |
| Accurate and complete copies (11.10(b)) | Exports are the file itself; copies drift. Which one is the record? | One database; CSV and Excel exports with an automatic data dictionary |
| Data checks at entry (ICH E6 5.5.3) | Data validation rules reject some inputs but raise no query to the site. | Edit checks raise an auto-query |
| Signatures (11.50, 11.70, 11.200) | No signature with meaning and re-authentication linked to the record. | Password re-authentication and a meaning statement for staff signatures |
| Backup and retention (Annex 11 s.7, s.17) | Depends on where people saved the file. | Hosted in the EU (Frankfurt) or the USA (N. Virginia) with soft-delete only |
General information, not legal or regulatory advice. Your quality unit decides what is adequate.
The hidden validation scope
A study workbook usually contains logic: BMI from height and weight, a visit window from two dates, a flag when a value is out of range. Each is a function whose output people trust. In Excel you must specify it, test it across edge cases, protect the cells and re-test whenever the formula changes. In Capture, calculated fields such as BMI are built in, read-only during entry, and filled from mapped inputs.
Heart rate
QT
QTcF
Fridericia, calculated
404 ms CalculatedOverall interpretation
Open the sandbox, add an ECG form and change the inputs. No credit card, every feature.
What you would have to build around it
Teams that continue with Excel for regulated data usually combine technical settings with procedures. The list is not exhaustive and it must be tailored to your risk assessment.
One master file in a managed location, a naming and versioning convention, no local copies, and a procedure for what happens when someone saves elsewhere. Record who held the master at each point. This is the file-control layer that an EDC replaces with a single database.
Build entry sheets as a locked template: protected cells, data validation lists, derived columns, no macros if you can avoid them. Validate the template against a written specification and re-validate after any change or after significant Excel updates. See computer system validation for clinical trial software and the data validation plan template.
Because built-in history is partial, teams add a manual or scripted change log with a reason and an independent reviewer. That log is itself a record to protect. See audit trail software for clinical trials for what a native trail looks like.
Keep names and contact details out of the analysis workbook, and control the key that links them. See role-based access control and ALCOA+ data integrity.
Switch plan
The sequence below keeps your existing workbook as the archived record and avoids any claim about automated data import.
Make a read-only master, record the date, the file hash if your procedure uses one, and the person responsible. File it with the study documents.
A sheet of repeated measurements becomes a form with a table section. A sheet of one-off baseline values becomes a baseline form. Upload the XLSX or headers and let AI draft the questions; review each one.
Use the built-in calculators where they exist and rebuild any other logic as edit checks, reviewed before approval.
Add the schedule your protocol requires and give site staff the access they need. The templates library has standard forms to copy.
Run mock participants end to end: break a rule, edit a value with a reason, read the audit trail. File the evidence with your validation documentation.
State in your data management plan which records lived in Excel and which live in Capture, and how they are combined at analysis.
Excel is not certified or prohibited by Part 11. Compliance depends on validation, access control, audit trail and procedures around your use. File-based design makes this hard to evidence for a participant database.
Per secondary sources, change tracking for shared workbooks needs OneDrive or SharePoint and covers a limited window, and Version History keeps file snapshots. Neither is a per-field audit trail with a reason for change. Confirm with Microsoft documentation.
If the spreadsheet supports regulated records, expect to specify, test and document its formulas, macros and protection, and re-test after changes. Your quality unit sets the level, based on risk.
Possibly, if the data are not subject to Part 11 or GCP expectations, or your sponsor and ethics committee accept it. Agree this in writing before you start.
Form-based eCRFs with typed fields, edit checks, calculated fields, roles and a field-level audit trail. Exports to CSV or Excel are still available for analysis.
We do not claim automated data import. AI drafting can build forms from an uploaded XLSX; archive the workbook and document how earlier data are combined at analysis.
Yes. Capture is suitable for Phase 1, 2 and 3 studies.
Open the free sandbox, with every feature and no credit card. You pay only when you go live.
Keep exploring
Capture vs Excel
The head-to-head comparison.
How to migrate from Excel spreadsheets
Step-by-step move.
Can you use Google Sheets for clinical trial data?
The sibling question for Sheets.
Can you use Airtable for a clinical trial?
The sibling question for Airtable.
Edit checks software
Validation at entry.
Data validation plan template
Document your checks.
Free sandbox, every feature. Build the form, break a rule and read the audit trail. No credit card.