FDA 21 CFR Part 11 controls for electronic records and e-signatures

The product provides document-governance capabilities — unique user authentication, access control, complete audit trail, versioning, and PAdES e-signature via DocuSign — that pharma and medical-device customers can use in their 21 CFR Part 11 compliance program. The product itself is not positioned as a 21 CFR Part 11 validated solution; validation and regulatory responsibility remain with the customer.

Book a free assessment

---

What 21 CFR Part 11 asks for — in plain language

21 CFR Part 11 is the FDA's regulation on electronic records and electronic signatures. For pharma, biotech, and medical-device organizations subject to FDA oversight, Part 11 establishes the criteria under which electronic records (in lieu of paper) and electronic signatures (in lieu of handwritten) are considered trustworthy and reliable.

The regulation has two main parts:

Subpart B — Electronic Records. Systems handling electronic records must include:

• Access controls — limit system access to authorized individuals (§11.10(d)).
• Audit trails — secure, computer-generated, time-stamped records of operator entries and actions that create, modify, or delete records (§11.10(e)). Audit trail information must be retained for at least as long as the underlying record.
• Record integrity — procedures and controls to ensure the records' authenticity, integrity, and confidentiality (§11.10(c)).
• Record retrieval — records must be ready and accurate for review (§11.10(a), (b)).
• System validation — the system must be validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records (§11.10(a)).

Subpart C — Electronic Signatures. Electronic signatures must:

• Be unique to one individual (§11.100, §11.200).
• Contain the printed name of the signer, date/time, and meaning of the signature (§11.50).
• Be linked to their respective electronic records (§11.70) so they can't be transferred or copied.
• Use at least two distinct identification components (e.g., user ID + password) (§11.200).

docs365.ai provides capabilities in each of these areas that pharma customers use as part of their Part 11 compliance program — with the explicit understanding that validation and the ongoing compliance posture remain the customer's responsibility.

---

Capability-to-control mapping

Access control (§11.10(d))

Capability: Unique user authentication via Microsoft Entra ID (Azure AD). Every action is tied to a named user. Per-document and per-library SharePoint permissions control who can create, read, edit, or approve. External users (contractors, consultants) can be granted narrow access without joining the organization's primary identity provider, if the customer's security model allows.

Audit trail (§11.10(e))

Capability: A complete, time-stamped audit log of every action on every document — creation, modification, approval, rejection, publication, archive. Tied to named user identities. Accessible per document from the document's context menu, not an administrative back-end. Retained alongside the document for the document's full lifecycle.

The audit log captures what was done (approval, edit, publication), who did it (named Entra user), when (timestamped to the second), against which version (the audit log is version-specific), and what role the actor held (approver, reviewer, editor, auditor, supervisor).

Record integrity (§11.10(c))

Capability: During an approval flow, the document is automatically checked out — it cannot be edited. An approval therefore applies to a specific, unambiguous version. After publication, the PDF in the public area cannot be modified. Version history preserves every prior state; prior versions are recoverable but are not the canonical "in effect" version.

Record retrieval (§11.10(a), (b))

Capability: Documents are searchable and filterable by protocol code, document type, status, publication date, and any custom metadata the customer configures. Historical versions are retrievable through the version history. Archived documents are retrievable through the archived-documents view.

Electronic signatures (Subpart C)

Capability: DocuSign integration for PAdES simple or PAdES advanced electronic signature. DocuSign's signature framework provides signer identity (via email or stricter verification options configured by the customer), timestamping, cryptographic binding of the signature to the document, and a separate signature certificate embedded in the signed PDF that records the signer's name, the date and time, and the signature's meaning.

The signed PDF returns to the library with the approval-and-signature history intact. The linkage between the document and the signature is preserved by PAdES' cryptographic binding — the signature cannot be transferred to another document.

---

The validation posture

21 CFR Part 11 §11.10(a) says the system must be validated. Validation is the customer's responsibility — it is an activity the customer's QA or Computer System Validation team performs to demonstrate, to the FDA or to internal assurance bodies, that the specific installation of the system performs reliably for the specific regulated use case.

intranet.ai does not provide pre-validated-for-Part-11 binaries, and we do not position the product as "validated" in the Part 11 sense. What we provide is:

• A software product whose documented capabilities map to the specific Part 11 expectations above.
• Implementation support during the initial configuration.
• Software maintenance (bug fixes, security patches) under the annual subscription.
• A stable change-management model (documented releases, new features every six months, communicated changelogs) that the customer's validation team can incorporate into their ongoing verification activities.

The customer's QA team performs validation — installation qualification, operational qualification, performance qualification — against their specific intended use of the product. Customers running processes under Part 11 do exactly this, successfully, with this product. See the Italfarmaco reference below.

What unique authentication looks like in practice

Because the product is Microsoft-365-native, unique user identification flows from Entra ID. Every action on every document is tied to the acting user's Entra identity. The identification token is not a user-generated password typed into a form — it's a cryptographically bound session backed by the tenant's identity provider, with whatever conditional-access policies the organization requires.

For organizations that require multi-factor authentication for 21 CFR Part 11 signature events, MFA is configured at the Entra level and applies uniformly. The e-signature step through DocuSign adds its own identity re-verification — DocuSign can be configured to re-authenticate the signer via email, SMS, knowledge-based authentication, or stronger ID-verification flows, depending on the customer's risk profile.