Are you 21 CFR Part 11 validated?

Why we don’t claim Part 11 validation

Vendors who claim “Part 11 validated product” are usually overstating what validation means. In GxP contexts, validation is an activity applied to a deployed computerized system, executed by the customer’s QA team, documented in their validation master plan, and maintained through their change-control procedures. The vendor’s role is supplying a product whose capabilities are appropriate for use in a Part 11 compliance program — not delivering “compliance” as a finished assertion.

What we actually provide

The capabilities Part 11 audits reference:

• §11.10(e) — secure, computer-generated, time-stamped audit trail. Our audit log provides this.
• §11.10(d) — limiting system access to authorized individuals. Microsoft Entra provides this; our layer inherits it.
• §11.50 — signature manifestations including printed name, date, meaning of signature. Our DocuSign PAdES integration provides this.
• §11.70 — signatures cannot be excised, copied, or transferred. PAdES cryptographic binding provides this.
• §11.200(a) — two-factor authentication. Microsoft Entra MFA provides this; our layer inherits.
• §11.100(a) — unique electronic signatures. Our named-Entra-identity attribution provides this.

What your QA team owns

• IQ (Installation Qualification) of the deployed instance in your tenant.
• OQ (Operational Qualification) documenting that the system functions as designed in your environment.
• PQ (Performance Qualification) documenting that it operates correctly during actual use.
• The validation master plan, change-control procedures, and periodic-review schedule.
• Documented risk assessment appropriate to the GxP scope.

This separation matches how Part 11 validation actually works. Italfarmaco runs this model; the customer’s QA team owns the validated-system assertion for their deployment.

See FDA 21 CFR Part 11 compliance and the Italfarmaco case study for deeper context.