Complying with Part 11

The first step to compliance with Part 11 is to determine if Part 11 applies to the system in question and if it does, which parts of Part 11 apply.

For example, an electronic records system that does not include electronic signatures does not need to comply with Subpart C. Each company needs to make a determination for each new system based on their understanding and application of Part 11. The ISPE and PDA guide also provides guidance for understanding and complying with Part 11. Whatever decision is made, this determination should be clearly documented and consistent with a company's standard procedures related to regulatory requirements.

Once a system is found to require Part 11 compliance, the company needs to determine how to comply with the applicable requirements. This requires a mixed solution of two types of controls: technological and procedural. Some specific requirements may even be addressed by both types of controls.

The presence of procedural requirements means that no technological solution, software, etc. can be compliant with the Part 11 regulation as it exists on its own. This guide will focus on the application of technological controls, but will also identify where procedural controls are required.