FDA Withdraws All Part 11 Guides and Publishes a New Draft

GMP News No. 294

GMP News
26 February 2003

FDAWithdraws All Part 11 Guides
and Publishes a New Draft

On 20 February, FDA withdrew all Part 11 Guides. The same is true of theCompliance Policy Guide. The list of withdrawn documents is as follows:

  • Guidance for industry, 21 CFR Part 11;Electronic Records; Electronic Signatures Validation
  • Guidance for industry, 21 CFR Part 11;Electronic Records; Electronic Signatures,Glossary of Terms
  • Guidance for industry, 21 CFR Part 11;Electronic Records; Electronic Signatures, Time Stamps
  • Guidance for industry, 21 CFR Part 11;Electronic Records; Electronic Signatures,Maintenance of Electronic Records
  • Compliance Policy Guide, CPG 7153.17:Enforcement Policy: 21 CFR Part 11; Electronic Records; ElectronicSignatures;

Even on 4 February, FDA withdrew the guidethat had been published last, i.e. Guidance for industry, 21 CFR Part 11;Electronic Records; Electronic Signatures, Electronic Copies of ElectronicRecords 79" (see our GMPNews of 14 February).

What was withdrawn were the Part 11Guides, not the Rule (i.e. 21 CFR Part 11) itself.

Of course, one wonders why FDA has takenthis quite radical step. What is sure is that the new cGMP Initiative hastriggered off this action (see our GMPNews of 4 September 2002). By means of this initiative, FDA intends toadopt a risk-based approach to all regulatory and inspection requirements.Apart from this, FDA sees 3 reasons that have led to the withdrawal. Therequirements mentioned in the Guides could bring about the followingnegative effects:

  • new electronic systems are introduced with adelay or not introduced at all 
  • the firms have to carry disproportionately high costs due to the extensivecompliance measures
  • innovative technologies are not introduced (without public health beingendangered by this)

FDA announces to exercise enforcementdiscretion during inspections with regard to the requirements onvalidation, audit trails, record retention, record copying and the requirements on legacy systems. This"special handling" of the requirements will be practised untilthe rule Part 11 has been re-evaluated/revised. FDA emphasises that allother requirements have to be implemented as before. The text says:

It is important to note that FDA's exerciseof enforcement discretion asdescribed in this guidance is limited to thespecified part 11 requirements.We intend to enforce all other provisions ofpart 11 including, but not limitedto, certain controls for closed systems in§ 11.10, the corresponding controlsfor open systems (§ 11.30), andrequirements related to electronic signatures(e.g., §§ 11.50, 11.70, 11.100, 11.200,and 11.300). We expect continuedcompliance with these provisions, and wewill continue to enforce them.

With the above-mentioned explanations forthe withdrawal of the different Part 11 Guides, a new Guide was publishedcontaining FDA's current thinking on electronic records and electronicsignatures. It is titled: Part 11, Electronic Records;Electronic Signatures – Scope and Application.

The text starts by giving the reasons forthe creation of this Guidance, the content being identical with what hasbeen said in the above-mentioned explanation in the Federal Register. Theactual content of the document takes up only 4 of the 9 text pages.

Already in the chapter "NarrowInterpretation of Scope", the reader finds a far-reaching statementon the handling of electronic records. Here, FDA says that, in case apaper printout is maintained, it is not necessary any more to archive theelectronic record.

Point 2 "Definition of Part 11Records" goes a bit more into the details of this item. FDA recommendsamong others that one should pre-define which records will be maintainedin paper format and which ones in electronic format. This can best be donein the form of an SOP.

In chapter C, FDA deals with those fields inwhich they intend to exercise enforcement discretion. Here, the focus isput especially on risk assessment. This key word is the central theme of theGuidance. By means of a risk assessment one has to find out to what extenta specific system can influence the product quality, safety, and recordintegrity. If the result indicates a high risk, the requirements, e.g. onvalidation, have to be implemented. If the risk proves to be low, this isnot necessary. In this context, FDA gives an example on which there havebeen controversial discussions at numerous conferences at which FDAofficials were present. FDA says: For instance, a word processor used only togenerate SOPs would most likely not need to be validated. If onedevelops this thought further, a text file containing an SOP (low risk forproduct quality) would no longer have to be handled according to the Part11 requirements either. But how is the situation for more complex records,e.g. an excel sheet with calculations that are used for a releasedecision? According to the approach described above, all of therequirements of Part 11, i.e. validation, audit trail etc., would againhave to be observed.

In analogy to this, there is also a changefor audit trails. FDA recommends a risk-based approach here, too. At thesame time, FDA emphasises that:

Audit trails are particularly importantwhere the users are expected to create, modify, or delete regulatedrecords during normal operation.

Next to risk assessment, another point is ofimportance: "All records held by you are subjectto inspection in accordance with predicate rules". For the decisionabout the scope of measures to be implemented for certain electronicrecords, it will therefore be crucial which requirements are defined inthe underlying GMP legislation (e.g. 21 CFR 210/211).

It will be interesting to know to whatextent FDA will change the rule Part 11, i.e. the law on which theGuidances are based.

On the whole, one can say that FDA has madeconcessions to many of the demands expressed by the industry. It may bedifficult to assess how far the enforcement discretion will go. In whichareas can one really ignore the requirements of Part 11? How can onedefine that a specific record resulting from the GMP requirementsrepresents a comparably low risk for the product quality and is thusexempted from the Part 11 requirements (also in case the record is createdand archived by means of an electronic system)?

You can download the new Draft via this link:

The following link leads you to theannouncement in the Federal Register (withdrawal of the Part 11Guidances):

The following ECA events deal especiallywith computer validation:

Oliver Schmidt


Go back

GMP Conferences by Topics