For example, the regulation, earlier draft guidance documents, and early interpretations from FDA defined an electronic record
as, "any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is
created, modified, maintained, archived, retrieved, or distributed by a computer system" (1, Par. 11.1 [b]). But, the rule
makes no distinction among the types of records or their criticality.
FDA requested Part 11 compliance for all such records that were generated or stored on a computer and could ask for such records
at inspections. With this very broad interpretation, full implementation was very expensive and for some applications, it
was impractical. In some cases, companies decided to keep paper records because of the anticipated additional complexity and
cost involved with implementing the technical control required by the rule. This outcome clearly was not the original intent
and spirit of the rule which was issued to protect public health and enable new technology to be used.
With the release of the draft guidance on scope and application of Part 11 in Feb. 2003 (5), FDA promoted a new, narrower
approach. With the final guidance released on Sept. 3, 2003 and FDA's announcement to reexamine Part 11 and initiate a new
rule-making process, this narrower approach became official and probably will be the basis for an updated regulation in the
The guidance states that Part 11 applies when:
- the record is required by a predicate rule (e.g., electronic batch records for 21 CFR Part 211 and electronic training records in 21 CFR Part 58);
- the electronic records are used to demonstrate compliance with a predicate rule (e.g., electronic training records for compliance with 21 CFR Part 211).
Part 11 applies in one or both of the following situations:
- when electronic records are used instead of paper;
- when persons make printouts but still rely on the electronic records to perform regulated activities.
Figure 1 illustrates the decision flow to determine which records fall under the scope of Part 11. This figure has been presented
several times by FDA staff Part 11 experts. First, we check if the record is required by and can demonstrate compliance with
the predicate rule.
Figure 1: Steps to determine whether records are within the scope of Part 11 (7).
Next, we determine if the record fits in the new, more-specific scope of Part 11. The main criterion is whether the record
is maintained in electronic format in place of a paper format or in both electronic and paper formats, and whether people
rely on the electronic records to perform regulated activities. A regulated activity is any activity required by an FDA regulation. For example, analytical test results must be recorded according to FDA's 21
CFR Part 211. In this case, the regulated activity is not limited to signing the record (e.g., a paper printout of an electronic record). It also includes all steps from data acquisition and evaluation.
Finally, we make a risk assessment of the criticality of the records and document the result. Based on the outcome, appropriate
Part 11 controls are implemented.
The final criteria is to evaluate the risk the record has on product quality and data integrity. Examples of high-risk records
are electronic batch records and analytical records of final product testing. Errors at this stage will not be identified
and cannot be recovered before the product ships to the market. An example of low-risk records are electronic planning documents
such as cleaning or maintenance schedules. Electronic standard operating procedures could fall into the medium- or low-risk
category, depending on the procedure's effect on product quality. The International Society for Pharmaceutical Engineering
has published a list of such risk classifications (6).