Digital Quality • GMP Records & Signatures

Electronic Records and Electronic Signatures in Pharma: A GMP Guide

Understand how pharmaceutical companies assess electronic-record scope, apply Part 11 and EU GMP Annex 11 controls, validate systems, and preserve trustworthy signatures and records throughout their lifecycle.

21 CFR Part 11EU GMP Annex 11Data Integrity

Quick answer: Electronic records are digital records created, modified, maintained, archived, retrieved, or transmitted by computerized systems. Electronic signatures are electronic methods used to sign or approve records. In pharma, both must be trustworthy, attributable, readable, retrievable, and controlled for their intended GMP use. Requirements depend on applicable predicate rules, jurisdiction, record type, and system use; 21 CFR Part 11 and EU GMP Annex 11 are important frameworks, but neither is a software certification.

What Are Electronic Records and Electronic Signatures?

An electronic record is information recorded or stored in digital form and relied upon to meet a regulatory, quality, or business requirement. It may include more than a final PDF or printed report. The complete record can include source data, metadata, calculations, processing methods, audit trails, annotations, approvals, and linked files needed to understand the activity.

An electronic signature is an electronic symbol, action, or process adopted by a person to sign or approve an electronic record. Examples include a controlled approval action in a validated quality system or a user-authenticated signature applied to a batch record. A typed name or scanned image of a handwritten signature is not automatically a compliant electronic signature.

Electronic records and signatures support a modern cGMP environment by enabling controlled workflows, faster review, traceable approvals, and secure retrieval. The benefits depend on appropriate system controls and good operating practices.

Why Electronic Records and Signatures Matter in Pharma

Record the full activityPreserve values, context, changes, approvals, and metadata needed to reconstruct an operation.

Make approvals attributableConnect an approval or review to a verified individual and a defined meaning.

Support timely decisionsEnable manufacturing, laboratory, quality, and release workflows without losing oversight.

Protect data integrityControl access, audit trails, signatures, retention, backup, and retrieval across the record lifecycle.

Electronic methods do not reduce the need for sound documentation. They change how records are generated, protected, reviewed, signed, copied, and retained. A trustworthy electronic record must remain complete and intelligible for its required lifecycle, including when technology or suppliers change.

Regulatory Framework: Part 11, Predicate Rules, and Annex 11

Regulatory applicability should be determined from the activity and records involved. A company should document the basis for its decision instead of applying a blanket “Part 11 compliant” label to every application.

21 CFR Part 11: Applies to electronic records and electronic signatures within the rule’s scope when records are created, modified, maintained, archived, retrieved, or transmitted under FDA requirements. It works with the underlying “predicate rules” that require records, signatures, or submissions. FDA’s Scope and Application guidance describes its current interpretation and recognizes that paper and electronic components can coexist in a hybrid record if predicate-rule requirements are met and content and meaning are preserved. FDA Part 11 guidance.
EU GMP Annex 11: Applies to computerized systems used as part of GMP-regulated activities. It addresses electronic records, security, audit trails, electronic signatures, validation, suppliers, and lifecycle risk management. Annex 11 describes electronic signatures as potentially used for GMP records and calls for them to be permanently linked to the respective record, with date and time information. EU GMP Annex 11.
Predicate regulations: Requirements in applicable GMP rules determine which records must exist, what they contain, how they are reviewed, and how long they are kept. Part 11 controls supplement these obligations when applicable; they do not replace them.
Site quality system: Procedures define ownership, record review, access, signature meaning, training, investigations, change control, retention, and archival in day-to-day operations.

Scope reminder: FDA’s Part 11 Scope and Application guidance describes a narrow interpretation of scope and enforcement discretion for certain Part 11 provisions. It does not remove the underlying predicate-rule requirements or the need to protect electronic records. Record-specific applicability should be assessed and documented by qualified personnel.

For a broader overview, read the site guide to 21 CFR regulations and the related article on Computerized System Validation.

Examples of GMP Electronic Records

Electronic records may be found across quality, laboratory, manufacturing, engineering, and supply operations. Scope depends on whether a record is required, relied upon, or used to perform a regulated activity.

Area	Example electronic records	Record-integrity considerations
Quality Control laboratory	Instrument raw data, chromatograms, sequences, calculations, sample records, result review, specifications, and reports.	Retain native data and metadata needed to interpret results; control processing methods, reintegration, repeat testing, review, and audit trails.
Manufacturing	Electronic batch records, weigh/dispense data, process parameters, equipment status, and material reconciliation.	Preserve sequence, values, exceptions, user actions, approvals, and the link to the batch and equipment.
Quality systems	Deviations, investigations, CAPA, change controls, complaints, training, and controlled procedures.	Control workflow state, electronic approvals, revisions, due dates, and complete history.
Stability and environmental monitoring	Chamber data, sample pulls, temperature records, viable/non-viable monitoring, and trend reports.	Protect time-series context, alarms, sample identity, limit changes, and traceability to source equipment.
Supply and distribution	Supplier qualification, receipt records, storage conditions, shipment monitoring, and traceability.	Maintain identity, chain-of-custody, review, exception handling, and record retention.

Electronic Signature vs. Scanned Signature vs. Typed Name

Method	What it represents	Key consideration
Controlled electronic signature	An authenticated action linked to a record and an identified signer.	When Part 11 or another applicable rule applies, implement required identity, signature manifestation, linkage, and procedural controls.
Scanned image of handwritten signature	A digital image of ink on paper.	It may be part of a hybrid workflow, but by itself may not provide identity verification, record linkage, or audit evidence required for the intended use.
Typed name or email approval	Text that may indicate a person’s name or intention.	Do not assume it meets electronic-signature controls. Define authentication, signature meaning, record association, and retention based on applicable requirements.
Handwritten signature on paper	A traditional ink signature on a paper record.	Control the paper original and any subsequent scanning or hybrid record conversion so the required content and meaning remain preserved.

Core Controls for Trustworthy Electronic Records

1. Validation and fit for intended use

Demonstrate that the system performs reliably for the intended GMP use. Requirements, risk assessment, testing, supplier evidence, traceability, release approval, and lifecycle controls should be proportionate to system complexity and risk. See Computerized System Validation in Pharmaceuticals.

2. Access control and unique user identity

Assign individual accounts and role permissions that match job responsibilities. Prohibit shared credentials for actions that need individual attribution. Manage account creation, modification, suspension, privileged access, and periodic review through approved procedures.

3. Audit trails and change history

Where required or justified by risk, maintain secure histories of relevant creation, modification, or deletion events. Preserve prior values and context where the system supports them; restrict the ability to disable or alter audit trails; and establish review procedures for critical records and events.

4. Electronic-signature manifestation and linkage

When Part 11 applies, signed records must include the signature manifestations specified by the rule, such as signer name, date/time, and meaning. The signature must be linked to its record so it cannot be excised, copied, or transferred to falsify another record. Configure signature meanings such as review, approval, verification, or responsibility to match actual workflows.

5. Record protection, backup, and retention

Protect records against loss, unauthorized change, deterioration, or premature deletion. Define backup and restore, archival, retention, retrieval, readability, migration, and disaster-recovery controls. A backup is not a complete retention strategy unless restoration and interpretation are possible.

6. System time and event chronology

Use controlled time settings and synchronization so events can be ordered reliably across connected systems. Define who can change clocks or time zones, how such changes are recorded, and how discrepancies are investigated.

7. Training and approved procedures

Train users and administrators on expected practices, signature meanings, correction methods, review responsibilities, security, and incident escalation. Keep procedures aligned with system configuration and actual behavior.

These controls support ALCOA+ principles, including attribution, legibility, contemporaneous recording, originality, accuracy, completeness, consistency, endurance, and availability.

Electronic Signature Controls Under 21 CFR Part 11

When Part 11 applies to a record or signature, the organization should assess the relevant subparts and implement controls through system design, procedures, and training. Key topics include:

Signature manifestation (§11.50): The signed record displays the signer’s printed name, date and time of signing, and the meaning associated with the signature.
Signature/record linking (§11.70): The signature is linked to its electronic record so it cannot be excised, copied, or transferred to falsify another record.
Uniqueness and identity (§11.100): Each electronic signature is unique to one individual and identity is verified before assignment.
Signature components and controls (§11.200): Non-biometric signatures use the prescribed identification components and controls; biometric signatures must be designed so they cannot be used by anyone other than the genuine owner.
Identification codes and passwords (§11.300): Controls protect credentials, detect compromised access, and support accountability.

Use official regulatory text and qualified interpretation when establishing requirements. FDA’s Part 11 guidance should be read alongside the current regulation and applicable predicate rules; see the current 21 CFR Part 11 text.

How to Assess Whether Part 11 Applies

A documented applicability assessment should examine the record and regulated activity—not simply the product name or vendor’s marketing claim. A practical assessment asks:

Which laws, regulations, or approved commitments require the record, signature, or submission?
Is the record created, modified, maintained, archived, retrieved, or transmitted electronically?
Does the organization rely on the electronic version to perform a regulated activity or make a quality decision?
Is the record submitted to FDA electronically under a requirement that brings it within Part 11?
Are there hybrid paper/electronic steps, and do they preserve the complete content, meaning, signatures, and history?
Which controls follow from Part 11, predicate rules, EU GMP Annex 11, and the site quality system?

Document the rationale, boundaries, record owners, and control decisions. Revisit the assessment if the process changes from paper to electronic, the system’s intended use changes, or a new record becomes the authoritative source.

Do not rely on labels alone: Statements such as “Part 11 compliant,” “validated by vendor,” or “paper printout is the official record” do not establish applicability or compliance. The regulated company must assess its own use and records.

Managing Hybrid Paper and Electronic Records

A hybrid record uses both paper and electronic components. It can be acceptable when the applicable rules are met and the organization can preserve the record’s complete content and meaning. The quality system should clearly identify the authoritative record, explain how its components fit together, and define how they are reviewed, signed, corrected, copied, and retained.

For example, a laboratory worksheet may be on paper while raw chromatographic data, processing methods, and audit trail remain electronic. A printed chromatogram may not contain all the metadata needed to reconstruct the analysis. Procedures should tell reviewers where the complete record resides and how it can be retrieved.

A scanned copy is not automatically a substitute for an electronic source record. Determine whether the source system data and metadata must be retained, whether the scan is a verified true copy, and how corrections or approvals are linked.

Lifecycle Implementation: From Requirements to Retirement

Inventory records and systems. Identify systems, records, signatures, owners, uses, and data flows that support GMP activities.
Assess applicability and risk. Document predicate-rule obligations, Part 11 scope, Annex 11 relevance, and impact on product quality, patients, and data integrity.
Define intended use and requirements. Specify record types, signature meanings, access roles, audit trails, retention, retrieval, and expected availability.
Evaluate suppliers and architecture. Review service-provider controls, hosting, interfaces, time synchronization, backup, security, and data export.
Validate controls and workflows. Verify record creation, changes, approvals, signature linkage, audit trails, access, reporting, backup, and retrieval.
Approve procedures and train users. Establish operating, review, access, incident, correction, and record-retention procedures.
Release and monitor. Approve the system for intended use, monitor incidents and changes, and periodically review system and record controls.
Retire without losing records. Preserve readability, context, signatures, audit trails, and retrieval through migration or archival.

Align lifecycle evidence with the applicable SOP, URS, and system validation records. Qualification deliverables such as IQ, OQ, and PQ may be used when appropriate to the system and approved lifecycle model.

Common Risks and Compliance Mistakes

Assuming every digital file is automatically in scope: Assess the record’s regulatory context and actual use.
Assuming Part 11 only means passwords and signatures: Consider records, access, audit trails, validation, retention, copies, and operating controls as applicable.
Using shared user accounts: Shared credentials undermine individual attribution and accountability.
Using a typed name as a signature without controls: A name field alone may not establish identity, meaning, or record linkage.
Keeping only a printout: A printout may omit dynamic data, metadata, audit trails, or processing context needed to reconstruct the record.
Failing to define signature meaning: Review, approval, verification, and authorship are not interchangeable.
Allowing administrators to change records without oversight: Privileged actions should be restricted, attributable, monitored, and included in procedures.
Ignoring retention and migration: Records must remain readable and retrievable for the required period, even after system replacement.
Treating vendor statements as company evidence: Supplier documentation needs assessment against configured use and local requirements.

Electronic Records and Signature Readiness Checklist

Are regulated records and their authoritative sources identified?
Is the applicability of Part 11, predicate rules, and Annex 11 documented where relevant?
Are individual accounts and role-based access controls used for attributable actions?
Are audit trails enabled, retrievable, readable, retained, and reviewed where required?
Do electronic signatures show signer identity, date/time, and signature meaning as applicable?
Are signatures permanently linked to the record and protected from transfer or removal?
Are corrections, repeat processing, and invalidations controlled and documented?
Are backup, restore, archival, migration, retention, and retrieval tested or verified?
Are hybrid records clearly defined, complete, and linked across paper/electronic components?
Are users trained and procedures consistent with system behavior?
Are changes, incidents, and supplier updates assessed for impact on records and signatures?

Frequently Asked Questions

What is an electronic record in the pharmaceutical industry?

An electronic record is information in digital form that is created, modified, maintained, archived, retrieved, or transmitted by a computerized system. Depending on the activity, it may include raw data, metadata, calculations, audit trails, approvals, and reports.

What is an electronic signature in pharma?

It is an electronic method by which a person signs or approves an electronic record. Its controls should establish the signer’s identity, the meaning of the signature, and its link to the specific record when applicable requirements demand those controls.

Does 21 CFR Part 11 apply to every pharmaceutical software system?

No. Applicability depends on the electronic records and signatures involved, the underlying predicate rules, and how the organization uses the system. Companies should document a record-based scope assessment rather than rely on a blanket software label.

What is the difference between 21 CFR Part 11 and EU GMP Annex 11?

Part 11 is a U.S. regulation for electronic records and signatures within its scope. EU GMP Annex 11 is a GMP guideline for computerized systems used in GMP activities. Both address controls for trustworthy electronic records, but their scope and detailed requirements differ.

Is a typed name a valid electronic signature?

Not automatically. A typed name should not be treated as a compliant signature unless identity, intent, signature meaning, record linkage, security, and applicable regulatory controls are established for its use.

Can a scanned handwritten signature replace an electronic signature?

A scanned image may be used in some controlled hybrid workflows, but it does not by itself provide the authentication, linkage, history, and security controls that may be required for an electronic signature. Assess the process and applicable rules.

Can paper and electronic records be used together?

Yes, a hybrid record can be used when the applicable requirements are met and the content and meaning are preserved. The company should define the authoritative record, how paper and electronic components relate, and how the complete record is reviewed and retained.

What information should an electronic signature display?

When Part 11 applies, §11.50 identifies signature manifestations including the signer’s printed name, date and time of signing, and the meaning associated with the signature. Applicable regulations and system configuration should be confirmed.

Do electronic records require audit trails?

Audit-trail expectations depend on applicable regulations, the record, system use, and risk. Part 11 includes audit-trail controls for closed systems within scope, and EU GMP Annex 11 addresses audit trails for GMP-relevant changes. Procedures should define scope, availability, retention, and review.

How long must electronic GMP records be retained?

Retention follows the applicable predicate rules, product and record requirements, and company procedures. Retain the complete record—including necessary metadata and audit trails—so it remains readable, retrievable, and interpretable for the required period.

Conclusion

Electronic records and signatures are reliable GMP evidence only when organizations control the whole lifecycle: applicability, system validation, user identity, access, audit trails, signature meaning, record linkage, retention, and retrieval. Start with the records and intended uses, document the regulatory rationale, and use procedures and validated controls that match the risk.

Official References

Use note: This article is an educational guide, not a substitute for current regulations, qualified regulatory interpretation, or site-specific procedures. Confirm jurisdiction, record scope, and applicable controlled requirements before implementation.