GxP / Guide 2
Part 11 and Annex 11, requirement by requirement
What 21 CFR Part 11 and EU GMP Annex 11 actually require, what the 2025 Annex 11 draft adds, and which technical control answers each requirement.
Most IT people meet Part 11 and Annex 11 as a list of demands from a validation lead. Reading the text itself is quicker than you'd think (Part 11 is two pages of rules), and knowing which clause a control answers makes design reviews and audits far shorter. This guide goes through both, then maps them to controls on Azure, AWS and Microsoft 365.
21 CFR Part 11 in one page
Part 11 applies to electronic records that a predicate rule requires, and to electronic signatures used in place of handwritten ones. Its main sections:
| Section | Requirement | Who usually owns it |
|---|---|---|
| 11.10(a) | Validation: accuracy, reliability, consistent intended performance, and the ability to spot invalid or altered records | System owner, validation |
| 11.10(b) | Accurate and complete copies, in human-readable and electronic form, for inspection | Application |
| 11.10(c) | Protect records so they can be retrieved accurately and readily for the whole retention period | IT: backup, archive, storage |
| 11.10(d) | Limit system access to authorized individuals | IT and application: identity, roles |
| 11.10(e) | Secure, computer-generated, time-stamped audit trails of entries and actions that create, modify or delete records. Changes must not obscure what was there before. Keep the audit trail as long as the record. | Application, plus IT for platform logs |
| 11.10(f), (g), (h) | Operational checks (enforced sequence of steps), authority checks (only authorized people can sign, change or use), device checks (valid source of input) | Application |
| 11.10(i) | People who build, maintain or use the system are trained and qualified | Everyone, including IT and cloud admins |
| 11.10(j) | Written policy holding people accountable for actions under their electronic signature | Quality |
| 11.10(k) | Control over system documentation, with change control and an audit trail of document changes | Quality, IT |
| 11.30 | Open systems (where you don't control access): add encryption and digital signature standards as needed | IT |
| 11.50, 11.70 | Signed records show printed name, date and time, and meaning (approved, reviewed); signatures are linked to their records so they can't be copied or removed | Application |
| 11.100 | Each electronic signature is unique to one person, never reused or reassigned; identity verified before issue; a one-time certification letter to FDA | Quality, HR, IT identity |
| 11.200 | Non-biometric signatures use at least two components (such as ID and password); the first signing in a session uses both, later signings at least one | Application, identity |
| 11.300 | Controls on IDs and passwords: unique, periodically checked and revised, lost credentials handled, attempts at misuse detected and reported, tokens tested | IT identity |
How FDA enforces it
FDA's 2003 guidance Part 11, Electronic Records; Electronic Signatures — Scope and Application still shapes how Part 11 is applied. It says FDA interprets the scope narrowly and exercises enforcement discretion on validation, audit trails, record retention, record copying and legacy systems, as long as the predicate rules are met and decisions are justified by a documented risk assessment. In practice that means: audit trails and validation are still expected for anything that matters, but the depth is yours to justify. It does not relax access control, signature or record integrity expectations.
Annex 11 (2011)
Annex 11 is shorter than Part 11 but broader: it covers the whole life cycle of a computerised system used in GMP, not only records and signatures. Its seventeen sections:
| Section | Topic | What it asks of IT |
|---|---|---|
| 1 | Risk management | Controls sized to risk, across the life cycle |
| 2 | Personnel | Qualified people with defined responsibilities, IT included |
| 3 | Suppliers and service providers | Formal agreements; audits based on risk; supplier documentation reviewed. This is where cloud providers are covered. |
| 4 | Validation | Life cycle validation, inventory of systems, requirements traceability, infrastructure qualified |
| 5, 6 | Data, accuracy checks | Checks on data exchanged between systems; checks on critical manual entries |
| 7 | Data storage | Data secured against damage; regular backups; backup integrity and restore checked during validation and monitored periodically |
| 8 | Printouts | Clear printed copies; show if data changed since entry |
| 9 | Audit trails | Based on risk, record GMP-relevant changes and deletions with the reason; audit trails available, readable and regularly reviewed |
| 10 | Change and configuration management | Changes made in a controlled way under a defined procedure |
| 11 | Periodic evaluation | Systems reviewed periodically to confirm they remain valid |
| 12 | Security | Physical and logical access controls; creation, change and removal of access recorded |
| 13 | Incident management | Incidents reported, assessed and root causes found |
| 14 | Electronic signature | Same effect as handwritten; permanently linked; time and date |
| 15 | Batch release | Only qualified persons can certify release, identified and recorded |
| 16 | Business continuity | Arrangements to keep critical processes going when systems fail, tested |
| 17 | Archiving | Archived data checked for accessibility, readability and integrity, especially after system changes |
The 2025 Annex 11 draft
The draft revision published in July 2025 grows Annex 11 from about five pages to about nineteen. When it becomes final, expect these to matter most to IT:
- Cloud and service providers: much more detail on what agreements must cover, including oversight, audit and inspection support, communication of quality and security issues, and exit arrangements that keep you in control of your data.
- Identity and access management: unique personal accounts (no shared accounts with write access), multi-factor authentication for remote access to critical systems, lockout, session time-outs, logged and reviewable access changes, and segregation of duties.
- Audit trail review: who, what, when and why for changes, and risk-based review of audit trails before data is used for decisions such as batch release.
- Security as a GMP topic: patching, vulnerability management, network segmentation and security testing written into the annex, not left to IT policy.
- Backup, archive and periodic review: backups separated from the live system and restore-tested; archives protected and verified; a defined list of items every periodic review covers.
The companion draft Annex 22 restricts AI in critical GMP uses to static, deterministic models, and excludes generative AI and large language models from critical applications. If you're planning AI for GxP work, read it now.
Mapping requirements to cloud controls
The table below is the one to bring to a design review. It covers the infrastructure layer only: the application still has to meet its own requirements.
| Requirement | Azure | AWS | Microsoft 365 |
|---|---|---|---|
| Limit access (11.10(d), A11 §12) | Entra ID groups, Azure RBAC, PIM, Conditional Access | IAM Identity Center, permission sets, SCPs | SharePoint groups, sensitivity labels |
| ID and password controls (11.300) | Entra ID password and lockout policies, MFA, sign-in logs | Identity Center with external IdP and MFA | Entra ID |
| Platform audit trail (11.10(e), A11 §9) | Activity log and resource logs to Log Analytics; immutable storage | CloudTrail with log file validation; S3 Object Lock | Purview Audit |
| Protect and retrieve records (11.10(c), A11 §7, §17) | Azure Backup with immutable vaults; blob immutability | AWS Backup with Vault Lock; S3 Object Lock | Retention labels, records management |
| Change control (11.10(k), A11 §10) | IaC pipelines with approvals; Azure Policy; deployment stacks | CloudFormation or Terraform pipelines; AWS Config; drift detection | Change-controlled site templates |
| Business continuity (A11 §16) | Azure Site Recovery, cross-region restore | Elastic Disaster Recovery, cross-region copies | Microsoft-operated resilience; your own exit and export plan |
| Continuous compliance checks | Azure Policy, Defender for Cloud | AWS Config conformance pack for 21 CFR Part 11 | Purview Compliance Manager (has a Part 11 regulation template) |
A clean compliance dashboard is supporting evidence, not proof. AWS says its Part 11 conformance pack is a sample template, and the same is true of any policy set: most Part 11 and Annex 11 requirements are met by the application and by your procedures.