21 CFR Part 11 lab automation compliance starts with a deceptively simple question: is the data your AI system generates or modifies an electronic record required by another FDA regulation? If the answer is yes, Part 11 applies fully, regardless of whether the record was produced by a person or an algorithm. Understanding what the regulation requires, and where AI creates specific gaps, is the practical starting point for any regulated lab deploying AI tools.
Quick Take:
- 21 CFR Part 11 establishes the criteria under which FDA considers electronic records and signatures trustworthy and legally equivalent to paper records and handwritten signatures
- Part 11 does not create new recordkeeping requirements; it governs how existing requirements (called predicate rules) are met when records are electronic
- Any AI system that creates, modifies, maintains, archives, retrieves, or transmits electronic records required under predicate rules is subject to Part 11
- The four core controls are system validation, tamper-evident audit trails, access controls, and electronic signature requirements
- AI introduces specific challenges around audit trail attribution, model version tracking, and the question of who "signs" an AI-generated record
What 21 CFR Part 11 actually covers
21 CFR Part 11 lab automation compliance begins with understanding what the regulation covers. The rule establishes the criteria under which FDA considers electronic records and electronic signatures to be trustworthy, reliable, and legally equivalent to paper records and handwritten signatures. Finalized in 1997, it applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirements set forth in FDA regulations.
Those other FDA regulations are called predicate rules. In 21 CFR Part 11 lab automation settings, the most relevant predicate rules are 21 CFR Parts 210 and 211 (current Good Manufacturing Practice (GMP)), 21 CFR Part 58 (Good Laboratory Practice (GLP) for nonclinical studies), and 21 CFR Part 312 (Investigational New Drug (IND) applications). Part 11 does not create new recordkeeping obligations; it sets the standard for how electronic records must be controlled when a predicate rule requires them.
FDA's 2003 guidance on Part 11 scope and application introduced a risk-based, narrow interpretation that remains operative today and shapes how 21 CFR Part 11 lab automation programs are structured. Part 11 controls should be proportionate to a system's impact on product quality and patient safety. This does not reduce the compliance obligation; it calibrates where enforcement focus lands.
Electronic records requirements under Part 11
For closed systems, those where access is controlled by the organization responsible for the records, Section 11.10 of the regulation sets out the core technical and procedural controls relevant to 21 CFR Part 11 lab automation deployments. Four matter most in an AI context.
System validation requires that any system used to create or manage Part 11 records is validated for its intended use, a core 21 CFR Part 11 lab automation obligation. Under FDA's computer software assurance (CSA) guidance, finalized in September 2025, validation scope should be proportionate to the risk the system poses to data integrity and product quality.
Audit trails are among the most scrutinized requirements at inspection. Section 11.10(e) requires computer-generated, time-stamped audit trails that independently record operator entries and actions that create, modify, or delete electronic records. These must be retained for as long as the records they document, must be accessible for FDA review, and must not be modifiable by anyone, including system administrators.
Access controls under § 11.10(d) require that system access is limited to authorized individuals. Section 11.10(b) separately mandates that the system can generate accurate, complete copies of records in human-readable and electronic form for FDA inspection. Open systems, those where records cross a network boundary not controlled by the record owner, carry additional requirements including document encryption.
| Part 11 control | Regulatory citation | Core requirement |
|---|---|---|
| System validation | § 11.10(a) | Validated for intended use; risk-based scope |
| Record copies | § 11.10(b) | Accurate, complete copies in human-readable and electronic form for FDA inspection |
| Record protection | § 11.10(c) | Accurate, ready retrieval throughout retention period |
| Access controls | § 11.10(d) | Limited to authorized individuals |
| Audit trails | § 11.10(e) | Computer-generated, time-stamped, tamper-evident, retained |
| Electronic signatures | § 11.50, § 11.100 | Legally equivalent to handwritten; uniquely bound to individual |
Electronic signature requirements
Part 11 Subpart C governs electronic signatures in 21 CFR Part 11 lab automation contexts, covering signatures used in place of handwritten signatures on records required by predicate rules. An electronic signature must be uniquely linked to the individual who applied it and must not be reusable by anyone else.
Lab Quality Management Certificate
The Lab Quality Management certificate is more than training—it’s a professional advantage.
Gain critical skills and IACET-approved CEUs that make a measurable difference.
Non-biometric electronic signatures require at least two distinct identification components, such as a user ID and password. The first signing in a continuous session must use all signature components; subsequent signings in the same session may use one. Each signature must include the signer's printed name, the date and time, and the meaning of the signing (reviewed, approved, authored, or similar).
Organizations using electronic signatures must submit a one-time certification to FDA stating that electronic signatures in their systems are intended as legally binding equivalents of handwritten signatures.
Which AI and automated systems are subject to Part 11
The threshold question for any AI system is whether it creates, modifies, maintains, archives, retrieves, or transmits an electronic record required by a predicate rule. If the answer is yes, Part 11 applies. The nature of the system, whether it uses a traditional algorithm, a machine learning model, or a generative architecture, is irrelevant to that determination.
What matters for 21 CFR Part 11 lab automation compliance is what the system does to a regulated record, not how the system works internally.
Interested in lab design?
AI systems subject to Part 11 include laboratory information management systems (LIMS) that use AI to flag anomalies in instrument data; chromatography data systems with automated integration and peak identification; AI-powered quality control tools that make or record accept/reject determinations; and document systems that produce batch records or reports required under GMP. AI-driven data handling across laboratory informatics platforms spans all of these record categories.
A system that supports laboratory operations but does not directly create or modify predicate-rule records sits outside 21 CFR Part 11 lab automation scope. An AI scheduling tool whose outputs do not themselves become regulatory records generally does not trigger Part 11. The boundary is the regulated record, not the regulated activity.
Part 11 compliance in practice for AI systems
AI introduces three compliance challenges that traditional Part 11 programs were not designed to address.
Audit trail attribution is the most immediate challenge. Section 11.10(e) requires audit trails to record who created or modified a record and when. When an AI system generates or modifies a record, the audit trail must identify the system and the specific version of the model that produced the output.
A log entry that reads "AI system processed result" without capturing model version, input data, and human review step does not satisfy Part 11 requirements. Labs should treat model version as a required audit trail field for any AI-generated predicate-rule record.
Electronic signature accountability is the second challenge. Part 11 requires that signatures are uniquely bound to an individual; AI systems cannot sign records in the Part 11 sense. Any AI-generated output that requires a signature under a predicate rule must be reviewed and signed by a qualified human before it enters the regulated record.
Labs should define and document this human review step in the system's standard operating procedure. This is not a procedural formality; it is the mechanism that preserves accountability in an AI-assisted workflow.
Model change control is the third 21 CFR Part 11 lab automation challenge. When an AI model is retrained or updated, its outputs may change systematically even when the system code does not. Labs should treat model version updates as regulated change events, assess their impact on the integrity of existing and future records, and document that assessment before the new version goes into production.
Broader GxP validation and data integrity requirements for AI systems are covered in the hub article for this compliance cluster.
Common misconceptions about Part 11 and AI
Several misconceptions recur when regulated labs evaluate AI tools against 21 CFR Part 11 lab automation requirements.
The most common is that Part 11 does not apply to AI because the regulation predates AI. This is incorrect. Part 11 applies to electronic records; it is indifferent to the technology that generated them.
A record created by an AI system is subject to the same predicate rule as a record created by a human operator.
A second 21 CFR Part 11 lab automation misconception is that purchasing a "Part 11 compliant" vendor system transfers compliance responsibility. Vendor claims of Part 11 compliance describe the system's capabilities, not your organization's compliance. The regulated organization remains responsible for validating the system in its specific environment and operating it with adequate procedural controls.
A third 21 CFR Part 11 lab automation misconception is that AI systems supporting rather than replacing human decisions are automatically outside Part 11 scope. This depends on the record. If an AI generates a recommendation that a human reviews and approves, and that approval is captured in a predicate-rule record, both the AI-generated input and the human review step are part of the Part 11 record chain.
21 CFR Part 11 and AI: what regulated labs need to get right
21 CFR Part 11 lab automation compliance for AI systems comes down to three priorities: map every AI function against the predicate rules it touches; verify that audit trails capture model version, input provenance, and reviewer identity; and treat model updates as regulated change events requiring documented impact assessments.
The regulation is not hostile to AI adoption. Automated systems have operated under Part 11 for decades, and evaluating and implementing AI in a regulated lab setting requires the same foundational question Part 11 has always asked: are the records trustworthy, attributable, and available for inspection?
This content includes text that has been generated with the assistance of AI. For more information, view Lab Manager's AI use policy.
References
U.S. Food and Drug Administration. Part 11, Electronic Records; Electronic Signatures — Scope and Application. Guidance for Industry, August 2003. Available at: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application
U.S. Code of Federal Regulations. 21 CFR Part 11 — Electronic Records; Electronic Signatures. Available at: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11
U.S. Food and Drug Administration. Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers. Final Guidance, October 2024. Docket FDA-2017-D-1105. Available at: https://www.federalregister.gov/documents/2024/10/02/2024-22562/electronic-systems-electronic-records-and-electronic-signatures-in-clinical-investigations-questions
