21 CFR Part 11 Applicability Assessment: Predicate Rules and When Part 11 Applies

One of the most common compliance gaps in FDA-regulated organizations is not failing to meet 21 CFR Part 11 requirements -- it is not knowing which systems need to meet them at all. Part 11 does not apply to every electronic system your organization uses. It applies only when a specific condition is met: a predicate rule requires a record, and your organization keeps that record electronically. Understanding that condition -- the predicate rule trigger -- is the foundation of a defensible Part 11 applicability assessment.

What Is a Predicate Rule?

The term predicate ruledoes not appear in the text of 21 CFR Part 11 itself. It comes from the FDA's 2003 Guidance for Industry: Part 11, Electronic Records; Electronic Signatures -- Scope and Application, where FDA defined it as "those requirements set forth in predicate rules." In practice, a predicate rule is any FDA regulation -- other than Part 11 -- that requires records to be created, maintained, modified, or transmitted.

Examples of predicate rules that routinely trigger Part 11 obligations:

• 21 CFR Part 211 (Current Good Manufacturing Practice for Finished Pharmaceuticals) -- batch production records (211.188), laboratory records (211.194), distribution records (211.196), and complaint files (211.198).
• 21 CFR Part 58 (Good Laboratory Practice for Non-Clinical Laboratory Studies) -- study protocols, amendments, raw data, and final study reports.
• 21 CFR Parts 312 and 314 (IND and NDA regulations) -- clinical investigation records and electronic submissions to FDA.
• 21 CFR Part 820 / QMSR (Quality System Regulation / Quality Management System Regulation) -- design history files, device history records, complaint handling records, and CAPA documentation.
• 21 CFR Part 606 (Blood and Blood Products) -- donor records, processing records, and compatibility testing records.

If none of these or other FDA regulations require the record, Part 11 does not apply to it -- regardless of how sensitive the data is or how robust your system is. A company intranet, HR records, marketing files, and general business contracts fall outside Part 11 scope unless they are specifically required by an FDA predicate rule.

The Two-Part Test for Part 11 Applicability

FDA's 2003 scope guidance frames applicability as a two-part test:

1. Is the record required by a predicate rule? If the underlying FDA regulation does not require the record, Part 11 does not apply. Optional records -- even if kept electronically -- are outside scope.
2. Is the record maintained in electronic form? If your organization keeps the required record on paper only, Part 11 does not apply. Part 11 applies specifically to electronic records. A hybrid record (paper original with electronic copy) requires careful analysis of which version is the official record.

Both conditions must be true simultaneously. A required record kept on paper, and an optional record kept electronically, are both outside Part 11 scope. Only when a predicate-rule-required record is maintained electronically do Part 11 controls apply.

What Does a Part 11 Applicability Assessment Include?

An applicability assessment is a controlled document -- typically a report or a section within your system validation file -- that formally records the analysis and its conclusions. FDA investigators can and do ask to see applicability assessments during inspections, particularly when they are reviewing systems that were determined to be outside Part 11 scope.

A complete assessment covers six elements:

1. System identification. The name, version, and intended use of the system being evaluated. Include both the system itself and any interfaces or data feeds that create or modify records.
2. Predicate rule citation. The specific CFR citation(s) requiring the record(s) the system creates or maintains. If the system creates records that multiple predicate rules require, list each one.
3. Record type analysis. For each record type the system creates, document whether that record type is required by the cited predicate rule and whether it is maintained in electronic form.
4. Conclusion and rationale. A clear statement of whether Part 11 applies, with documented rationale. If Part 11 does not apply, state why -- either no predicate rule requires the record, or the record is not maintained electronically.
5. Hybrid record determination. If the system creates or interfaces with records that exist in both paper and electronic form, document which version is the official record, and whether both copies must meet Part 11 requirements.
6. Review date and responsible party. Assessments age. When the system is updated, when a new predicate rule is added, or when record-keeping practices change, the assessment must be revisited. Document who is responsible for reassessment triggers and when the next scheduled review is.

Where Organizations Get Part 11 Applicability Wrong

Three patterns account for most applicability errors during FDA inspections:

Assuming software category determines applicability

A common misconception is that Part 11 applies to all "validated systems" or all GxP software. It does not. Part 11 applicability depends on what records the system creates -- not on whether the system is validated or labeled as GxP. A laboratory scheduling tool used exclusively for optional workflow management, with no predicate rule requiring its records, is outside Part 11 scope even if it runs in a validated environment.

Treating hybrid records as automatic exemptions

If a paper record is signed and then scanned and stored electronically, the electronic copy is a record required by the predicate rule -- and Part 11 may apply to the electronic storage system. The question is whether the paper or the electronic version is the official record. Organizations sometimes assume that because the original was paper, they have no Part 11 obligation for the electronic copy. That assumption is incorrect if the electronic copy is used for regulated purposes, submitted to FDA, or retained as the primary access copy.

Failing to reassess after system changes

Applicability assessments are living documents. A system that was correctly determined to be outside Part 11 scope can move into scope if its use expands to cover predicate-rule-required records. A SaaS tool initially deployed for optional project tracking that is later configured to manage GMP batch records triggers Part 11 obligations that did not exist at initial deployment. Without a change control process that flags system scope changes for reassessment, organizations can operate non-compliant systems without realizing it.

The Relationship Between Applicability and Scope-Narrowing

FDA's 2003 scope guidance also introduced an important flexibility: even where Part 11 applies, organizations can use a risk-based approach to determine which Part 11 controls are most critical for a given system, based on the risk to product quality and patient safety. This is distinct from applicability -- it does not mean Part 11 does not apply, it means that some controls may be implemented with less rigor for lower-risk systems.

This concept was formalized further in FDA's Computer Software Assurance (CSA) guidance, which encourages thinking in terms of the risk and criticality of each software function rather than treating all validated systems identically. For Part 11 applicability purposes, the key point is: you cannot scope-narrow your way out of an applicability finding. If a predicate rule requires the record and the record is electronic, Part 11 applies -- the question of how rigorously each control needs to be implemented is a separate risk-based analysis.

Part 11 Applicability for E-Signature Systems

E-signature systems used in FDA-regulated activities almost always meet both conditions of the applicability test. The documents being signed are typically required by predicate rules (batch release approvals, clinical trial consent forms, protocol amendments, delegation of authority logs), and the signatures are by definition electronic. This means Subpart B (electronic records) and Subpart C (electronic signatures) both apply.

The applicability assessment for an e-signature system should map each document type the system is used to sign to its predicate rule. If the system is used to sign optional internal documents as well as required regulatory documents, the assessment should document that Part 11 controls apply to the regulatory document workflows even if not to the optional workflows -- and the system must enforce those controls for the applicable workflows.

Klyverity's approach is to build Part 11 controls into the core signing architecture rather than as optional add-ons. Every signing event uses two-component authentication, captures a SHA-256 hash-chained audit entry, and records the signature meaning at the point of signing. This means organizations do not need to engineer around the platform to achieve compliance for predicate-rule-required documents -- it is the default. See our compliance documentation for the full regulatory mapping and our Part 11 compliance checklist for a complete assessment starting point.

Summary: When Does 21 CFR Part 11 Apply?

Part 11 applies when two conditions are both true: a predicate rule (an FDA regulation other than Part 11) requires a record, and that record is maintained in electronic form. When both conditions are met, all of Subpart B and -- for records requiring signatures -- all of Subpart C apply. The analysis must be documented in an applicability assessment, retained as a controlled document, and reviewed whenever the system or its use changes.

Getting this determination right is not just a compliance formality. Under-scoping leads to uncontrolled Part 11 systems that surface as 483 observations. Over-scoping wastes validation resources on systems that do not need them. A well-documented applicability assessment is both a compliance asset and a resource allocation tool.