Part 11 does not regulate bioinformatics as a field. It regulates electronic records and signatures that FDA rules require you to keep or that you submit to the agency. If a docking run, a variant-calling pipeline or a peptide-design model produces data that ends up in one of those records, the system that creates, changes and stores it has to meet Part 11 controls. If the work is early exploratory research that never feeds a regulated record, Part 11 generally does not reach it. This guide shows how to tell which side your workflow sits on and what to put in place if it is the regulated side.
TL;DR
- Part 11 applies to electronic records required under an FDA "predicate rule" or submitted to the FDA, not to every computational analysis.
- The core controls are system validation, secure time-stamped audit trails, access limits, record protection and trained personnel.
- Legacy pipelines are not grandfathered, so older scripts and servers that now feed regulated records need review.
- Decide the regulatory status of each workflow early, in the scoping stage, and write it into the project documents.
- A vendor's testing evidence helps, but your organization still has to validate the system for how you use it.
Table of Contents
- What Part 11 is, in one paragraph
- Is Part 11 mandatory for bioinformatics work?
- Which records does Part 11 cover?
- Where the boundary falls in clinical data flows
- What about analysis software itself?
- The core controls, translated for a pipeline
- Legacy scripts and the grandfathering myth
- A workable assessment process
- Working with an outside computational partner
- Our perspective
- Where Innova Biotech fits
- FAQ
- Sources
What Part 11 is, in one paragraph
The FDA finalized Part 11 in the Federal Register on March 20, 1997, with an effective date of August 20, 1997. The regulation sets out the criteria under which the agency considers electronic records, electronic signatures and handwritten signatures on electronic records trustworthy, reliable and generally equivalent to paper (21 CFR 11.1(a)). It is split into general provisions, electronic records (Subpart B) and electronic signatures (Subpart C). Nothing in it mentions bioinformatics. The link comes from what your pipeline touches.
Is Part 11 mandatory for bioinformatics work?
It is mandatory when two conditions meet: the record is electronic, and an FDA regulation or statute requires it or requires you to submit it. University compliance guidance puts it plainly: Part 11 applies only to electronic records and signatures generated in FDA-regulated research and required under a predicate rule.
A predicate rule is the underlying FDA requirement, for example good laboratory practice, good clinical practice or good manufacturing practice rules that say what records you must keep. Part 11 then says how those records must behave when they are electronic. The FDA reminds regulated entities that electronic records must still be maintained in accordance with the underlying predicate rules.
In practice that gives you three situations:
| Situation | Part 11 likely in scope? |
|---|---|
| Virtual screening of a compound library to pick hits for internal discovery work | Usually not, because no predicate rule requires those records |
| Sequence or biomarker analysis whose output becomes part of a nonclinical study report or clinical trial dataset | Yes, for the systems that create, change or store those records |
| Computational results that go into a regulatory submission as supporting data | Yes, where the record is submitted to the FDA |
This table is a screening aid, not a legal determination. Your regulatory affairs or quality lead should confirm the call for each program, because the answer depends on the specific predicate rule and how the record is used.
Which records does Part 11 cover?
Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under any records requirements set forth in FDA regulations (21 CFR 11.1(b)). It also covers electronic records submitted to the FDA under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, even when FDA regulations do not specifically identify them. The FDA repeats this scope in its guidance on Part 11 scope and application.
For a bioinformatics team, the records that tend to matter are:
- Raw and processed data files that serve as source data for a regulated study.
- Analysis outputs, tables and figures included in study reports or submissions.
- Configuration, parameter files and software versions that define how a result was produced.
- Approvals, reviews and sign-offs on those results.
One point from FDA guidance on computerized systems in clinical trials is worth remembering: when original observations are entered directly into a computerized system, the electronic record is the source document. If a pipeline writes the first and only copy of a measurement, that file is the source, and it needs the controls to match.
Where the boundary falls in clinical data flows
The FDA's 2024 guidance on electronic systems in clinical investigations draws a useful line. The agency says it does not intend to assess the compliance of electronic health record systems or other real-world data sources with Part 11. Once that data enters a sponsor's electronic data capture system, though, the FDA intends to assess Part 11 compliance.
For bioinformatics this means the handoff matters. Genomic or imaging-derived data pulled from a hospital system is outside Part 11 scrutiny at the source. The moment your team ingests it into a sponsor-controlled system that supports a trial, the receiving system is in scope. Document where that handoff happens and who owns the system on each side. For the privacy side of the same handoff, see our checklist on vetting HIPAA compliant bioinformatics.
What about analysis software itself?
A common misunderstanding is that Part 11 "certifies" software. It does not. Part 11 puts requirements on the electronic record systems and procedures of the regulated organization. A statistical or modeling package is one component of that system. The same engine can sit in an exploratory notebook with no Part 11 obligations, or inside a validated, access-controlled environment generating regulated records, where the controls apply to the whole system around it.
That is why "is tool X Part 11 compliant?" is the wrong question. Ask instead whether the environment in which you use the tool, including users, permissions, versions, storage and review steps, meets the requirements for the records it produces.
The core controls, translated for a pipeline
The closed-system controls in 21 CFR 11.10 are the center of any assessment. The eCFR text lists validation, secure computer-generated time-stamped audit trails, limited system access, record protection for accurate retrieval and training for personnel. It also asks for written policies on individual accountability for actions under electronic signatures (11.10(j)) and for revision and change control over systems documentation (11.10(k)).
Here is what each looks like in a computational workflow.
Validation
Validation means showing, with documented evidence, that the system does what it is intended to do consistently. For a pipeline, that includes defined requirements, test cases with known inputs and expected outputs, and a record of the results. Yale's research compliance guidance notes that investigators cannot simply choose off-the-shelf systems because a vendor supplies proof of testing: the institution must validate the systems along with the investigator's process for using them. Vendor evidence is an input to your validation, not a replacement.
Practical steps:
- Write intended-use statements for each pipeline stage.
- Pin software versions, reference databases and containers.
- Run reference datasets with known answers and keep the outputs.
- Re-run the tests after any change that could affect results.
Audit trails
An audit trail records who did what and when, and it must not let anyone overwrite earlier entries silently. FDA guidance says audit trails must be retained at least as long as the subject electronic records and be available for agency review and copying.
In pipelines, shell histories and ad hoc log files rarely meet this bar. Workflow managers that log every run with user, timestamp, inputs, parameters and versions get you closer. Make sure the logs are protected from edits and stored on the same retention schedule as the results.
Access control
Only authorized people should be able to run, change or approve. That means individual accounts (no shared logins), role-based permissions, and a way to remove access promptly when someone leaves the project. For electronic signatures, it also means each signature is unique to one person and linked to the record it signs.
Record protection and error prevention
The same FDA guidance says computerized systems should be designed to preclude errors in data creation, modification, maintenance, archiving, retrieval or transmission. In bioinformatics, that translates into checksums on input files, write-protected archives of final outputs, tested backups and controlled data transfer. Our guide to secure data transfer in biotech covers the transfer step in detail.
Training and SOPs
People who run and review the system need documented training. The same guidance expects standard operating procedures for system setup, security, change control and data backups, along with validation and documented user training. If a new analyst joins and nobody can show what they were trained on, that is a finding waiting to happen.
Legacy scripts and the grandfathering myth
Teams often assume an older in-house pipeline is exempt because it predates their quality system. The FDA says otherwise: Part 11 does not grandfather "legacy systems", and firms are expected to take steps toward full compliance. In the same document, FDA officials describe deciding how deeply to look at Part 11 on a case-by-case basis, based on initial findings and program resources.
The agency's current posture is also worth knowing. The FDA states that it continues to apply a narrow and practical interpretation of Part 11. That is not permission to skip controls. It means inspectors focus on whether records are trustworthy and the predicate rule requirements are met, rather than on formalities.
If you inherit a script collection that now feeds regulated records, a sensible sequence is: inventory what exists, decide which outputs are regulated records, then either bring the pipeline into a controlled environment or move that step into a validated system.
A workable assessment process
This is the process we suggest for a biotech or pharma R&D group scoping a computational project.
- Map the data flow. Draw each step from raw input to final output, with the system and owner at every step.
- Identify predicate rules. For each output, ask whether an FDA regulation requires you to keep it or submit it. Record the answer and who made the call.
- Classify systems. Mark each system as in scope, out of scope or in scope for some functions. Write down the reasoning.
- Gap-assess against the controls. Check validation, audit trails, access, record protection, training and change control for the in-scope systems.
- Remediate or isolate. Fix gaps, or fence off the regulated step in a controlled environment and keep exploratory work separate.
- Document and retain. Keep validation records, SOPs, training files and audit trails on the same retention schedule as the records they protect.
When a sponsor provides technology for a trial, academic institutions may ask for more. Yale's guidance says the institution requires a written attestation of Part 11 compliance, security and ongoing record access when a sponsor supplies the technology. Expect similar requests from partners and get your answers ready.
Working with an outside computational partner
Outsourcing computation does not outsource responsibility. If a service provider produces results that become regulated records, your quality unit still needs to know how those records are created, controlled and handed over. Settle these points in the contract and scope, not after delivery:
- Whether the deliverables are intended for a regulated record or for internal decision-making only.
- What the provider will document: versions, parameters, run logs, test results.
- How data moves in both directions and who can access it.
- Confidentiality terms and how IP is protected. See our notes on NDA requirements that close common gaps.
- What the deliverable package looks like for later submission use, including the BioCompute-style checklist for regulatory data submission.
The four contract deliverables for bioinformatics scoping are a good starting template, and our overview of bioinformatics data security for R&D teams covers the security controls that sit under many Part 11 requirements. For a pipeline-level checklist, see 8 pipeline checks for 21 CFR Part 11.
Our perspective
Most Part 11 trouble we see in computational projects does not come from exotic requirements. It comes from deciding too late. A team runs virtual screening or a design campaign informally, the results prove promising, and only then does someone ask whether the supporting records can stand up to review. Reconstructing versions, parameters and decisions after the fact is slow and often impossible.
Our approach is to ask the regulatory question at the first consultation. Is this exploratory, or could any output become a regulated record? If it is exploratory, we keep the process lean and fast, but we still record software versions, parameters and data lineage, because it costs little and keeps options open. If a regulated use is plausible, we agree with the client's quality team up front on documentation, data handling and what a handoff package contains.
We also think clients should keep the determination in their own hands. Whether a record falls under a predicate rule is a regulatory judgment for your quality and regulatory leads. Our job is to make the computational side transparent enough that their judgment is easy to make and easy to defend: clear updates, documented methods and strict confidentiality throughout the project.
— Hooman
Where Innova Biotech fits
We are a San Francisco-based team providing custom computational biology and bioinformatics services for biotech and pharma projects. That includes virtual screening and hit-to-lead optimization, protein engineering and chimeric protein design, enzyme optimization and de novo peptide design. Each engagement is scoped to the project, with confidentiality and data security built into the workflow and regular communication from first consultation to delivery. If you are planning a computational project and want the documentation expectations settled before work starts, you can contact us through our site.
FAQ
Is 21 CFR Part 11 mandatory?
It is binding for electronic records that FDA regulations require you to keep or that you submit to the FDA. It does not apply to electronic records that no FDA rule requires, such as purely internal exploratory analyses. Your regulatory lead should decide the status of each workflow and write down the reasoning.
When did 21 CFR Part 11 go into effect?
The final rule was published in the Federal Register on March 20, 1997, and took effect on August 20, 1997. The FDA has since issued guidance on its scope and enforcement approach, and it does not grandfather legacy systems.
What records does 21 CFR Part 11 apply to?
It applies to electronic records created, modified, maintained, archived, retrieved or transmitted under FDA record requirements. It also covers electronic records submitted to the FDA under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act. Paper records and non-regulated electronic records fall outside it.
How do you get a bioinformatics workflow Part 11 ready?
Start by mapping the data flow and confirming which outputs are regulated records. Then validate the in-scope systems, put secure time-stamped audit trails and individual access in place, write SOPs for change control and backups, and document training. Keep the evidence for as long as the records themselves.
Sources
- Federal Register, March 20, 1997: Electronic Records; Electronic Signatures final rule
- eCFR: 21 CFR Part 11, Electronic Records; Electronic Signatures
- FDA: Part 11, Electronic Records; Electronic Signatures, Scope and Application
- FDA: Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations
- FDA: Guidance for Industry, Computerized Systems Used in Clinical Trials
- FDA Bioresearch Monitoring: Attachment A
- Yale University HRPP: 21 CFR Part 11 guidance