21 CFR: making sense of it all
When people in clinical research mention 21 CFR, they usually mean Part 11. But Title 21 of the Code of Federal Regulations covers a much broader landscape: food safety, pharmaceuticals, medical devices, biologics, cosmetics, and tobacco products. If you are running studies in any of these areas and selling into the US market, some part of 21 CFR is likely relevant to your work.
What 21 CFR actually covers
The regulation addresses several distinct product categories:
- Food safety: labelling, quality, and safety of food products including supplements and additives
- Drugs: development, testing, manufacturing, and marketing of prescription and OTC pharmaceuticals
- Medical devices: design, testing, and production standards to ensure safety and effectiveness
- Biologics: vaccines, blood products, gene therapies, and similar products
- Cosmetics and tobacco: safety, labelling, and marketing requirements
Most research teams interact with only one or two of these areas. But understanding the broader context helps when navigating cross-category products like supplement-device combinations or food-grade biologics, where a study can find itself subject to requirements from more than one part of the regulation simultaneously without anyone on the team realising it until late in the design process.
21 CFR Part 11: what it means for clinical systems
Part 11 is the section that matters most to digital trials. It sets out the FDA's requirements for accepting electronic records and signatures as legally equivalent to paper ones. The regulation's own text is worth reading directly rather than only through secondary summaries, since the exact wording of its definitions (what counts as a valid digital signature, for instance) is precise enough to matter when a vendor claims compliance.
The core requirements are:
- Validation. Any electronic system used to maintain records must be validated to confirm accuracy, reliability, and the ability to identify altered records.
- Audit trails. Every change to a record must be tracked, including who made it and when.
- Access controls. Only authorised individuals should be able to access the system, enforced through passwords, unique user IDs, and role-based permissions.
- Record retention. Electronic records must remain accessible for the full period required by FDA regulations.
- Electronic signature controls. Signatures must be linked to specific individuals and cannot be reused or transferred.
- Training. Everyone using the system must be trained in both how to use it and what Part 11 requires.
Why it matters in practice
Non-compliance with Part 11 does not just create a regulatory headache. It can result in clinical trial data being rejected by the FDA, which has significant consequences for timelines and approvals. Organisations that handle electronic records across multiple studies need to ensure their platforms are validated, their audit trails are complete, and their user management is properly controlled.
For teams working across multiple regulatory environments, Part 11 also provides a useful baseline. Many international frameworks have similar requirements, and building to Part 11 standards often satisfies or significantly overlaps with requirements in other jurisdictions.
A quick self-check against the six requirements
| Requirement | Question to ask your platform |
|---|---|
| Validation | Has this system been formally validated, and is that documentation available? |
| Audit trails | Can you produce a complete, timestamped change history for any record, on demand? |
| Access controls | Is every user uniquely identified, with permissions matched to their actual role? |
| Record retention | Will records remain accessible in a usable format for the full required retention period? |
| Electronic signature controls | Is each signature uniquely and permanently tied to one individual? |
| Training | Can you produce training records showing staff understand both the tool and Part 11 itself? |
If you can't immediately answer "yes, and here's the evidence" to every row, that's the actual gap to close, not a hypothetical one to worry about in the abstract.
If your work touches food, drugs, devices, or biologics in the US, checking where your processes sit against 21 CFR is worth doing before a problem surfaces rather than after. The regulation itself, not just industry summaries of it, is freely available and worth keeping bookmarked for exactly this kind of check.
It's a document worth revisiting periodically rather than reading once at study setup and filing away. Platforms get updated, staff turn over, and integrations get added mid-study, and each of those changes is a fresh opportunity for a gap to open up between what the regulation requires and what the system actually does day to day.