21 CFR Part 11 applies to a pet study when the study's records are kept in electronic form under a records requirement in FDA's own regulations. The plain case is a study of an unapproved new animal drug shipped under the investigational exemption in 21 CFR 511.1, which requires the investigator and the sponsor to keep records of the investigation. Hold those records in software and Part 11 governs the software. An observational study, or a study of a marketed product used as labelled with no plan to send the data to FDA, has no FDA records requirement, and Part 11 does not apply to it. Where it applies, Part 11 asks for a validated system, complete copies, limited access, a secure time-stamped audit trail that never hides an earlier entry, and electronic signatures that show who signed, when and with what meaning, are linked to the record, and are made of two identity components. Each organization that uses electronic signatures also tells FDA so, in a letter signed by hand.
What Part 11 is
Part 11 does not ask anyone to keep a record. Other FDA rules do that, and Part 11 sets the terms on which those records may be electronic. Section 11.1(b) says the part applies to "records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations", and to records submitted to FDA electronically. The rule that requires the record is called the predicate rule. No predicate rule, no Part 11.
FDA's 2003 guidance on the scope and application of Part 11 reads it narrowly. Records required by a predicate rule and kept electronically in place of paper are Part 11 records, as are records submitted to FDA electronically, and FDA exercises enforcement discretion over the validation, audit trail, retention and copying requirements. The predicate rule still requires the record to exist and to be complete.
Which pet studies have a predicate rule
| Study design | FDA records requirement | Part 11 |
|---|---|---|
| Observational study or registry, nothing assigned | None | Does not apply |
| Marketed product used as labelled, data not for FDA | None for the study. Serious, unexpected adverse events go to the product's applicant, who reports them to FDA within 15 working days and keeps records for five years (21 CFR 514.80) | Does not apply to the study's records |
| Any study whose data will support an approval or a new claim | 21 CFR 514.117(b)(2): the study follows "an appropriate standard of conduct" and the protocol states the intention to follow "a standard of conduct acceptable to FDA". That standard is Guidance #85, VICH GL9 | Applies to the electronic records |
| Unapproved new animal drug under an investigational exemption, such as a peptide or a compounded product | 21 CFR 511.1(b)(7)(ii): the investigator keeps "complete records of the investigations, including complete records of the receipt and disposition of each shipment". 511.1(b)(8)(i): the sponsor keeps investigator reports for two years after the study ends or the drug is approved | Applies |
Intent is settled before enrollment, not after. Section 514.117(e) says "reports lacking the details which permit scientific evaluation will not be considered", so a university study that starts as a registry and is later offered to a sponsor is judged on the records it made at the time. Part 11 is an FDA rule; other regulators have their own.
What it asks of the records
Section 11.10 lists the controls for a closed system, one where access is controlled by the people responsible for the records on it (11.3(b)). It asks for:
- validation of the system "to ensure accuracy, reliability, consistent intended performance" (a);
- "accurate and complete copies of records in both human readable and electronic form" (b);
- protection of records so they can be retrieved "throughout the records retention period" (c);
- "limiting system access to authorized individuals" (d);
- "secure, computer-generated, time-stamped audit trails" of entries and changes, where "record changes shall not obscure previously recorded information", kept at least as long as the records (e);
- checks that enforce the permitted sequence of steps (f), and authority checks on who may use the system, sign or alter a record (g);
- people with "the education, training, and experience" to do their part (i);
- "written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures" (j);
- controls over the system's documentation (k).
GL9 says the same of the data themselves, for studies meant to go to a regulator. Raw data should be "attributable, original, accurate, contemporaneous and legible" (8.3.1). Corrections are initialed and dated with the reason for the change (8.3.5). When data are entered directly into a computer, "the electronic record is considered the raw data", each entry is made under the "electronic signature of the individual making the entry", and changes are kept in an audit trail (8.3.6). FDA's October 2024 questions-and-answers guidance on electronic systems in clinical investigations covers "clinical investigations of foods, medical products, tobacco products, and new animal drugs". An earlier reading described it as co-issued by the Center for Veterinary Medicine; FDA's page for it, read today, lists the Center for Drug Evaluation and Research and the Office of Clinical Policy and Programs. Guidance #287 (June 2025) describes how the Center for Veterinary Medicine uses raw data in its review of a new animal drug application.
What it asks of signatures
- A signed record shows "the printed name of the signer", "the date and time when the signature was executed" and "the meaning (such as review, approval, responsibility, or authorship)" (11.50).
- Signatures are "linked to their respective electronic records" so they "cannot be excised, copied, or otherwise transferred" (11.70).
- Each signature is "unique to one individual" and never reused (11.100(a)), and the organization verifies a person's identity before issuing one (11.100(b)).
- A signature that is not biometric uses "at least two distinct identification components such as an identification code and password". The first signing in a continuous session uses all components, later signings at least one, and a new session all of them again (11.200(a)).
- Passwords are "periodically checked, recalled, or revised", lost tokens are deauthorized, and attempts at unauthorized use are detected and reported "in an immediate and urgent manner" (11.300).
- Before using electronic signatures, the organization certifies to FDA that they are the legally binding equivalent of handwritten ones, in a certification "signed with a traditional handwritten signature" (11.100(c)). FDA calls it a letter of non-repudiation agreement and asks for it on company letterhead.
What stays yours
Part 11 is written for the people who keep the records, not for the people who supply the system. Section 511.1(f) makes a contract research organization that takes on a sponsor's obligation "subject to the same regulatory action as a sponsor"; a vendor that supplies software takes on none. These stay with the sponsor and the investigator:
- the protocol and its statement of the conduct standard (514.117(b)(2));
- the investigational exemption, the records, monitoring by a qualified person, and prompt reports to FDA and all investigators of findings that "may suggest significant hazards" (511.1(b)(7), (b)(8));
- any transfer of sponsor duties to a contract research organization, in writing (511.1(f));
- the ethics review, and the consent text behind the "documented process by which an owner, or owner's agent, voluntarily confirms" participation (GL9 1.15);
- under Part 11 itself, evaluating the vendor's validation evidence, keeping training records and a written accountability policy, checking identity before a signature is issued, and sending the certification letter (11.10(i), (j); 11.100(b), (c)).
One line of 511.1(b)(8)(iv) reaches the consent text and every recruitment page: no one acting for the sponsor may "represent that the new animal drug is safe or effective for the purposes for which it is under investigation". What GL9 asks beyond this is in VICH GL9 in plain words.
Where Signalment fits
Signalment is the system. Its electronic signatures re-check the signer's password and bind to the hash of what was signed. Its audit trail is append-only and hash-chained, and exports with the fingerprints so a monitor verifies it offline. The database lock carries a fingerprint, and the exports are CSV per form, a data dictionary and a JSON bundle. A compliance guide inside the workspace covers INAD, IACUC, VICH GL9 and Part 11, and a validation summary with the test suite behind it is available for a sponsor's evaluation. It does not yet offer single sign-on or SAS exports. It does not write the protocol or the consent, review the ethics, file the exemption or send the certification letter. More at signalment.app/sponsors.
Sources
- 21 CFR Part 11, electronic records and electronic signatures: https://www.ecfr.gov/current/title-21/part-11
- 21 CFR 511.1, new animal drugs for investigational use: https://www.ecfr.gov/current/title-21/section-511.1
- 21 CFR 514.117, adequate and well-controlled studies: https://www.ecfr.gov/current/title-21/section-514.117
- 21 CFR 514.80, records and reports on approved new animal drugs: https://www.ecfr.gov/current/title-21/section-514.80
- FDA, Part 11, Electronic Records; Electronic Signatures, Scope and Application (2003): https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application
- FDA, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 2024): https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-systems-electronic-records-and-electronic-signatures-clinical-investigations-questions
- FDA Guidance #85, VICH GL9, Good Clinical Practice (May 2001): https://www.fda.gov/media/70333/download
- FDA Guidance #287, Raw Data for Safety and Effectiveness Studies (June 2025): https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cvm-gfi-287-raw-data-safety-and-effectiveness-studies
- FDA, Letters of Non-Repudiation Agreement: https://www.fda.gov/industry/getting-started-esg-nextgen/letters-non-repudiation-agreement
- FDA Center for Veterinary Medicine, guidance by number: https://www.fda.gov/animal-veterinary/guidance-industry/guidance-number