21 CFR Part 11 compliant software, GxP compliance software and computer system validation

There is no such thing as FDA certified Part 11 software

FDA runs no certification, accreditation or approval scheme for Part 11 software, and no third party is authorized to run one on the agency's behalf. Every "Part 11 compliant" badge in this market is a vendor asserting something about its own product. That is not automatically dishonest. It is just a claim with no external check behind it, which is why an inspector will never ask to see your vendor's certificate. They will ask to see your validation record and your audit trail.

The practical consequence is that responsibility splits, and buyers routinely misjudge where the line falls. The table below is the split that holds up in an inspection.

Read the right-hand column again. Not one of those items is something a vendor can do for you, and the last one is the item most often missed entirely. A supplier assessment is genuine work, and it belongs in the same discipline as the rest of your vendor risk management program, not in a separate one-off spreadsheet that nobody revisits at renewal.

Closed versus open turns on who controls access, not cloud versus on-premise

This is the most common technical error in Part 11 conversations, and it has survived two decades of repetition. The regulation does not mention hosting. Section 11.3(b)(4) defines a closed system as "an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system." Section 11.3(b)(9) defines an open system as one "in which system access is not controlled" by those persons. The whole test is access control.

That matters commercially because the open-system path in 11.30 adds obligations on top of everything in 11.10, specifically document encryption and appropriate digital signature standards, as necessary to ensure record authenticity, integrity and confidentiality from creation to receipt. Teams who assume "cloud means open" buy controls they do not need. Teams who assume "our server means closed" sometimes miss that a managed service provider holds the administrator credentials.

Notice that the deciding factor in every one of those rows is entitlement ownership. That makes the closed-system question a direct descendant of ordinary access governance, and it is answered with the same evidence you would produce for IT general controls: who can grant access, who reviews it, and how removals are proven.

Electronic signatures, and the one-time letter to FDA that almost no checklist mentions

Subpart C sets three requirements that shape product selection. Under 11.100(a) a signature must be unique to one individual and never reused or reassigned, which quietly rules out shared or generic accounts anywhere near a signed record. Under 11.100(b) the organization must verify the individual's identity before it establishes, assigns or certifies that signature. And 11.200(a)(1) requires non-biometric signatures to use at least two distinct identification components, typically an identification code and a password.

Here is the part that surprises buyers, and that vendors sometimes get wrong in the conservative direction. Part 11 does not demand full credentials on every single signature. Under 11.200(a)(1)(i), when an individual executes a series of signings during one continuous period of controlled system access, the first signing uses all components and later signings in that session need only one component, provided it is executable solely by that individual. Signings outside a continuous session each need the full set under 11.200(a)(1)(ii). A batch reviewer signing forty results in one sitting does not have to retype a password forty times for the regulation's sake, and a product that forces it is making a design choice, not obeying a rule.

Then there is 11.100(c), which is an obligation on your organization and not on any software. Persons using electronic signatures must, prior to or at the time of use, certify to FDA that the electronic signatures in their system are intended to be the legally binding equivalent of traditional handwritten signatures. The certification has to be signed with a traditional handwritten signature. It is one letter, filed once for the organization rather than per system, and a great many companies running signed electronic records have never sent it.

The submission detail changed recently enough that older guides are wrong. An amendment published 2 March 2023 at 88 FR 13018 removed the fixed mailing address from the rule text. The paragraph now says information on where to submit the certification can be found on FDA's web page on Letters of Non-Repudiation Agreement. If your SOP names a street address copied from a pre-2023 template, it is pointing at something the regulation no longer says.

What GxP compliance software has to cover, by predicate rule

GxP is a collective label, not a regulation. It covers good manufacturing, laboratory and clinical practice, and each has its own predicate rules, its own inspectorate and its own record set. A platform sold as GxP compliance software is really being asked to hold records from several of these at once, which is why scoping by predicate rule beats scoping by department.

A useful buying test falls out of this table. If a vendor cannot tell you which predicate rule each record type in their product answers to, they have built features rather than a compliance system, and the mapping work lands on you during validation at the worst possible moment. The same logic applies to audit management for internal and third-party inspections, and to the healthcare compliance obligations that sit alongside GxP for organizations that also touch patient data.

On budget: recorded buyer data across compliance and quality platforms puts most contracts between roughly $20,000 and $54,000 a year at the median, with the full recorded range running from about $7,500 to over $150,000. Validated life sciences systems cluster toward the upper half because the vendor is shipping validation documentation and holding a change process you can assess. Validation effort is the line that surprises people, commonly adding 30 to 100 percent of first-year license in year one. Our breakdown of compliance software pricing has the per-vendor medians and the negotiation spread.