A laboratory can move from paper records to a modern LIMS and still create compliance problems if the electronic workflow is not designed, validated and governed correctly.
21 CFR Part 11 is often reduced to a short feature checklist: audit trails, electronic signatures and passwords. Those controls matter, but Part 11 is broader than any single software feature.
21 CFR Part 11 establishes criteria under which FDA considers applicable electronic records and electronic signatures trustworthy, reliable and generally equivalent to paper records and handwritten signatures. For a LIMS, this can involve controlled access, validation, secure audit trails, record protection and retrieval, electronic-signature controls, workflow checks, user accountability, system documentation and procedures around how the laboratory actually uses the system.
The first question is therefore not: "Is this LIMS Part 11 compliant?"
The better question is: Which laboratory records and signatures are subject to Part 11, which controls apply to our intended use, and how will the configured LIMS, procedures and users satisfy those requirements?
The current 21 CFR Part 11 regulation applies to electronic records created, modified, maintained, archived, retrieved or transmitted under applicable FDA record requirements, along with certain electronic submissions and electronic signatures.
FDA's separate guidance on Part 11 Scope and Application explains the Agency's narrower interpretation of Part 11 and emphasizes the importance of the underlying FDA requirements, commonly called predicate rules. U.S. Food and Drug Administration That distinction should shape how a laboratory approaches a LIMS project.
What Does 21 CFR Part 11 Mean for a Laboratory LIMS?
Part 11 does not create the underlying requirement to perform a test, retain a laboratory record or obtain an approval.
Those obligations generally come from other applicable FDA statutes and regulations. Those underlying requirements are commonly called predicate rules.
Part 11 becomes relevant when applicable records or signatures required by those rules are maintained or used electronically within its scope.
For example, a pharmaceutical QC laboratory may be required under applicable CGMP regulations to retain laboratory testing records. If the laboratory relies on its LIMS as the electronic record used to satisfy those requirements, Part 11 may apply to those electronic records and signatures.
This is why a laboratory should identify the regulatory status and intended use of each important electronic record rather than assuming every screen, dashboard and temporary calculation in the LIMS automatically falls under Part 11.
The LabZila 21 CFR Part 11 LIMS functionality is designed to support electronic-record controls, role-based access, audit histories, electronic approvals and signatures within configurable laboratory workflows. The laboratory still remains responsible for determining applicability and validating its actual implementation.
Start With the Predicate Rule, Not the Software Feature List
A sound Part 11 assessment starts by asking why the laboratory record exists.
Which FDA regulation requires the record?
What information must it contain?
How long must it be retained?
Who must review or approve it?
Is an electronic signature being used as the equivalent of a required handwritten signature?
Is the electronic record the record the organization actually relies on for regulated work?
These questions establish the context in which Part 11 controls need to operate.
FDA's Scope and Application guidance recommends determining in advance whether the organization intends to rely on the electronic or paper version of records required by predicate rules and documenting that decision.
That prevents a common compliance problem where an organization calls paper the "official record" but daily regulated decisions are actually being made from electronic data. Actual business practice matters.
Not Every Electronic Laboratory Record Is Automatically a Part 11 Record
A LIMS can contain many types of information.
Some may be directly required by FDA regulations.
Some may be operational information created voluntarily to make laboratory work easier.
Some may support a required record without themselves being the regulated record.
Some may be temporary system data.
Part 11 applicability therefore needs to be evaluated against the relevant predicate rules and actual use of the electronic record.
FDA's current guidance interprets the scope of Part 11 more narrowly than some early industry interpretations. It focuses particularly on required records maintained electronically instead of paper, required records maintained electronically alongside paper when the electronic version is relied upon for regulated activities, applicable electronic submissions, and electronic signatures intended to serve as required signatures.
A laboratory should document this scope rather than apply expensive controls indiscriminately to every piece of data in the system.
Which LIMS Capabilities Are Important for Laboratories Working Under 21 CFR Part 11?
Important capabilities include controlled user access, system validation support, secure time-stamped audit trails, electronic-signature controls, record and signature linking, operational and authority checks, record protection and retrieval, system-documentation controls, user accountability and configurable review and approval workflows.
A capable system provides the technical foundation. The laboratory then has to configure and use those capabilities correctly. For example, a LIMS may technically support role-based permissions. That does not help if every analyst is assigned administrator privileges.
It may provide audit trails. That does not help if regulated changes occur through an uncontrolled external spreadsheet. It may provide electronic signatures. That does not help if users share credentials. Part 11 readiness is therefore a combination of software capability, system configuration and organizational control.
Access Should Be Limited to Authorized Individuals
Part 11's closed-system controls include limiting system access to authorized individuals. For a LIMS, this means access should be attributable to identifiable users rather than generic shared accounts. A laboratory may have receiving personnel, analysts, technical reviewers, QA staff, managers and system administrators.
Those roles do not necessarily need the same permissions.
An analyst may need to enter results but not approve their own work.
A technical reviewer may need authority to review certain methods or departments.
QA may need access to deviations and quality records.
A system administrator may manage configuration but should not automatically receive authority to approve laboratory results simply because they administer the software. Role-based permissions help create that separation.
LabZila supports role-based access and configured workflow responsibilities so laboratory activities can be aligned with authorized users and review stages.
Authority Checks Should Match Real Responsibilities
Logging into a system proves only that the user has access. It does not automatically establish that the user is authorized to perform every action.
Part 11 also addresses authority checks designed to ensure that only authorized individuals can use the system, electronically sign records, alter records or perform specific operations. This distinction matters in laboratories.
A microbiology analyst may be authorized to enter microbiology results but not approve analytical chemistry results.
A supervisor may be allowed to review results but not modify controlled system configuration.
A QA approver may have authority to sign a final quality record while another employee can only prepare it.
Permissions should reflect those responsibilities. The system configuration should follow approved laboratory roles rather than granting broad access because it is administratively convenient.
Shared User Accounts Create a Serious Accountability Problem
A record saying "LABUSER entered result 4.27" provides limited accountability if ten people know the LABUSER password. Electronic records and signatures work only when activities can be attributed to the correct individual.
Each user should therefore have a unique identity appropriate to the laboratory's access-control model. Account provisioning, modification and deactivation should also be controlled.
When an employee changes role or leaves the organization, their access should be updated appropriately. User lifecycle management is part of maintaining the reliability of the electronic-record environment.
What Is an Audit Trail Under 21 CFR Part 11?
For applicable closed-system records, Part 11 describes secure, computer-generated, time-stamped audit trails that independently record operator entries and actions that create, modify or delete electronic records, while preventing record changes from obscuring previously recorded information.
The audit trail should therefore preserve history rather than simply show the latest value. Suppose an analyst enters: Assay = 98.7%Later, the value changes to: Assay = 99.7%
A traceable system should not make the original value vanish as though it never existed. Depending on the applicable workflow and configuration, the history may need to show the previous value, new value, responsible user, date and time and other information needed by the laboratory to understand the change.
That history helps answer:
Who changed the record?
What changed?
When did it change?
What did the record contain before the change?
Why was the change made, where the procedure requires a reason?
LabZila can maintain time-stamped histories of applicable record creation, changes, actions, reviews and approvals within connected laboratory records.
An Audit Trail Is Not the Same as an Activity Log
Some systems market any system log as an audit trail. The distinction matters. A technical activity log may show that a user logged in, opened a page or generated an error. Those records can be useful for IT and security.
A regulated audit trail is concerned with preserving meaningful history around electronic records and actions relevant to regulated work. A laboratory evaluating an audit trail LIMS should therefore test real scenarios.
Change a result.
Correct a sample identifier.
Return a record from review.
Approve a result.
Amend a report.
Then examine exactly what remains visible. The demonstration should show whether the previous information is preserved and whether the history is attributable and understandable.
Audit Trails Should Be Reviewable, Not Merely Stored
Creating an audit trail is only part of the control. A laboratory should also determine when and how relevant audit-trail information is reviewed.
The appropriate frequency and scope depend on the record, risk, predicate rules and laboratory procedure. A routine administrative field may not warrant the same review approach as a critical laboratory result or electronic approval.
The point is not to create a procedure requiring QA to read every system event generated every day. The objective is to use audit-trail information where it helps establish the reliability and integrity of regulated records.
FDA's Scope and Application guidance recommends a risk-based approach to audit trails, considering predicate-rule requirements and the potential effect on product quality, safety and record integrity.
What Should Laboratories Look for in Electronic Signatures and Audit Trails for Test-Result Signoff?
For electronic signatures, laboratories should look for unique user identity, appropriate authentication, signer name, date and time, signature meaning and a secure link between the signature and the signed record. For audit trails, they should look for secure, time-stamped history that preserves prior information and identifies applicable record changes and actions.
These controls work together.
The audit trail shows how the record changed.
The signature establishes who formally performed the review, approval or other signed action.
They are not substitutes for each other.
What Information Must an Electronic Signature Show?
For signed electronic records within Part 11 scope, the regulation requires information associated with the signing that clearly indicates:
the printed name of the signer,
the date and time the signature was executed,
and the meaning associated with the signature, such as review, approval, responsibility or authorship.
The meaning is especially important. A name and timestamp do not tell the reader whether the person entered the result, technically reviewed it, approved it for release or acknowledged responsibility. An electronic signature LIMS should therefore make the significance of the signature clear.
For example:
Reviewed by: Jane Smith
Date/Time: 26 Oct 2026 14:42
Meaning: Technical Review Approved
The exact wording should reflect the laboratory's workflow.
Electronic Signatures Must Remain Linked to the Record
A signature should not behave like an image pasted onto a document. Part 11 requires electronic signatures and handwritten signatures executed to electronic records to be linked with their respective records so they cannot readily be removed, copied or transferred to falsify another electronic record.
This is why signature workflows should be managed within the controlled record structure. If an analyst signs one result, that signature should remain associated with that specific result and approval event. It should not be possible to copy the signature manifestation and make an unrelated record appear approved.
Electronic Signatures Should Be Unique to One Individual
Part 11 states that each electronic signature must be unique to one individual and must not be reused or reassigned to someone else. The organization must also verify the person's identity before establishing their electronic signature.
This is another reason shared credentials are incompatible with trustworthy electronic-signature workflows.
When an employee leaves, another employee should receive a new identity. The former user's electronic signature should not be reassigned. Historical signatures should remain attributable to the original signer.
Usernames and Passwords Are Not the Whole Electronic-Signature Requirement
For non-biometric electronic signatures, Part 11 specifies at least two distinct identification components such as an identification code and password, with requirements that vary according to whether signatures occur during one continuous controlled session or separate sessions.
A system therefore needs more than a button labelled "Approve." The laboratory should understand how authentication is performed at the actual signature event.
It should also manage identification codes and passwords appropriately, including uniqueness and controls for compromised credentials. The implementation should reflect the laboratory's security and electronic-signature procedures.
Test Completion, Review and Approval Should Be Different States When Required
A common workflow design problem is treating result entry as approval. An analyst enters the test result, clicks Save, and the system immediately treats it as final. That may not reflect the laboratory's required review process.
Where technical or quality review is required, the LIMS should distinguish among stages such as:
Result Entered
Awaiting Technical Review
Returned for Correction
Technically Approved
Awaiting Final Authorization
Released
The actual stages depend on the laboratory. The important point is that the electronic record should reflect the real review hierarchy.
The LabZila laboratory workflow automation software can support configured routing, status transitions and approvals while preserving the distinction between automated workflow movement and the human review decision.
What Does LIMS Validation Mean Under Part 11?
Validation is the documented process of demonstrating that the configured system is suitable for its intended use and performs accurately, reliably and consistently for the functions the laboratory relies on.
Part 11's closed-system controls include system validation for accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records.
FDA's Scope and Application guidance also describes enforcement discretion for certain Part 11 validation provisions while recommending a justified, documented, risk-based approach based on the system's impact on product quality, safety and record integrity. Predicate-rule validation requirements still apply where relevant.
This nuance matters. A laboratory should not interpret enforcement discretion as meaning that validation no longer matters.
A LIMS used to generate and approve critical regulated laboratory records needs substantially stronger assurance than software used only for a low-risk administrative purpose.
Vendor Testing Is Not the Same as Laboratory Validation
A LIMS vendor should test its software. That does not automatically validate the customer's configured implementation for the customer's intended use. The laboratory may configure its own:
sample types,
methods,
specifications,
approval routes,
user roles,
electronic-signature workflows,
reports,
interfaces,
calculations,
quality processes,
and data migration.
Those choices affect how the system behaves. The laboratory therefore needs an appropriate validation strategy for the implemented environment.
Vendor documentation can support that effort, but the laboratory should retain ownership of the intended-use and validation decisions.
The existing LIMS implementation guide explains how requirements, configuration, testing, validation and controlled deployment should remain connected during implementation.
Validation Should Start With Intended Use
Before writing test scripts, define what the system is expected to do. For example:
The system must prevent unauthorized users from approving laboratory results.
The system must preserve the previous value when a regulated result is changed.
The system must associate an electronic signature with the signer, date, time and approval meaning.
The system must prevent a restricted instrument from being selected where laboratory procedure requires that restriction.
The system must retain required records and make them retrievable.
These statements are much more testable than: "The LIMS must be Part 11 compliant."
Validation should demonstrate the specific functions on which the regulated workflow depends.
Record Retention Is Defined by the Predicate Rule
Part 11 does not give every electronic laboratory record one universal retention period. The applicable retention requirement generally comes from the relevant predicate rule or other governing requirement.
Part 11 controls include protecting applicable electronic records so they can be accurately and readily retrieved through the required retention period.
A laboratory therefore needs to know which rule determines how long the record must remain available. The LIMS should then support that lifecycle. Archiving should preserve the content and meaning of the record.
Changing infrastructure or software should not make required historical information unreadable. This becomes particularly important for systems used over many years.
Records Should Be Available for Inspection and Review
Part 11 includes the ability to generate accurate and complete copies in human-readable and electronic form suitable for inspection, review and copying.
FDA's guidance recommends providing meaningful access and preserving the content and meaning of records when electronic copies are supplied.
That means "we have the data somewhere in the database" is not necessarily sufficient. Authorized personnel should be able to retrieve understandable records.
If the laboratory relies on searching, sorting or linked histories during normal operations, inspection-readiness should be considered when designing retrieval and archival processes.
LabZila supports searchable laboratory records and connected activity histories according to its configured workflows.
Security Is Part of Record Trustworthiness
Part 11 is not a general cybersecurity regulation, but several of its requirements depend directly on effective security controls.
Unauthorized access can undermine electronic records.
Shared credentials can undermine signature attribution.
Poor password management can weaken identity assurance.
Excessive permissions can allow users to perform activities outside their responsibilities.
Weak administrative controls can allow critical configuration changes without adequate oversight. For a data integrity LIMS, security should therefore be designed around the regulated workflow, not added after implementation.
This includes appropriate authentication, role-based authorization, account lifecycle management, separation of duties where needed, controlled administrative access and appropriate protection of system infrastructure.
Closed Systems and Open Systems Need Different Considerations
Part 11 defines a closed system as an environment in which system access is controlled by the people responsible for the electronic records.
Many internally controlled enterprise LIMS environments are designed as closed systems, although the actual determination depends on the architecture and responsibilities.
Part 11 also addresses open systems, where access is not controlled by those responsible for record content.
For open systems, additional measures may be necessary to protect record authenticity, integrity and confidentiality, including measures such as encryption and appropriate digital-signature standards depending on the circumstances.
Laboratories should evaluate their actual deployment and data flows rather than assuming that cloud deployment automatically means open system or that on-premise deployment automatically means closed system. The determining issue is control, not simply physical server location.
SOPs Remain Essential Even With Strong Software Controls
Software cannot define every organizational responsibility. Laboratories need procedures around activities such as:
user account creation and removal, electronic-signature use, record correction, audit-trail review, system administration, data backup and recovery, record retention, validation, incident management, change control, training, and business continuity.
Part 11 also includes expectations around written policies that hold individuals accountable for actions performed under their electronic signatures.
If laboratory practice contradicts the procedure, the existence of the SOP does not solve the problem. The system and procedure should work together.
Users Need Appropriate Training
Part 11 includes determining that people who develop, maintain or use electronic-record and electronic-signature systems have the education, training and experience to perform their assigned tasks.
Training should therefore cover more than how to click through the LIMS.
Users should understand the controls relevant to their responsibilities.
An analyst should understand why credentials must not be shared.
A reviewer should understand what their electronic approval means.
An administrator should understand the impact of changing permissions or workflows.
QA should understand how audit histories and electronic records are reviewed.
Training should align with role.
Change Control Matters After Go-Live
Validation is not a one-time event that ends at system launch.
A regulated LIMS will change.
The laboratory may add a method.
Update a report.
Change an approval workflow.
Introduce a new instrument interface.
Modify a calculation.
Apply a software release.
Change identity-management infrastructure.
Each change does not necessarily require revalidating the entire system from the beginning. The laboratory should use controlled change assessment to determine the potential impact on validated functions and regulated records, then perform appropriate testing or validation.
This is where LIMS governance becomes a continuing process rather than an implementation project.
Audit Trail Review and Change Control Should Work Together
Imagine that an administrator changes a result-approval workflow so analysts can now approve records that previously required supervisor review.
The audit trail for individual results may operate perfectly.
The real compliance problem lies in the configuration change.
System documentation and configuration changes therefore need appropriate control as well.
Part 11 includes controls over system documentation and revision/change-control procedures for that documentation. A mature Part 11 approach considers both record-level activity and changes to the system that governs those records.
Electronic Records Should Remain Connected to Their Context
A laboratory result is rarely meaningful by itself. The regulated record may depend on relationships with the sample, method, specification, instrument, analyst, QC information and review history.
Breaking those relationships during migration or archival can reduce the usefulness and integrity of the record even when the final numeric result is preserved. This is why structured LIMS records can provide an advantage over disconnected files.
The LabZila Certificate of Analysis software provides one example: approved CoA information can remain traceable to supporting samples, methods, specifications and results rather than existing only as an isolated final document.
Data Integrity Is Broader Than Part 11
A system can have electronic signatures and audit trails while the laboratory still has poor data integrity. For example:
users may share passwords,
analysts may perform calculations in uncontrolled spreadsheets,
instrument results may be transcribed manually without adequate controls,
administrators may have excessive privileges,
staff may create unofficial records outside the validated workflow,
or employees may select incorrect source data.
Part 11 technical controls address important risks, but data integrity also depends on procedures, culture, training, system design, quality oversight and responsible behavior.
A data integrity LIMS should therefore be evaluated as part of the laboratory's complete data lifecycle.
Should Laboratories Buy "FDA Compliant LIMS Software"?
The phrase FDA compliant LIMS software is commonly used in software marketing, but laboratories should be careful with it. FDA does not make a laboratory compliant simply because it purchases a product carrying that label.
Software can provide features that support regulated workflows. The laboratory still needs to determine which requirements apply, configure the system appropriately, validate intended use where required, control access, establish procedures, train users, maintain records and govern changes.
A more useful vendor question is: Show us how your system supports the specific Part 11 controls and predicate-rule requirements that apply to our intended use. Then test those capabilities through realistic scenarios.
What Should a Part 11 LIMS Demonstration Include?
Do not ask only to see the audit-trail screen. Ask the vendor to demonstrate the workflow from beginning to end.
Have an analyst enter a result.
Change that result.
Review the history.
Return it for correction.
Approve it.
Inspect the signature manifestation.
Try to perform the approval with an unauthorized role.
Retrieve the completed record.
Show the relationship between the result and its sample.
Change a configured workflow in a test environment and examine the configuration control.
Ask how historical records remain available after software upgrades. The goal is to see whether the system supports controlled regulated work, not whether it contains a list of compliance-related features.
Does Using a Part 11-Capable LIMS Automatically Make a Laboratory Compliant?
No. A Part 11-capable LIMS can provide technical controls that support compliance, but compliance depends on the laboratory's intended use, predicate-rule obligations, configuration, validation, procedures, training, access governance, record-retention practices and ongoing system management.
This is one of the most important points in this entire article. A vendor can provide:
role-based access,
time-stamped histories,
electronic signatures,
record retrieval,
workflow controls,
and validation documentation support.
The laboratory determines:
which records are regulated,
who should have access,
which roles may approve,
how the workflow should operate,
how the system will be validated,
how audit trails will be reviewed,
how records will be retained,
how users will be trained,
and how changes will be controlled.
That division of responsibility should remain clear.
How LabZila Supports 21 CFR Part 11 Workflows
LabZila provides configurable controls intended to support laboratories using electronic records and electronic signatures in applicable regulated workflows. Role-based access can restrict activities according to authorized responsibilities.
Time-stamped record histories can preserve applicable changes, actions, reviews and approvals.
Electronic-signature workflows can associate approval activity with authorized users, signing time and signature meaning.
Review and approval routing can help move laboratory records through defined stages without replacing required human authorization.
Searchable records and histories can support controlled retrieval.
LabZila can also connect these controls with its wider laboratory QMS software, allowing regulated laboratory activities and quality events to remain related when deviations, investigations or CAPAs are required.
These technical capabilities can support a laboratory's Part 11 approach. They do not transfer regulatory responsibility from the laboratory to the software vendor.
Building a Practical Part 11 LIMS Strategy
A practical approach begins with scope. Identify the FDA predicate rules that apply to the laboratory and determine which electronic records and signatures fall within the intended Part 11 environment. Then document intended use.
Define what the LIMS must do and which functions affect regulated data.
Design roles and access around actual responsibilities.
Define review and signature stages.
Decide which record changes require traceable history.
Establish retention and retrieval requirements. Validate the configured system using a risk-based approach appropriate to the intended use and applicable requirements.
Create procedures for use, electronic signatures, audit trails, system administration, security, change control and record retention. Train users. Then maintain the validated and governed environment as the system changes over time.
This is substantially stronger than buying software first and attempting to build a compliance rationale afterward.
LabZila provides the technical framework for controlled electronic records, signatures and laboratory workflows. Laboratories evaluating their own requirements can contact LabZila to discuss how their sample, testing, review, quality and electronic-record processes could be configured within the platform.
Frequently Asked Questions
Which LIMS capabilities are important for laboratories working under 21 CFR Part 11?
Important capabilities include controlled user access, role and authority checks, secure time-stamped audit histories, electronic-signature controls, signature-to-record linking, record protection and retrieval, validation support, workflow controls, system-documentation control and traceable review and approval processes. The exact controls required depend on the laboratory's intended use, applicable predicate rules and the electronic records and signatures within scope.
What should laboratories look for in electronic signatures and audit trails for test-result signoff?
Electronic signatures should be attributable to a unique authorized individual and should identify the signer, signing date and time, and meaning of the signature, such as technical review or approval. The signature should remain securely linked to the signed record. Audit trails should preserve applicable changes without obscuring previous information and should identify relevant users, dates, times and record actions. Laboratories should test these functions using realistic result-entry, correction, review and approval scenarios.
Does using a Part 11-capable LIMS automatically make a laboratory compliant?
No. Software can provide technical controls that support Part 11 workflows, but the laboratory remains responsible for determining regulatory scope, satisfying applicable predicate rules, configuring and validating the system appropriately, controlling user access, establishing SOPs, training personnel, reviewing records and audit histories where required, protecting and retaining records, and managing system changes. A Part 11-capable LIMS is part of the compliance framework, not a substitute for it.