FDA 21CFR Part 11 governs electronic records and electronic signatures. A press side automation system creates a variety of regulated records, such as inspection results, test data, operator actions or electronic approvals.

21CFR Part 11 compliance involves the records and the computerized system that creates or manages them. To maintain compliance, your processes must satisfy FDA recordkeeping requirements. The current regulation in the eCFR system establishes specific criteria for electronic records and signatures to be considered trustworthy and equivalent to paper records or handwritten signatures.

Jerit Automation has incorporated Part 11-related controls into several custom systems, including automation cells for the highly regulated pharmaceutical and medical-component manufacturing industry. In our experience, it’s best to keep the six pointers below at the forefront of your mind as you specify new press side automation.

1. DEFINE WHICH RECORDS FALL UNDER 21CFR PART 11

Identify the electronic records required under the applicable FDA predicate rules and decide which records the manufacturer will rely on for regulated activities.

FDA scope and application guidance recommends that you document the decision in an SOP or system specification. Part 11 applies to specific electronic records — not every value that happens to reside in a PLC, HMI or database.

For press side automation, relevant records could include dimensional inspection results, process parameters or test outcomes.

2. ASSIGN ACCESS ACCORDING TO USER ROLES

Section 11.10 requires closed systems and authority checks as safety controls, to limit access only to authorized individuals who are allowed to operate the system or change records.

Operator permissions may therefore differ from engineering or administrator permissions. Individual accounts also preserve traceability between a system action and the person responsible for it.

3. KEEP A TIME-STAMPED AUDIT TRAIL

Part 11 calls for secure, computer-generated audit trails with records of the date and time of any actions that create, modify or delete electronic records. Changes must also preserve previously recorded information. For an automated cell, that can include:

• Recipe edits
• Overrides
• Parameter changes
• Inspection dispositions

FDA guidance recommends that you base audit-trail controls on predicate-rule requirements plus a documented assessment of product quality, safety and record integrity.

4. VALIDATE ANY FUNCTIONS THAT AFFECT REGULATED RECORDS

Section 11.10 addresses system validation for accuracy and intended performance. Your ability to detect invalid or altered records will be key, here. The FDA recommends you take a risk-based approach and consider the system's effect on product quality as well as record integrity.

Keep in mind the type of system or process you’re working with. A dimensional inspection result will not have the same regulatory impact as a simple production counter in a press side system, so make sure your validation plan reflects any of these sorts of specific differences.

5. CAREFULLY CONFIGURE ELECTRONIC SIGNATURES

Signed electronic records must identify the signer and record the date and time of signing. Don’t forget to state the meaning of the signature (such as approval or review).

21CFR Part 11 compliance also requires that each electronic signature is unique to one person. For non-biometric signatures, the regulation calls for at least two identification components (e.g. an ID and a password).

6. PLAN RECORD RETRIEVAL & DATA COLLECTION

You’re only halfway there once you’ve initially collected production data. Section 11.10 requires that you preserve accurate and complete record copies suitable for FDA inspection. All records must remain retrievable through their required retention period.

According to FDA guidance, it’s best to provide records in common portable formats that will preserve their content and meaning (e.g. PDF, XML, or SGML).

Regulated manufacturers should consider 21CFR Part 11 compliance within the full context of automation specification, inspection requirements, and controls architecture. Jerit Automation is ready to work with our customer engineering teams to incorporate all required access controls as well as data collection and electronic-record functionality in custom press side automation systems.