[1] 21 CFR, Part 11 applies to drug makers, medical device manufacturers, biotech companies, biologics developers, CROs, and other FDA-regulated industries, with some specific exceptions.
Broad sections of the regulation have been challenged as "very expensive and for some applications almost impractical",[4] and the FDA has stated in guidance that it will exercise enforcement discretion on many parts of the rule.
If a regulated firm keeps "hard copies" of all required records, those paper documents can be considered the authoritative document for regulatory purposes, and the computer system is not in scope for electronic records requirements—though systems that control processes subject to predicate rules still require validation.
[6] Various keynote speeches by FDA insiders early in the 21st century (in addition to high-profile audit findings focusing on computer system compliance) resulted in many companies scrambling to mount a defense against rule enforcement that they were procedurally and technologically unprepared for.
Many software and instrumentation vendors released Part 11 "compliant" updates that were either incomplete or insufficient to fully comply with the rule.
Complaints about the wasting of critical resources, non-value added aspects, in addition to confusion within the drug, medical device, biotech/biologic and other industries about the true scope and enforcement aspects of Part 11 resulted in the FDA release of: This document was intended to clarify how Part 11 should be implemented and would be enforced.