The Most Important Compliance Best Practices You Need to Know

21 CFR Part 11 specifies requirements for handling electronic records and electronic signatures and applies to any records covered by FDA regulations that exist in an electronic form. The main objective behind implementing this regulation was to prevent fraud while facilitating, promoting the possible use of electronic technology to reduce expenditures incurred from paper sources.This white paper provides an overview of FDA requirements for electronic systems and the applicability of 21 CFR Part 11. It also details consequences for non-compliance and six key aspects FDA regulated firms should focus on so as to ensure compliance.

This guidance describes how certain provisions of the medical device Quality System regulation apply to software and the agency’s current approach to evaluating a software validation system.  For example, this document lists elements that are acceptable to the FDA for the validation of software; however, it does not list all of the activities and tasks that must, in all instances, be used to comply with the law.

The scope of this guidance is somewhat broader than the scope of validation in the strictest definition of that term.  Planning, verification, testing, traceability, configuration management, and many other aspects of good software engineering discussed in this guidance are important activities that together help to support a final conclusion that software is validated.

This guidance recommends an integration of software life cycle management and risk management activities.  Based on the intended use and the safety risk associated with the software to be developed, the software developer should determine the specific approach, the combination of techniques to be used, and the level of effort to be applied.   While this guidance does not recommend any specific life cycle model or any specific technique or method, it does recommend that software validation and verification activities be conducted throughout the entire software life cycle.Where the software is developed by someone other than the device manufacturer (e.g., off-the-shelf software) the software developer may not be directly responsible for compliance with FDA regulations.

In that case, the party with regulatory responsibility (i.e., the device manufacturer) needs to assess the adequacy of the off-the-shelf software developer’s activities and determine what additional efforts are needed to establish that the software is validated for the device manufacturer’s intended use.

This guidance applies to:

• Software used as a component, part, or accessory of a medical device;
• Software that is itself a medical device (e.g., blood establishment software);
• Software used in the production of a device (e.g., programmable logic controllers in manufacturing equipment); and
• Software used in implementation of the device manufacturer's quality system (e.g., software that records and maintains the device history record).

Various sections of this Guidance:

• CONTEXT FOR SOFTWARE VALIDATION
• PRINCIPLES OF SOFTWARE VALIDATION
• ACTIVITIES AND TASKS
• VALIDATION OF AUTOMATED PROCESS EQUIPMENT AND QUALITY SYSTEM SOFTWARE