"Part 11 lab data" means laboratory records and electronic signatures that fall under 21 CFR Part 11 because they support an FDA-regulated activity. That could be a trial result headed into a submission or a record your organization must keep under another FDA rule. Part 11 is not a test standard and it is not a badge a lab earns once. It governs whether specific electronic records and signatures can be trusted as much as paper. This guide shows which of your lab records qualify, what controls FDA expects, and what to ask a laboratory partner before you send it regulated work.
TL;DR
- Part 11 applies to specific electronic records and signatures tied to FDA requirements, not to a laboratory or software product as a whole. "Part 11 compliant lab" is a claim to test, not accept.
- Core controls: validation, access limits, secure time-stamped audit trails, signature manifestation, and retrievable copies for the whole retention period.
- For trials, the focus is the full data lifecycle, from specimen collection to retention, and outsourcing a function does not outsource accountability.
- Ask a lab for its data flow, audit-trail evidence, change control, and inspection access in writing, not only a validation certificate.
What "Part 11 lab data" actually covers
FDA's scope and application guidance, issued August 24, 2018, describes how the agency interprets Part 11. The regulation sets the criteria under which FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records trustworthy and reliable. Whether a given record is in scope depends on the rule behind it, called the predicate rule. If an FDA requirement says a record must exist or be submitted, and you keep it electronically, Part 11 attaches to that record.
In a laboratory, that usually includes:
- Instrument output and raw data files that serve as source data for a regulated study
- Results entered, edited, or released in a laboratory information system (LIS)
- Reviewer and approver sign-offs on results or reports
- Corrections, reruns, and result amendments, with their reasons
- Data transferred to a sponsor, CRO, or EDC system
- The audit trail and metadata that explain all of the above
A routine diagnostic result for a patient visit in a primary care office is generally governed by other rules (CLIA, HIPAA, state law). It becomes Part 11 relevant when it also serves as evidence in an FDA-regulated activity, such as a clinical investigation. That is why a lab can run a perfectly sound clinical operation and still need extra controls around the subset of records that support a trial.
The practical consequence: do not ask "is this lab Part 11 compliant?" Ask "which of our records are regulated, which systems touch them, and can this lab show the controls working on those records?"
What 21 CFR 11.10 requires of a closed system
Most laboratory systems are closed systems, meaning the people responsible for the records control who gets access. Section 11.10 lists the controls, and they translate cleanly into lab terms.
| Requirement | What it looks like in a lab |
|---|---|
| Validation | Documented evidence the LIS, instrument interfaces, and portal do what you need, for your intended use |
| Accurate copies | Human-readable and electronic copies of results that an inspector can review |
| Record protection and retrieval | Backup, restoration, and archiving that work through the retention period |
| Limited access | Unique user IDs, role-based permissions, no shared logins |
| Audit trails | Secure, computer-generated, time-stamped entries that record changes without obscuring prior values |
| Operational checks | Enforced sequences, such as no result release before required review |
| Authority checks | Only authorized people can sign, edit, or release |
| Qualified personnel | Documented training for the people using the system |
| Accountability | Policies that hold people responsible for actions under their signature |
| Documentation controls | Controlled, versioned procedures and system documentation |
The audit trail is where labs most often fall short. Under 11.10(e), a change must not hide the original entry. For a lab result, that means you can see the first value, the new value, who changed it, when, and why. Our own explainers on proving the reason for change in lab data audit trails and on what inspectors look for in audit trail compliance go deeper on this one control.
Electronic signatures on lab records
When a scientist reviews a result or a director approves a report electronically, the signature has to be linked to that exact record. Under 11.50, the signed record shows the signer's printed name, the date and time of signing, and the meaning of the signature, such as review, approval, responsibility, or authorship. The rules for identification codes and passwords in 11.300 require controls that keep each code unique and secure. All of this is set out in the Part 11 text on eCFR.
A useful test during a vendor audit: pick one released result and ask the lab to show, on screen, who signed it, when, what the signature meant, and whether the record changed afterward. If the answer takes days, the controls are probably not built into the workflow.
What FDA's enforcement discretion does and does not mean
Part 11 remains in effect. The 2018 guidance does say FDA intends to exercise enforcement discretion for certain provisions on validation, audit trails, record retention, and record copying, as the guidance describes. Two cautions follow.
First, this does not remove the underlying predicate-rule obligations. If another FDA rule requires a record and its integrity, you still need to meet that. Second, policy can change, so check the current FDA position before relying on it. Treat enforcement discretion as context for your risk assessment, not as a reason to skip documentation. For a closer look at how these pieces fit together, see our overview of 21 CFR Part 11 compliance for FDA-regulated teams.
Clinical trials: the whole data lifecycle
For trials, FDA's guidance on computerized systems used in clinical trials expects documentation that identifies where systems create, modify, maintain, archive, retrieve, or transmit data. Source documents must allow the trial to be reconstructed. Electronic changes must preserve the original, identify the change, and give a way to read the prior value. Audit trails should record who made a change, when, and why, and be kept at least as long as the associated electronic records.
Two more recent documents shape current thinking:
- FDA's final guidance on electronic systems, records, and signatures in clinical investigations was published in the Federal Register on October 2, 2024. It covers applicability of Part 11 to real-world data and describes electronic systems used in investigations. The question-and-answer text itself is available from FDA and addresses risk-based validation, service providers, and electronic signatures.
- ICH E6(R3), the Good Clinical Practice guideline finalized January 6, 2025, organizes expectations around data capture, metadata and audit trails, corrections, transfer and migration, dataset finalization, retention, access, security, validation, and user management.
The shift is from protecting a final database snapshot to governing every step. When specimens move by courier, results come off an analyzer, an LIS releases them, a portal displays them, and a sponsor system receives them, each handoff is a place where traceability can break.
Why the final result alone is not enough
A common failure is keeping only the last reported value. Regulated lab data needs the attributable source data, the metadata, any prior values, the reason for each change, and a readable audit trail. A spreadsheet with corrected numbers and no history will not satisfy an inspector, however accurate the numbers are.
Outsourcing a lab does not outsource accountability
FDA's 2024 clinical-investigation guidance recognizes that technology and service providers may perform important trial functions. Sponsors, investigators, and CROs still need clear agreements, oversight, inspection access, and evidence that the provider's systems protect participant safety and data reliability. The Federal Register notice linked above is the place to read that framing.
If your team also handles research-use-only materials alongside regulated work, it helps to understand how FDA treats that category differently from approved products. This short read on FDA signals around research-use-only materials is a useful companion when you draft quality agreements that say precisely what is and is not in scope.
What belongs in a quality or technical agreement
- Which systems and interfaces handle regulated records, and who owns the source documents
- Backup, recovery, and incident handling responsibilities
- Change control: how the lab notifies you before it alters validated systems
- Inspection access for you and for FDA
- Retention periods and retrieval timelines
- Data transfer formats, migration procedures, and reconciliation checks
- Training records for personnel who touch your data
Our piece on the role of a central lab in pharma sponsor oversight covers how sponsors keep visibility when a central lab runs the testing.
A readiness workflow you can run with any lab
The sources do not prescribe one universal timeline or price, so treat this as a sequence, not a schedule. It synthesizes the controls in 11.10, FDA's clinical-trial computerized-systems guidance, and ICH E6(R3).
- Inventory regulated records. List every lab record that supports an FDA requirement, and name the predicate rule behind each.
- Map the specimen-to-result data flow. Include collection, labeling, transport, accessioning, analysis, review, release, transfer, and archive.
- Classify source data and metadata. Decide what is original, what is derived, and what context must be kept.
- Document a risk assessment. Focus effort where an error would affect participant safety or result reliability.
- Validate intended use and interfaces. Test the system as you will use it, including instrument and sponsor connections.
- Configure controls. Role-based access, signatures, audit trails, and sequence checks.
- Train users and keep the records.
- Test failure handling. Backup, restoration, transfers, and what happens when a connection drops.
- Approve procedures and keep them under change control.
- Review periodically. Revalidate after significant changes and recheck the risk assessment.
Our guide on building audit trail requirements from day one shows how to bake step 6 into a project instead of retrofitting it.
Questions to ask a laboratory partner
A validation certificate is a starting point. These questions test whether the controls work in daily operation.
- Which of my records will live in your systems, and where do they go next?
- Can you show the audit trail for one amended result, including the reason for change?
- How do you control user access, and how fast are departed staff removed?
- What is your backup and restoration test history?
- How do you notify clients about changes to validated systems?
- What does inspection access look like for a sponsor or for FDA?
- How are results delivered electronically, and how is delivery logged?
- Who is my named contact when something goes wrong?
A lab that answers in specifics, with documents attached, is easier to oversee than one that points to a general compliance statement.
Where this matters by type of organization
CROs and sponsors. You carry accountability for data supporting a submission. Prioritize data flow maps, quality agreements, and transfer reconciliation.
Research sites. Your specimen collection and shipment records are part of the chain. Labeling, timestamps, and courier handoffs need to be attributable.
Practices and clinics joining a study. Your own EHR results may become source data. Confirm with the sponsor which records are regulated before the first participant is enrolled.
Practices outside trials. Part 11 will rarely be your main concern. Interface reliability, result delivery speed, and clear amendment history still matter for patient care.
Our perspective at KoHealth Labs
We see the same mistake from sponsors and practices alike: treating compliance as a label on a vendor instead of a property of a workflow. A laboratory can have modern software and still leave gaps at the handoffs, such as a result corrected by phone, a courier log kept on paper, or a portal export with no history behind it.
Our approach starts from the workflow. We support electronic results reporting, LIS and EMR integration, a provider portal, courier specimen pickup, mobile phlebotomy, and dedicated onboarding and training, so the specimen-to-result path can be mapped and discussed with a client in one conversation rather than across several vendors. For clinical research, we offer a collaborative laboratory partnership focused on supporting study protocols, simplifying specimen logistics, and delivering reliable laboratory data.
Our advice is plain: write down which records are regulated, ask every partner to demonstrate the controls on a real record, and put responsibilities in the agreement. Direct communication with the people running your testing makes each of those steps faster.
— Kohealth Labs
Working with KoHealth Labs
If you run a study, we can walk your team through how specimens, results, and data delivery would work for your protocol. See our clinical trials and research laboratory services and how onboarding works. Practices that want a primary or supplemental laboratory can start at our physician solutions page.
FAQ
Is there such a thing as a Part 11 compliant lab?
Not as a blanket status. FDA frames Part 11 around specific electronic records and signatures tied to FDA requirements. A lab can show that its controls work for particular records and workflows, and you should ask it to demonstrate that.
Does Part 11 apply to every lab result?
No. It applies to electronic records that are required by FDA rules or submitted to FDA. A routine patient result is usually governed by other rules, but it can become Part 11 relevant if it serves as evidence in a regulated clinical investigation.
What must an electronic signature on a lab record show?
Under 21 CFR 11.50, the signed record shows the signer's printed name, the date and time of signing, and the meaning of the signature, such as review or approval. The signature must also be linked to its record so it cannot be moved to another.
What should an audit trail capture for lab data?
It should be secure, computer-generated, and time-stamped, and it should record who changed a record, when, and why, while keeping the original value readable. FDA's clinical-trial guidance says audit trails should be kept at least as long as the associated records.
If a lab handles our data, are we still responsible?
Yes. FDA's 2024 clinical-investigation guidance recognizes that providers can perform trial functions, but sponsors, investigators, and CROs keep accountability. Use written agreements, oversight, and inspection access to show you retained control.
Sources
- FDA: Part 11 Scope and Application guidance (August 24, 2018)
- eCFR: 21 CFR Part 11
- eCFR: 21 CFR 11.10, Controls for closed systems
- FDA: Computerized Systems Used in Clinical Trials
- Federal Register, October 2, 2024: Electronic Systems, Records, and Signatures in Clinical Investigations
- FDA: Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations, Questions and Answers
- ICH E6(R3) Good Clinical Practice, Step 4 final guideline (January 6, 2025)
For more information about our diagnostic testing, clinical research laboratory services, or partnership opportunities, visit https://kohealthlabs.com or contact KoHealth Labs at (469) 792-8439 and ask for Amy Patterson.