21 CFR Part 11 and training records: when it applies, what to check
Not every electronic training record is a Part 11 record. FDA's 2003 scope guidance draws a narrower line. Here is how to tell, what 11.10 asks of an LMS, and 12 vendor questions.
The short answer: 21 CFR Part 11 training records rules apply only when a predicate rule requires the record and you keep it electronically in place of paper, or rely on the electronic version to do regulated work. In scope, FDA still enforces access and authority controls and the electronic signature rules, and expects a documented, risk-based approach to validation and audit trails. Your firm, not the vendor, answers for it.
Where LMS Advisor fits, stated plainly: it is not marketed as Part 11 compliant, we do not sell a validation package, and it has no Part 11 electronic signature. Use LMS Advisor to deliver and test training that is not a predicate-rule record, or in a hybrid setup where it teaches and scores while your eQMS or signed paper holds the GxP record.
This guide is for QA, CSV and IT leads and training managers at drug, biotech, CDMO and device companies. The quotes come from FDA's Part 11 Scope and Application guidance (August 2003) and the regulation itself, which we read in September 2026. It is a decision aid, not legal advice.
Which training records are in scope for Part 11?
Part 11 does not create a duty to keep training records. It sets rules for electronic records and signatures that other regulations, the "predicate rules," already require. So the first question is always which rule requires this record.
Predicate rules that require training records
Some rules name the record outright. The dietary supplement CGMP rule, 21 CFR 111.14, requires documentation of training including "the date of the training, the type of training, and the person(s) trained." The GLP rule, 21 CFR 58.29(b), requires "a current summary of training and experience and job description" for each person on a nonclinical study. Drug CGMP in 211.25 requires the training and leaves the record implied, but in practice firms rely on training records to show they meet it, and most QA teams treat them as GMP records. Device makers must "maintain appropriate records of education, training, skills and experience" under ISO 13485 clause 6.2 (wording as quoted by Greenlight Guru, since the standard is paid), which the QMSR made enforceable in the US on February 2, 2026. Our QMSR training requirements guide covers that change.
Electronic in place of paper, or relied on
FDA's guidance defines Part 11 records narrowly. Two of its categories matter for an LMS:
- "Records that are required to be maintained under predicate rule requirements and that are maintained in electronic format in place of paper format."
- "Records that are required to be maintained under predicate rules, that are maintained in electronic format in addition to paper format, and that are relied on to perform regulated activities."
The guidance also says FDA "intends to interpret the scope of part 11 narrowly." Some vendor pages say every electronic training record falls under Part 11. That reads broader than FDA's own guidance.
Hybrid and printout approaches
The guidance gives a way out that many small firms use: "when persons use computers to generate paper printouts of electronic records, and those paper records meet all the requirements of the applicable predicate rules and persons rely on the paper records to perform their regulated activities, FDA would generally not consider persons to be 'using electronic records in lieu of paper records' under §§ 11.2(a) and 11.2(b)."
The guidance closes the obvious loophole too. If you print the record but still check the LMS screen to decide who may run a process, FDA says it "may consider you to be using the electronic record instead of the paper record." A hybrid only works if your SOP says which copy is the record and people actually use that copy.
What do the 11.10 controls mean for an LMS?
21 CFR 11.10 lists controls for closed systems. Here they are, translated into the questions a QA reviewer asks of a learning platform:
| Part 11 control | Citation | What to verify in the LMS |
|---|---|---|
| System validation | 11.10(a) | Your intended use, risk assessment and test evidence, plus what vendor documentation exists |
| Complete copies for FDA | 11.10(b) | Exports of training history in readable and electronic form |
| Record protection | 11.10(c) | Backups and retrieval for the full retention period |
| Limited access | 11.10(d) | SSO, two-factor authentication, prompt deprovisioning, role permissions |
| Audit trail | 11.10(e) | Which events are logged, whether prior values survive a change, how long logs are kept |
| Authority checks | 11.10(g) | Who can edit completions, grades or certificates |
| People qualified to run the system | 11.10(i) | Training records for your LMS admins |
| Signature manifestation | 11.50 | Printed name, date and time, and meaning on signed records |
| Unique signatures | 11.100, 11.200 | No shared accounts, two-component signing |
Validation
11.10(a) asks for "Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records." FDA's guidance recommends that "you base your approach on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity."
Human-readable and electronic copies
11.10(b) requires "The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency." Test this before an inspection. Export one operator's full history and check it shows course, version, date and result.
Access limits and authority checks
11.10(d) asks for "Limiting system access to authorized individuals," and 11.10(g) for authority checks on who can sign, alter a record or perform an operation. In an LMS, the risky permission is usually "edit completion," which some admins hold without anyone noticing. Our SCIM provisioning guide covers the deprovisioning side.
Audit trails that do not obscure changes
11.10(e) calls for "secure, computer-generated, time-stamped audit trails" of entries and actions that create, modify or delete records, and adds: "Record changes shall not obscure previously recorded information." Ask any vendor to show a changed grade in the log, with the old and new value side by side.
Training of people who run the system
11.10(i) requires a "Determination that persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks." Your LMS administrators need their own training records.
Do training records need an electronic signature?
Printed name, date, time and meaning (11.50)
Under 11.50, a signed electronic record must show the signer's printed name, the date and time the signature was executed, and its meaning, such as review, approval, responsibility or authorship.
Unique to one person, with two components (11.100 and 11.200)
11.100(a) requires each electronic signature to be unique to one individual. 11.200(a)(1) requires non-biometric signatures to use "at least two distinct identification components such as an identification code and password." Shared logins break both rules at once.
When a completion is not a signature
An LMS completion timestamp records that an event happened. It is not an electronic signature, because nobody executed it with a stated meaning. Whether a training record needs a signature is a decision in your own procedures. If your SOP says the trainee signs "I have read and understood revision 5," then the system holding that record needs Part 11 signature controls, or the signature goes on paper or in your eQMS. FDA's data integrity Q&A (2018) confirms that "electronic signatures with the appropriate controls can be used instead of handwritten signatures or initials in any CGMP required record," which means the controls, not the software label, are what count.
What does FDA still enforce, and where does it use discretion?
The 2003 guidance says FDA intends "to exercise enforcement discretion with regard to part 11 requirements for validation, audit trails, record retention, and record copying in the manner described in this guidance." Discretion is not a waiver. The guidance still recommends a documented risk-based approach for each, and "Persons must still comply with all applicable predicate rule requirements for validation."
FDA said it will keep enforcing the other controls: limiting access to authorized individuals, operational system checks, authority checks, device checks, the training determination in 11.10(i), written accountability policies, and the electronic signature "requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)."
How do you validate an LMS the risk-based way?
Intended use and risk assessment
Write down what the LMS does for you. "Delivers CGMP refresher content, records completions that we print and sign" is a very different intended use from "is our system of record for operator qualification." The second carries far more risk and needs far more testing.
Vendor documentation vs your own testing
Vendor validation packs save work, but they test the vendor's intended use, not yours. You still test your configuration: roles, assignments, the exports you rely on and the audit events you depend on.
CSA guidance and ISO 13485 4.1.6 for device makers
FDA's Computer Software Assurance guidance (September 2025) gives risk-based recommendations for software "used as part of medical device production or the quality system." ISO 13485 clause 4.1.6, enforceable under the QMSR, requires validation of QMS software, with an approach "proportionate to the risk associated with the use of the software," as quoted by Greenlight Guru. A device maker that keeps QMS training records in an LMS therefore needs to validate that use.
Change control for SaaS releases and self-hosted upgrades
A SaaS LMS changes when the vendor ships. Ask how releases are announced and whether you can test first. A self-hosted install lets your team choose when to upgrade and run it under your own change control, at the cost of owning the server.
What to ask any LMS vendor about Part 11
- Do you claim Part 11 compliance, and exactly which controls does that claim cover?
- Do you provide a validation package, and what intended use does it test?
- Can a training record carry an electronic signature with printed name, date and time, and meaning?
- How do signatures meet 11.200, for example re-entering a password at signing?
- Which events does the audit log record, and does it keep prior values?
- Can any role edit or delete a completion, and is that logged?
- How long are audit logs kept, and can we export them?
- Do you support SAML SSO, SCIM deprovisioning and enforced two-factor authentication?
- Can we export one person's full history in readable and electronic form?
- How are releases announced, and can we test before they reach production?
- Can we self-host to control upgrade timing?
- What happens to our records and logs if we leave?
More general platform questions are in our LMS RFP questions list.
Where LMS Advisor fits for Part 11 training records
LMS Advisor is our platform, so here is the honest version.
| Fits well | Does not fit |
|---|---|
| Training that is not a predicate-rule record: onboarding, soft skills, safety refreshers, product training | Being the system of record for e-signed read-and-understand records |
| Hybrid setups: teach and test in LMS Advisor, sign the record in your eQMS or on paper | Buyers who need a vendor validation package or a "Part 11 compliant" claim |
| Access controls: SAML SSO, SCIM deprovisioning, two-factor authentication, passkeys, roles and permissions | Automatic retraining when document control revises an SOP |
| Evidence and copies: audit logs, CSV, Excel or PDF exports, webhooks and REST API to the eQMS | Anyone who has not assessed the audit log against 11.10(e) for their use |
| Upgrade timing under your change control when you self-host | Teams wanting a ready-made GMP course library |
If you plan to rely on LMS Advisor for any record a predicate rule requires, your QA team must assess and validate that use, and should check in a demo exactly what the audit log records. Our security and data ownership page lists the access controls, the GxP training software guide shows the two-system architecture, and the pharmaceutical LMS page covers the rest. For a walk-through against your own risk assessment, book a demo.
Frequently asked questions
Does 21 CFR Part 11 apply to training records?
Only to some. It applies when a predicate rule requires the training record and you keep it electronically in place of paper, or rely on the electronic copy to do regulated work. Training records that no predicate rule requires are outside Part 11.
Is a course completion an electronic signature?
No. A completion timestamp records an event, and a Part 11 signature must show the signer's printed name, date and time, and meaning. If your SOP requires a signed training record, you need signature controls somewhere.
Can we keep signed paper records and use an LMS for delivery?
Yes. FDA's 2003 guidance says that if printouts meet the predicate rule and you rely on the paper, FDA would generally not consider you to be using electronic records in lieu of paper. Your SOP must name the paper as the record, and people must actually use it.
Does the vendor or the company have to validate the LMS?
The company does. Vendor documentation helps, but FDA expects you to validate your intended use based on a documented risk assessment, and device makers must validate QMS software under ISO 13485 clause 4.1.6.
Is LMS Advisor Part 11 compliant?
No, LMS Advisor is not marketed as Part 11 compliant, is not sold with a validation package and has no Part 11 electronic signature. It fits training outside predicate rules and hybrid setups where the signed record lives in your eQMS or on paper. Our GMP training requirements guide shows how that split works on the floor.
Add lmsadvisor.com as a preferred source on Google, or open this article in your AI assistant to use it as a source.
I'm Swati Priyadarshani, Founder & CEO of LMS Advisor and Co-Founder of WorldWin Coder Pvt. Ltd. (est. 2019). Over the last 10+ years, I've helped enterprises build learning platforms that actually get used - not just deployed.
