21 CFR Part 11 & EU Annex 11 Compliance

Regulatory Framework Scope

The platform is designed from the ground up to satisfy the rigorous requirements of:

• United States FDA 21 CFR Part 11: Electronic Records; Electronic Signatures.
• European Union EudraLex Volume 4, Annex 11: Computerised Systems.
• ALCOA+ Data Integrity Principles: Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available.

Clause-by-Clause Technical Implementation

1. Electronic Audit Trails (§ 11.10(e) & Annex 11 Clause 9)

• Requirement: Secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records.
• Implementation:
  • The PostgreSQL audit_trail table records every system event: timestamp, user_id, user_role, action, entity_name, entity_id, old_values, new_values, and reason_for_change.
  • Database trigger prevent_audit_trail_tampering() intercepts any SQL UPDATE or DELETE commands and raises an immediate fatal SQL exception.
  • Audit trail records are preserved through database backups and continuous WAL streaming.

2. Electronic Signatures (Subpart C, § 11.50, § 11.70 & Annex 11 Clause 14)

• Requirement: Electronic signatures must contain the printed name of the signer, the date and time when signed, and the meaning associated with the signature. Signatures must be linked to their respective electronic records to ensure they cannot be excised, copied, or transferred.
• Implementation:
  • When an electronic record (such as a Validation Summary Report or CAB Change Control) is signed, the system serializes the target record into canonical JSON.
  • A cryptographic SHA-256 hash is computed over the canonical record and combined with the signer’s identity, role, timestamp, and signature meaning (APPROVAL, REVIEW, AUTHORSHIP).
  • The resulting manifest is stored in electronic_signatures and linked by foreign key to the entity.
  • Any alteration of the signed record immediately invalidates the cryptographic hash comparison performed by /api/qms/verify-manifest.

3. Record Protection & Operational Checks (§ 11.10(b), (c), (f))

• Protection: Multi-tier backup architecture governed under SOP-IT-018 and SOP-IT-019 ensures data durability, rapid recovery, and periodic dry-run verification.
• Operational System Checks: EvidenceGate enforces pre-flight verification, ensuring operators and AI agents cannot base decisions on superseded, draft, or invalidated documents.
• Authority Checks: Role-Based Access Control (RBAC) segregates operational permissions, preventing unauthorized operators from initiating or approving regulated change controls.