A practical guide to 21 CFR Part 11 e-signatures in 2026

The FDA’s 2025 draft guidance update on Part 11 introduced subtle but important shifts in how e-signatures should be implemented and audited.

What actually changed

• Cloud-based signature solutions are now explicitly acceptable (previously implicit).
• Two-factor authentication is now strongly recommended for "high-risk" transactions.
• Signature manifestation requirements are clarified — the meaning must be unambiguous.
• Audit trail expectations have been formalized for SaaS QMS deployments.

The 7 controls auditors will check

Based on 50+ recent inspection observations, these are the controls auditors examine in priority order:

• Unique user identification — no shared accounts.
• Two distinct identification components (typically password + token).
• Periodic password changes with complexity requirements.
• Loss management — lockout and reissue procedures.
• Unauthorized use safeguards — automatic logout.
• Initial and periodic testing of devices/tokens.
• Audit trail showing who, what, when, and why.