Guide, published
21 CFR Part 11 for research sites: what the software does and what you own
A practical separation of electronic-record controls, investigator responsibilities and the evidence your site needs to review.
In this guide
Start with the records and intended use
21 CFR Part 11 addresses certain electronic records and signatures used under FDA requirements. Scope is not determined by calling a system an eSource product or by displaying a signature field. Begin by identifying the records you create, maintain, submit and retain, then establish which requirements apply to their intended use. Include source records, essential documents and signature evidence in that inventory. A site and sponsor may have different responsibilities for records in their respective systems.
FDA’s October 2024 electronic systems guidance provides recommendations for clinical investigations. Guidance is not identical to binding regulation. Read it alongside the applicable predicate rules and your protocol, rather than selecting a single paragraph that seems to endorse a product. Keep a documented intended-use description and identify the people responsible for system review, configuration, training and acceptance. This review should happen before sensitive study work is entered, not after a monitor asks for evidence.
Audit trails must explain the record
Section 11.10(e) describes secure, computer-generated, time-stamped audit trails for actions that create, modify or delete covered electronic records. Changes should not obscure previous information. A list saying someone opened a page is not the same as a traceable change history. Ask whether the record shows the responsible user, date/time, original value, changed value and the reason required by your procedure. Confirm how authorized reviewers obtain the history in a readable form.
Kyros Trials uses reasoned change and void workflows for regulated records. Voiding preserves the record rather than deleting it, and changes retain before/after context. Your site still needs a procedure for reviewing audit trails, handling unexplained changes and retaining the evidence. Do not treat the existence of a log as proof that it is reviewed. During a demo, enter a sample value, correct it through the intended workflow and inspect both the record and the history.
A signature is more than a drawn mark
Sections 11.50 and 11.70 address the manifestation and linkage of electronic signatures. Review the signer’s name, signing date/time and meaning, and confirm that the signature remains tied to the record. A decorative signature image does not establish those controls. The human-readable version should make the signing event understandable to a reviewer without relying on an oral explanation from the person who implemented the form.
Kyros Trials signatures use re-authentication and a server-verified process rather than allowing the browser to assert password verification. Organization signer two-factor settings can also apply. These controls do not replace identity establishment, individual credentials, training or a defined signing responsibility. Ask what happens when the record later needs correction: the signature, lock and unlock workflow depends on the record type. Do not assume every signed record behaves identically or can never be changed.
Credential controls remain a site responsibility
Section 11.200 addresses electronic-signature components and controls; it is not simply a universal instruction to require the same extra factor at every click. Review individual account management, identity, password handling, access periods and misuse prevention under the applicable rules. A shared login prevents a reliable relationship between a person and their action. Staff should know how to protect credentials and report suspected account compromise.
The site controls onboarding and offboarding as well as assignment of appropriate duties. A coordinator, investigator and outside monitor need different access. Review named accounts, study scope and access expiry before inviting a reviewer. The menu is a convenience, not authorization. Kyros Trials uses database authorization and effective organization roles; your procedures still determine who should receive a role and how that decision is reviewed over time.
System review is not a vendor badge
An intended-use assessment should identify critical records, configuration, interfaces and the evidence needed to show the system supports your process. ICH E6(R3) emphasizes fit-for-purpose computerized systems, investigator oversight and data governance. Review source designation, data originators, edit checks, corrections, exports and retention together. A form that looks correct on screen may still require configuration checks and documented staff acceptance before it is used in the study.
Kyros Trials supports Part 11 controls; no standalone product label establishes your site’s compliance. Compliance depends on how each site validates and uses the system. Request current system documentation and record the gaps your organization must resolve. Define responsibilities between site, sponsor and service provider rather than assuming the software team owns every operational decision. Keep the review proportionate and specific, with test evidence that addresses the actual configured workflow.
Retention and export need a practical check
Review what the site can export, in which formats and how signatures and audits remain readable. A spreadsheet of current values does not necessarily preserve prior events. Retention periods come from the applicable research requirements and agreements, not a universal number copied from a pricing page. Plan access after a subscription ends and retain original records from systems you replace. Include documents and file storage in the review, not just database rows.
Use the Part 11 statement, security overview and eSource page as starting points for questions. Inspect one sample correction, one signing event and an export before deciding that your intended use is supported. Record who approves the setup, how staff will be trained and when the next review occurs. This guide is educational; a site’s regulatory conclusion requires its own assessment of the study, records, procedures and evidence.
A sample site acceptance review
Choose a representative test record rather than an empty screen. The coordinator enters a value, an authorized reviewer asks a field query and the investigator signs with the intended meaning. Record the expected access and evidence before performing each step. Then inspect the signature manifestation, query response and correction history. A successful click is not the whole test: the next reviewer must be able to read back the result and understand the responsible action.
Retain the test inputs, expected results, observed results and unresolved issues under your site’s review process. Use sample identifiers and no real participant data. Where a check fails, document the impact and the decision before adopting the configured workflow. This acceptance exercise is an example of review evidence, not a universal validation package or a regulatory determination. Ask your organization who approves it and when a material configuration change requires another review.