The Role of FDA Predicate Rules in 21 CFR Part 11 Compliance

In an era where digitization has become so central to our everyday lives, it’s hard for some to believe that there was a time digitized records were considered less trustworthy than paper documents. It was only 25 years ago that the 21 CFR Part 11 regulation established that electronic records and signatures maintained for regulatory purposes are as valid as paper records and handwritten signatures. By permitting the use of electronic record-keeping systems for maintaining records and submitting information to regulators, 21 CFR Part 11 builds upon the previously established regulatory requirements that applied to paper-based systems, also known as U.S. Food and Drug Administration (FDA) predicate rules.

What Are FDA Predicate Rules?

An FDA Predicate rule is any established U.S. regulation that requires a company to maintain certain records and submit specific information to the agency as part of regulatory compliance. FDA Predicate rules are those that applied to recordkeeping and paper records with handwritten signatures prior to the establishment 21 CFR Part 11 in 1997. They are the foundational guidelines for regulating processes, records, and signatures, however they are maintained. Specifically, the FDA Predicate rules include any requirements set forth in:

• The Federal Food, Drug, and Cosmetic Act.
• The Public Health Service Act.
• Any FDA “GxP” best practice guidelines, i.e., good manufacturing practices (GMP), good laboratory practices (GLP), good clinical practices (GCP), etc.

Examples of the types of mandates stated in FDA predicate rules include:

• The types of records that must be maintained.
• The content of records.
• Whether signatures are required.
• How long records must be maintained.⁽¹⁾

The Relationship Between 21 CFR Part 11 and Predicate Rules

21 CFR Part 11 requirements are an extension of the FDA predicate rules for records and signatures that must be met by companies using digital systems to manage compliance-related processes and documentation. They do not replace or supersede other existing FDA regulations pertaining to signatures and records. Guidances issued by the FDA in the future may potentially augment or alter the focus of specific facets of 21 CFR Part 11>. One constant will always remain, however: agency-recommended approaches will never deviate from the core guidelines established in FDA predicate rules.

Compliance with 21 CFR Part 11 > is dependent on your understanding of the specific FDA predicate rules that apply to your company. Those predicate rules will determine the corresponding 21 CFR Part 11 controls that are pertinent to your regulated products.

It’s helpful to examine the relationships between 21 CFR Part 11 and various FDA predicate rules and their impact on the GxP environments in specific industries.

Life Sciences: FDA Predicate Rules in GxP

An FDA predicate rule’s applicability depends on the kind of regulated product(s) a company manufactures and the types of records that must be maintained in support of the regulatory compliance for those products. For example:

21 CFR Part 211 is an FDA predicate rule that outlines the GMP forfinished pharmaceuticals. Section 211.180(b) of the regulation stipulates that “(r)ecords shall be maintained for all components, drug product containers, closures, and labeling for at least one year after the expiration date or, in the case of certain OTC (over-the-counter) drug products lacking expiration dating because they meet the criteria for exemption under §211.137, three years after distribution of the last lot of drug product incorporating the component or using the container, closure, or labeling.”⁽²⁾

Per GMP requirements, 21 CFR Part 11 is applicable if your company maintains such records electronically. The regulation also requires that the computer system used to control those records must be validated according to FDA 21 CFR Part 11 requirements.

21 CFR 820 outlines the quality system regulation (QSR) mandates for device companies. The requisite FDA predicate rules for document control are set forth in Section 820.40(b), which stipulates that “(c)hanges to documents shall be reviewed and approved by individual(s) in the same function or organization that approved the original review and approval. Each manufacturer shall maintain records of changes to documents. Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective.”⁽³⁾

If you use a digitized system for change control and document control as described by the GMP rule above, Part 11 applies to those records and the system must be validated.

Some examples of other types of records required by FDA predicate rules that are still enforced under 21 CFR Part 11 are provided in the following list. The corresponding GxP classification those records fall under and the FDA predicate rule reference for each are also cited.

Aligning With Both FDA Predicate Rules and 21 CFR Part 11

Understanding the relevant FDA predicate rules of record retention and submission as they pertain to the GMP, GLP, GCP, or other requirements applicable to your organization is central to compliance with 21 CFR Part 11. Any digitized quality management system (QMS) or other solution your company uses to manage electronic records should be designed to facilitate compliance with both regulatory requirements for electronic recordkeeping and FDA predicate rules.

References:

1. “21 CFR Part 11: Rules for Complying With the Rules,” Marilyn Marshall, Mar. 30, 2006.
2. “Code of Federal Regulations, Title 21, Vol. 4, Part 211, Subpart J, Sec. 211.180 General requirements,” Food and Drug Administration Department of Health and Human Services, current as of Mar. 29, 2022.
3. “Code of Federal Regulations, Title 21, Vol. 8, Part 820, Subpart D, Sec. 820.40 Document controls,” Food and Drug Administration Department of Health and Human Services, current as of Mar. 29, 2022.
4. “Assuring Data Integrity and Data Privacy Compliance when using Software-as-a-Service (SaaS) in the LIfe Science Sector,” by Eliane Veiga and Nuala Calnan, IVT Network, Dec. 18, 2018.