Part 11 governs the copy, not the duty.

Twenty-one CFR Part 11 gets treated, in a lot of quality systems, as the device industry’s general law of electronic recordkeeping — the rule that decides whether any system storing a company’s records is validated enough to trust. That reading survives almost no contact with the regulation’s own scope section, and FDA said so in writing more than two decades ago.

What Part 11 actually conditions

21 CFR 11.1 ties Part 11’s reach to a single test: a record is in scope only when some other FDA requirement — a “predicate rule,” in the guidance’s own term — already obligates the company to create, maintain, or submit it, and the company chooses to keep that record electronically instead of on paper. Part 11 does not create a recordkeeping duty for anything. It sets the conditions under which an electronic version of a duty that already existed counts as the genuine article — validated, attributable, and as trustworthy as the paper it replaces.

What 2003 narrowed, and what it didn’t touch

FDA’s 2003 guidance, Part 11, Electronic Records; Electronic Signatures — Scope and Application, read its own regulation as reaching further than the agency intended and said it would exercise enforcement discretion on four fronts: validation, audit trails, record retention and copying, and systems already running before Part 11’s 1997 effective date. None of that discretion reaches the predicate rule itself. A record a device regulation already requires still has to exist, still has to say what that regulation says it has to say, and still has to be kept for as long as that regulation says — Part 11’s narrower reading changes how FDA evaluates the electronic record’s trustworthiness, not whether the underlying record was ever optional.

Part 11 decides whether an electronic record counts as the real one. It was never the regulation that decided a record had to exist in the first place.

Two predicate rules that never asked Part 11’s permission

21 CFR 803.18 requires every manufacturer and importer to establish and maintain an MDR event file for each reportable malfunction, injury, or death — identifiable, retrievable, and kept for at least two years past the event or the device’s expected life, whichever is longer, with the duty surviving even after the device stops shipping. 21 CFR 806.20 requires a comparable file for every correction or removal a firm decided didn’t need to be reported to FDA, carried forward to whoever manufactures or imports the device next. Neither section mentions Part 11, because neither one needed to. The obligation to build and keep that file exists on paper rules alone; Part 11 only shows up afterward, and only if the file is kept electronically.

Not the same door as eSTAR

A separate provision, now 21 U.S.C. § 379k-1 — added by the Food and Drug Administration Safety and Innovation Act — lets FDA mandate the electronic submission format a premarket filing arrives in, the authority behind eCopy and, later, eSTAR. That provision governs the format a submission is transmitted in. It has nothing to do with Part 11’s question of whether an electronic record is trustworthy once it exists, and clearing the eSTAR template says nothing about whether any particular record inside it was ever subject to Part 11 at all.

The practice

The question worth asking about any electronic record a quality system produces isn’t whether it’s electronic. It’s whether some predicate rule required that record before anyone built a system to hold it — a question with 21 CFR 803, 806, and the rest of a device company’s own regulations as the only place to look for an answer, not Part 11’s own text. Deciding which systems in a specific company’s quality system actually carry that duty, and what validation a specific predicate rule is owed, is a call for the regulatory and quality professionals who hold that file — this is regulatory intelligence and method, about where one rule’s authority starts and another’s ends, never advice on a specific system’s own compliance.