In February 2003, the FDA published a draft guidance for 21CFR11 titled 'Scope and Application'. This new guidance withdrew all previous guidances and the compliance policy guide as well as providing new interpretation to the industry on the current thinking of the FDA on 21CFR11. This 're-examination' of 21CFR11 is part of the FDA's initiative for current good manufacturing practice (cGMP), based on a risk-based approach to quality regulation. As such, the guidance is intended as an interim indication of the FDA's current thinking whilst the cGMP initiative is continuing.
The new guidance touches on 3 topics :
- Scope of the regulation
- Areas subject to enforcement discretion
- Legacy systems
Scope of the regulation
According to the new guidance 21CFR11 will now be interpreted narrowly, in the sense that only records that are required to be maintained or submitted by the predicate rule will be subject to 21CFR11. In addition, paper printouts of electronic records, where the paper printout is the record maintained or submitted as part of the predicate rule, will not fall under 21CFR11. We would expect that far fewer records would fall under the 21CFR11 umbrella.
Areas subject to enforcement discretion
The guidance states that the FDA will exercise 'enforcement discretion' with regards to the validation, audit trails, copies of records and record retention aspects of 21CFR11. Systems access, operational, authority and device checks, training and electronic signatures require continued compliance. Enforcement discretion in this case will mean that systems need to comply with predicate rule requirements but records not directly required by predicate rules need not adhere as rigorously to 21CFR11.
Legacy systems
When published, the final rule for 21CFR11 stated that all existing, legacy systems needed to comply. Perfectly usable and reliable systems that had worked for years instantly became obsolete and useless. The new guidance states that legacy systems that otherwise meet predicate rule requirements prior to August 20, 1997 will also be subject to 'enforcement discretion'. In this case, provided legacy systems are 'fit for their intended use', they will not normally need to be compliant with 21CFR11.
PA's opinion
This new guidance clarifies the agency's thinking on the regulation and means that everyone can now focus on the critical systems that need to be compliant with the regulation. In reviewing the regulation, the FDA are also bringing 21CFR11 closer to the stated cost-neutral state that it was intended to be. Existing implementations of 21CFR11 do not need to be revised as they will all meet the new guidance handsomely. The worst that can be said is that there will be many companies bemoaning the replacement of perfectly good legacy systems. However, such companies will not have wasted money entirely as they will now have state-of-the-art systems in place so that when the FDA does start to catch up on legacy systems, they will be ahead of the game. It is likely that the FDA is simply giving companies a breathing space, during which only a subset of electronic records are examined for 21CFR11 compliance. However, it seems inevitable that the need for compliance will gradually spread to more and more systems over time.
