Oh my - FDA 21CFR11

Read the reg!

I don't know whether to laugh or cry at Title 21 of the Food and Drug Administration's Code of Federal Regulation Part 11. It dictates requirements for Electronic Documents and Signatures. It seems to written on technical topics by non-technical people. It's well intended, but deliberately vague on implementation standards - over the top in many cases. The funny thing is that most vendors tout a "Certified 21CFR11 compliant" stamp on their hardware or software. The sad thing is that end users fail to realize that 80% or so of the requirements have to do with their: processes, training, documentation, etc.

I was getting so frustrated by a couple of users asking specifically how to implement a 21CFR11 application in FactoryPMI. They wanted point by point descriptions all the way down the list. I was first approached in 2005, but don't know of any users who have actually attempted a fully compliant project. I've had other users working in a 21CFR11 "compliant" facility that just wanted to use FactorySQL or FactoryPMI beside the application. I had to bite my tongue when one said that a hardware datalogger satisfied that requirement. Did anyone there actually read the regulation? Oh gosh! Maybe a good integrator helped them make their whole process compliant. I know for a fact that you can't throw any single piece of hardware or software and make it happen. Things like 11.300(e):

Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner.

Carl made me feel better when he pointed out that 21CFR11 isn't a compliance standard for HMI/SCADA design software. Its a compliance standard for HMI/SCADA project implementations, which are two totally separate things. So, I wrote a white paper on creating a compliant 21CFR11 application with Inductive Automation software and didn't feel so bad about all the, "it is the responsibility of the designer..." answers. I might add that the "big vendors" white papers have similar responses.

I'd like to see someone actually do this - but it'd take planning on the front end and someone with experience. It would be absurd for an Integrator or end user to take this on from scratch, without help, as a first project.