Data integrity for temperature records: 21 CFR Part 11 and Annex 11

When a temperature record becomes a GxP record

Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirement in FDA's regulations. FDA calls those underlying requirements predicate rules. Two of them name temperature. The current good manufacturing practice (CGMP) rules require written warehousing procedures that include storing drug products under appropriate conditions of temperature (21 CFR 211.142). FDA's minimum standards for state licensing of wholesale distributors require temperature recording equipment, devices, or logs to document proper storage (21 CFR 205.50(c)(2)).

FDA's 2003 guidance says Part 11 applies to a required record kept electronically in place of paper, and to one kept on paper and electronically when the electronic version is relied on to perform regulated activities. FDA recommends deciding in advance which one you rely on, and documenting that decision. Its 2018 guidance is shorter: when data is generated to satisfy a CGMP requirement, all of it becomes a CGMP record.

The 2003 guidance also narrows enforcement. FDA does not intend to take enforcement action on Part 11's own validation, audit trail, record retention, and record copying requirements, but the predicate rules still apply, and FDA still enforces access limits, authority checks, and the electronic signature requirements. Its 2018 guidance rests on the CGMP rules rather than on Part 11, and it still expects access to be restricted and audit trails to be reviewed with the record.

A temperature record that a quality team reads to release a shipment or assess an excursion is a GxP record, and the system that holds it is in scope. Even a shipping record that no rule requires can end up in front of an inspector: FDA says it routinely requests records that were not meant to satisfy a CGMP requirement but contain CGMP information, such as shipping records that may be used to reconstruct an activity.

In the EU, distributors find the computerized-system rules in the good distribution practice (GDP) guidelines themselves (section 3.3.1): a system is validated or verified before use, only authorized people enter or amend data, and backups are kept for at least five years. How the rest of GDP treats temperature is in our guide to good distribution practice.

ALCOA+, applied to a temperature record

ALCOA is the acronym regulators use for the attributes of trustworthy data: attributable, legible, contemporaneous, original, and accurate. ALCOA+ (ALCOA plus) adds complete, consistent, enduring, and available. The UK Medicines and Healthcare products Regulatory Agency (MHRA) says the expectations are the same whichever acronym is used. The definitions below follow PI 041-1, the data integrity guide for inspectors from the Pharmaceutical Inspection Co-operation Scheme (PIC/S), which is not binding in itself; the right-hand column is what each means for a shipment's record.

Audit trails

Part 11 requires secure, computer-generated, time-stamped audit trails that independently record the date and time of entries and actions that create, modify, or delete electronic records. A change must not obscure what was recorded before, and the audit trail is kept at least as long as the record it covers (11.10(e)).

Annex 11 asks companies to consider, based on a risk assessment, building in an audit trail of GMP-relevant changes and deletions. Where such data is changed or deleted, the reason is documented, and audit trails can be converted to a readable form and are regularly reviewed (section 9). FDA expects whoever reviews a record under CGMP to review its audit trail with it. The World Health Organization (WHO) expects audit trails to be on for all interactions, the ability to switch them off to be restricted, and any switching off to appear in the audit trail itself.

In a monitoring system, that means anything that changes what a reviewer sees: alarm limits, a shipment's start and end, which device it carries, alarm acknowledgements, and comments.

Electronic signatures

Where a record is signed electronically, such as an excursion assessment or a release decision, Part 11 Subpart C applies. Each signature is unique to one person and never reused or reassigned (11.100). Signatures not based on biometrics use at least two components, such as an identification code and a password (11.200). The signed record shows the signer's printed name, the date and time, and the meaning of the signature, such as review or approval (11.50), and the signature is linked to its record so it cannot be copied to another (11.70). Before or when they start using them, companies certify to FDA that their electronic signatures are intended to be the legally binding equivalent of handwritten signatures (11.100(c)).

Annex 11 covers the same ground more briefly: an electronic signature has the same impact as a handwritten one within the company, is permanently linked to its record, and carries the time and date it was applied (section 14).

Validation

Part 11 lists validation first: systems are validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records (11.10(a)). FDA's 2003 guidance advises basing the extent of validation on a justified and documented risk assessment.

For a bought system, FDA's 2018 guidance draws the line that matters: validating the platform is not enough unless the workflow it is used for is validated too. Under Annex 11, the regulated user checks the supplier's documentation against its own requirements, assesses the supplier, and keeps the system under change control and periodic evaluation (sections 3, 4, 10, and 11).

Access control

Part 11 limits system access to authorized individuals and uses authority checks so that only they can sign, alter a record, or perform an operation (11.10(d) and (g)). Annex 11 asks for physical or logical controls, a record of every access authorization created, changed, or cancelled, and a record of who entered, changed, confirmed, or deleted data, with date and time (section 12).

FDA singles out shared logins: they make it impossible to identify a unique individual, so the system does not conform to the CGMP rules. A shared read-only account for viewing data is acceptable. FDA also recommends an administrator independent of the people responsible for the record's content.

Retention, copies, and reports

A record has to stay retrievable, accurately, for its whole retention period (Part 11, 11.10(c)), and the system has to produce accurate and complete copies, both human readable and electronic, for an inspector (11.10(b)). The retention period comes from the predicate rule. Under US CGMP, records associated with a batch are kept for at least one year after the batch's expiration date (21 CFR 211.180). Under EU GDP, documents are kept for at least five years, or longer where national law says so. Annex 11 adds regular backups whose restoration is checked, and archives checked for accessibility, readability, and integrity, including after a change of system (sections 7 and 17).

A PDF report produced at the end of a shipment is useful, but it is a copy. FDA accepts an electronic copy as a true copy only if it preserves the content and meaning of the original, including its metadata and whether the original was static or dynamic, and it says a printout or static record of a dynamic electronic record does not preserve that format. PIC/S warns that summary reports often leave out the supporting data and metadata, and that neither companies nor inspectors should place sole reliance on them. The original readings and their audit trail need to stay retrievable behind the report.

When the system belongs to a service provider

When monitoring data lives on a supplier's platform, Annex 11 requires a formal agreement that states the third party's responsibilities, and says the need for an audit should be based on a risk assessment (section 3). The MHRA asks cloud and software-as-a-service users to understand the ownership, retrieval, retention, and security of their data, and to have a contract that gives the data owner and the authorities timely access to data, metadata, and audit trails.

What to ask of a monitoring system

The rules above lead to a short list of questions for qualifying any temperature monitoring system:

Is the audit trail always on?

Which actions does it record, does it keep the old and the new value and a reason, and can anyone switch it off?

Can every action be traced to one person?

Are accounts personal, is there no shared login with write access, and who administers access?

Are readings stored as captured?

With their time and time zone, and with gaps and out-of-range readings kept rather than smoothed over?

Where are electronic signatures used?

For which decisions, with what components, and does the signed record show name, time, and meaning?

What validation documentation comes with it?

And what is left for your own validation of the workflow you will use it for?

How are changes to the system controlled?

How are you told about a release that touches the validated state?

Can you get the original data out?

Including metadata and audit trail, in a usable format, for as long as your retention period runs, and after the contract ends?

Are the sensors calibrated?

Against what standard, and can you see each device's calibration certificate?

Ask the supplier to show each answer in the system and in its documentation, not only in a questionnaire.

How the device types differ in what they record, and when, is in our guide to cold chain monitoring devices. What the record is used for after a breach is in our guide to temperature excursions, how it is used to release a shipment, including by exception, in our guide to product release after transport, and when it pays to have it while the shipment is still moving, in why real-time temperature monitoring.

Annex 11 is being revised

The European Commission consulted on a revised Annex 11, together with a revised Chapter 4 on documentation and a new Annex 22 on artificial intelligence, from 7 July to 7 October 2025. The draft is far more specific than the 2011 text: unique personal accounts, with shared accounts other than read-only ones called a violation of data integrity; audit trails that record who, what, when, and why, including the old and the new value; and a section on alarms, whose limits are justified and whose acknowledgement, for critical alarms, carries a comment saying why. It also states that a regulated user who outsources an activity remains fully responsible for it.

Status as of 2 November 2026: the consultation is closed, and the Commission's EudraLex Volume 4 page still lists the January 2011 revision of Annex 11 as the current text. The draft is not in force.

Where Controlant fits

The Controlant Platform is validated to comply with FDA 21 CFR Part 11 and EU GMP Annex 11, under a quality management system certified to ISO 9001. Its audit trail is always on and cannot be switched off, and each device's calibration certificate opens from the platform. GxP compliance itself stays with you as the regulated company: validating the platform for the way you will use it, and qualifying your lanes and standard operating procedures. The certifications and the validation statement are on our quality and certifications page.