21 CFR Part 11 has been in force since 20 August 1997 (Final Rule published 20 March 1997 + effective 20 August 1997). The 2003 FDA Scope and Application Guidance significantly narrowed enforcement scope using a risk-based approach + announced enforcement discretion regarding certain Part 11 requirements (legacy systems + validation + audit trails for non-critical records). FDA enforcement focus areas: (a) data integrity - the FDA Data Integrity Guidance (2018 + 2021 update) + Warning Letters citing inadequate audit trail review + missing accountability + paper-vs-electronic discrepancies + post-hoc record creation; (b) clinical trial data per Bioresearch Monitoring (BIMO); (c) GMP manufacturing records per the 'Data Integrity ALCOA+' framework (Attributable + Legible + Contemporaneous + Original + Accurate + Complete + Consistent + Enduring + Available); (d) medical device per QMSR (21 CFR Part 820 + ISO 13485 alignment from 2 Feb 2026). 2023 FDA COMPUTER SOFTWARE ASSURANCE (CSA) DRAFT GUIDANCE proposes modernised validation approach focused on critical thinking + risk + intended use + appropriate testing - reducing prescriptive CSV burden + accelerating digital transformation in regulated industries. Future evolution: SBOM expectations per Cures Act 524B + FDA 2024 pre-market cybersecurity guidance; AI / ML in regulated systems per the 2023 FDA AI/ML Action Plan + the 2024 FDA Digital Health Center of Excellence priorities; coordination with EU GMP Annex 11 (Computerised Systems) + EMA Q&A on Annex 11 + EU MDR / IVDR digital records provisions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.