From the 21 CFR Part 11 regulation:
Sec. 11.1 Scope.
"(b) This part applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations. This part also applies to electronic records submitted to the agency under requirements of the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, even if such records are not specifically identified in agency regulations."
From the Part 11 (Electronic Records; Electronic Signatures -Scope and Application) guidance:
Introduction
"...we do not intend to take enforcement action to enforce compliance with the validation, audit trail, record retention, and record copying requirements of part 11 as explained in this guidance. However, records must still be maintained or submitted in accordance with the underlying predicate rules, and the Agency can take regulatory action for noncompliance with such predicate rules."
Validation
"The Agency intends to exercise enforcement discretion regarding specific part 11 requirements for validation of computerized systems (§ 11.10(a) and corresponding requirements in § 11.30). Although persons must still comply with all applicable predicate rule requirements for validation (e.g., 21 CFR 820.70(i)), this guidance should not be read to impose any additional requirements for validation.
"We suggest that your decision to validate computerized systems, and the extent of the validation, take into account the impact the systems have on your ability to meet predicate rule requirements. You should also consider the impact those systems might have on the accuracy, reliability, integrity, availability, and authenticity of required records and signatures. Even if there is no predicate rule requirement to validate a system, in some instances it may still be important to validate the system.
"We recommend that you base your approach on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity."
So the agency is relying on each company to perform a risk assessment of the software implemented (which generally implies an existing risk assessment of the product) to determine the approach and the extent of validation activities. This is regardless of device Class. If a company chooses to decline full validation of relevant computerized/automated systems, they must account for that rationale based on the risk assessments and other contents of the guidance, described here.
Hope this helps.
------------------------------
Christine Zomorodian
University of Washington, BRAMS Program
------------------------------
Original Message:
Sent: 29-Jul-2020 15:25
From: Anonymous Member
Subject: Part 11 Validation Class I GMP Exempt
This message was posted by a user wishing to remain anonymous
A company is claiming that they don't need to do appropriate Part 11 validation because they are class I GMP exempt device. Thoughts?