Part 11 applies only when a predicate rule requires the record
Part 11 does not stand on its own. It applies to electronic records that a predicate rule, an underlying FDA regulation such as the cGMP rules in 21 CFR Part 211, requires you to keep. Where no predicate rule requires the record, Part 11 does not attach, even when the record is held electronically. FDA’s 2003 Scope and Application guidance is explicit that the agency reads Part 11 narrowly, and that fewer records are in scope than a plain reading of the rule suggests.
No FDA rule names a P&ID as a required record. A P&ID is a good-engineering-practice design document. It becomes a GMP-controlled record only when your QMS designates it one, for qualification, change control, or facility and equipment definition, or, for medical-device makers, when it forms part of design-control records. Whether a given P&ID is a predicate-rule record is therefore your determination, tied to your product type and how your QMS treats the drawing. We do not assert it either way on your behalf.
The guidance’s own analogy is the useful one. FDA says validation “would not be important for a word processor used only to generate SOPs”. A drawing tool used to author a document that is then controlled elsewhere sits in the same place.
Authoring tool versus system of record: where the record actually lives
The question resolves once you separate the two systems and their two jobs. If the drawing is exported into your document system (your eDMS or QMS), where it is versioned, reviewed, approved with an electronic signature, retained and retrieved, then that system is the Part 11 system of record. The editor is where the drawing is authored and moves between people before it gets there.
Authoring layer · PharmaDiagrams
Where the working drawing lives
- create
- share link
- comment on the tag
- version history
- export
Record-holding layer · your validated DMS
Where the GxP record is controlled
- Veeva Vault
- ValGenesis
- Part 11 controls
- predicate rules
The exact question we hear from QA is this: “our drawings live in our eDMS and are approved there, so does the drawing editor itself need to be Part 11 compliant?” The answer is no, not in the sense of carrying the Part 11 record and signature controls, provided that your document system is the system of record, that approval signatures are applied there on the controlled record, and that the editor is not used to retain the authoritative record or apply the regulated signature. The editor should still be access-controlled and supplier-assessed: that is Annex 11 supplier oversight and basic data-integrity hygiene, not a Subpart C signing system.
What the editor owes you, and what it does not
The clean way to write this up is to name which controls sit where. The split follows the same system-of-record line.
The editor’s job
Named accounts with no shared logins, and SSO available on Enterprise. A version history in which each version carries a tamper-evident hash. A vendor compliance package for your supplier assessment.
Your document system’s job
The Part 11 audit trail of the approved record. The approval signature of record. The retention clock and the archival copy.
Named accounts matter here more than almost anywhere. Shared logins are among the most frequently cited data-integrity findings, so unique, attributed accounts are the one control we would insist on even for a low-risk tool, and we provide them. Every plan keeps a version history in which each version carries a tamper-evident chained hash, and every edit, comment and approval is timestamped and linked to a verified user; Enterprise adds audit-log export. This is authoring-level history. We do not present it as the Part 11 audit trail of your approved record, which lives in your document system.
Where you need a regulated approval signature, it belongs on the controlled record in your document system. Electronic signatures are available on Enterprise for formal sign-off, with a 21 CFR Part 11-aligned audit trail behind them; on other plans, approval sign-off is captured where you control the record. We do not file the Part 11 electronic-signature certification, because we are not the signing system of record.
For EU buyers: Annex 11 is the closer framework, and it is being revised
If you manufacture in the EU, Annex 11 of the EU GMP guide is usually the framework that applies to you directly, and Part 11 binds in addition when you keep records for FDA-regulated product. The two point the same way for a tool like this: the computerised system that carries the obligations is the one holding the record, and the supplier of an authoring tool is assessed, not validated in your place.
Annex 11 is being revised. The European Commission published a draft for consultation in July 2025 and closed comments in October 2025; the final text is expected in 2026, with the transition period to be confirmed on finalisation. The draft’s clearest new expectation for a tool like ours is in its supplier chapter: the agreement with a service provider should include an exit strategy under which you keep control of your data. A browser tool you can export from at any time, to PNG and JSON, is the plain answer to that, and it sits alongside our EU hosting, our DPA and our subprocessor list.
See also: How much you have to validate a P&ID tool (GAMP Category 1) · How we hold your data (security)