Compliant labeling in pharma: 21 CFR Part 11 in practice

During a pharma inspection, the label is often one of the first things the auditor asks about. Who changed this label, when, and who approved it? If you can't prove it, you have a finding. This article explains what 21 CFR Part 11 and EU GMP Annex 11 concretely mean for your labeling process, and how to comply without building a paper mountain.

What the rules require

21 CFR Part 11 is the American FDA regulation for electronic records and signatures. EU GMP Annex 11 is the European counterpart for computerized systems. The details differ, but for labeling they come down to the same thing.

You must be able to prove who created or changed a label template, and when. Changes must be approved by an authorized person before the label goes into production. And that entire history must be kept in an audit trail that cannot be altered afterwards.

With loose label files on a PC next to the printer, that is practically impossible. Who made version 14 of the label? Nobody knows for sure.

The three pillars of compliant labeling

Audit trail

Every action is recorded automatically: create, change, approve, print. Not as an option someone can switch off, but as a fixed part of the system. During an inspection you pull up the full history of any label within a minute.

Approval workflow

A changed label does not go straight to the printer. It first passes through a workflow: the designer submits, an authorized colleague reviews, and only after approval does the new version become available for production. Roles and permissions control who may do what.

Version control

Every change produces a new version, and old versions are retained. You can always see which label was in use at which moment. That is exactly the question that needs answering during a recall or complaint.

What this means for your system choice

These requirements are why Loftware Cloud has a separate Compliance edition. Audit trail, electronic signatures, and approval workflows are built in, set up according to 21 CFR Part 11. The edition page shows how Compliance compares to Essentials and Business.

Important to know: the system alone does not make you compliant. The setup has to match your quality processes, and validation remains your responsibility. That is why our pharma implementations come with documentation that supports your validation track. Read more about our approach in the sector on the pharma page.

Frequently asked questions

Does this apply to us if we only produce for the EU?

Then EU GMP Annex 11 is leading. Its requirements for audit trails and change management strongly overlap with Part 11, so the setup is virtually the same in practice.

Is a cloud system even allowed in a GMP environment?

Yes. Annex 11 and Part 11 set requirements for the system and its use, not for where it runs. Loftware Cloud runs in a certified Azure environment and is used by pharma companies worldwide in validated processes.

Do we have to revalidate all our existing labels when switching?

Your label designs migrate along. The validation work is mainly in the new system and the workflows; we supply supporting documentation for that.

Conclusion

Compliant labeling comes down to three things you must be able to prove: who, what, and when. Loose files can't do that; a central system with an audit trail and approval workflow can. Want to see how it works with your own labels? Book a demo, tailored to your quality process.