21 CFR Part 11 for maintenance records

21 CFR Part 11 is the FDA regulation governing electronic records and electronic signatures used in place of paper under an FDA predicate rule. It does not create the requirement to keep the maintenance record — something else does that. Part 11 governs what must be true of the record once you decide to keep it electronically, and applies only where a predicate rule requires the record and you keep it electronically in place of paper.

Four requirements do the work for a maintenance record: attributable to an identified individual, protected from undetected alteration, retained and retrievable through the retention period, and — where a signing is required — a signature linked to the record it signs.

EU GMP Annex 11 covers the same ground with more explicit emphasis on risk management, supplier assessment, and audit trails that are reviewed, not merely generated.

No software vendor can sell you a compliant or validated system. Compliance is a property of your processes, your validation, and how you operate the system in your environment — not a badge a product carries.

How MYREX records maintenance work: sign-in is through Microsoft Entra, so the identity in the record is the organisation’s own directory identity. Completed work carries an attestation by that identified user. Work on maintenance records — creation, assignment, edit, completion, attestation — is written to an audit log secured by a SHA-256 hash chain — tamper-evident, meaning not that alteration is impossible, but that alteration is detectable. Administrative changes to accounts and roles are recorded but currently sit outside that chain, and verification does not walk them. This is a design aligned with 21 CFR Part 11 and EU GMP Annex 11. Validation in your environment remains yours to perform.