A 21 CFR Part 11 compliance checklist for AI-assisted adverse event grading

A 21 CFR Part 11 compliance checklist for AI-assisted adverse event grading comes down to one question an inspector can ask of any graded event: who did what, when, and on what basis. The record has to do three things. It keeps the software's suggestion and the investigator's decision side by side in a secure, time-stamped audit trail (21 CFR 11.10(e)). It carries an electronic signature showing the signer's printed name, the date and time, and the meaning of the signature (11.50). And it binds that signature to the exact record it signed (11.70). The software suggests; the investigator decides, and the signature binds that decision to the record.

Does 21 CFR Part 11 apply to AI-assisted adverse event grading?

21 CFR Part 11 is FDA's regulation setting the criteria under which electronic records and electronic signatures are considered trustworthy, reliable and generally equivalent to paper records and handwritten signatures (11.1(a)). It applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under any records requirement in FDA regulations (11.1(b)). FDA reads that scope narrowly. Under its 2003 Part 11 scope and application guidance, the regulation covers records kept electronically in place of paper, or relied on to perform a regulated activity.

FDA calls the underlying records requirements predicate rules, and adverse event records sit under two of them:

• 21 CFR 312.62(b) requires investigators to keep adequate and accurate case histories, which include progress notes and other medical records.
• 21 CFR 312.64(b) requires the investigator to report every serious adverse event to the sponsor immediately, with an assessment of whether there is a reasonable possibility the drug caused it, and to record nonserious adverse events.

So when a site grades, attributes and signs adverse events in an electronic system and relies on that system for the record, the grade, the attribution and the signature are Part 11 records. When software proposed the grade, the proposal belongs in that record's history.

Two scope points matter for AI-assisted grading. First, the source note usually sits in the electronic health record. FDA's 2018 guidance on electronic health record data in clinical investigations states that FDA does not intend to assess EHR systems for Part 11 compliance, and FDA's 2024 questions and answers repeat it while adding that once the record enters the sponsor's electronic data capture system, FDA intends to assess compliance (Q1). Second, the 2003 guidance narrowed how FDA enforces some provisions, including validation, audit trails, record retention and record copying, while the predicate rules stay fully in force.

FDA's October 2024 final guidance, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers, is the agency's current statement of its expectations for sponsors, CROs, investigators and IRBs. The question numbers below refer to that document.

21 CFR Part 11 requirements: the compliance checklist, item by item

Each of the 13 rows below maps one of the 21 CFR Part 11 requirements to what an AI-assisted grade must record or show, and where to check it.

Part 11 requirement	What an AI-assisted grade must record or show	Where to look
11.10(a) System validation	Evidence the grading software was tested for its intended use, with change control when the model or the CTCAE version changes	The vendor's validation and change-control records, and your own risk assessment
11.10(b) Accurate and complete copies	A human-readable and electronic copy of the grade with its source citation, criterion, CTCAE version, attribution and signature	Export one event and read it with no vendor in the room
11.10(c) Retrieval through retention	The record and its full history retrievable for the whole retention period	Retrieve an event from your oldest open study
11.10(d) and (g) Access and authority checks	Only authorized people can grade, change or sign, and attribution is signed by an investigator listed on the delegation log	Compare system roles with the site delegation log
11.10(e) Audit trail	Date and time, user ID and role, old value and new value, and the reason, with the software's original suggestion preserved when someone changes it	The trail for one grade a clinician overrode
11.10(f) and (h) Operational and device checks	Steps happen in the permitted order, such as review before signature; a grade missing its source citation is caught before signing; notes enter only through authorized sources	Try to sign a grade with a missing field, and check the source recorded on an imported note
11.10(i) Training	Everyone who grades or signs is trained on the system and on the CTCAE version the protocol names	Training records against the user list
11.10(j) Accountability policy	A written policy holding each signer responsible for every suggestion they accepted, changed or rejected under their signature	The site SOP and signed acknowledgments
11.10(k) Documentation controls	System and model documentation under revision and change control, including which CTCAE version and model version produced each suggestion	The vendor's controlled documentation and its change history
11.50 Signature manifestation	Printed name, date and time, and meaning (review, approval, responsibility or authorship) on every display and printout	The signed grade on screen and on paper
11.70 Signature and record linking	The signature cannot be excised, copied or moved to another record	Change a signed record: the change must appear in the audit trail, and the signature must still show which version it signed
11.100 Signature uniqueness and identity	Each signature unique to one person and never reassigned; identity verified before a signature is issued; a letter of non-repudiation on file with FDA	Account issuance records and your organization's non-repudiation letter
11.200 and 11.300 Signature components and password controls	At least two identification components, such as an ID code and a password, when not biometric; unique ID and password pairs, periodic checks such as password aging, and loss management for compromised credentials	Account and password policy, and the procedure for a lost or compromised credential

Validation and a CTCAE version change

Validation is risk-based. FDA's 2024 questions and answers (Q7) ask regulated entities to weigh a system's intended use, the importance of its records and its potential to affect participant safety or the reliability of trial results. They also ask that changes be evaluated across the system's life, depending on risk, and documented.

A CTCAE version change is a configuration change under change control. CTCAE v6.0, published by NCI on July 22, 2025, moved every grade band of Neutrophil count decreased: an absolute neutrophil count of 800/mm3 is grade 3 under v5.0 and grade 2 under v6.0. A grade with no version recorded is ambiguous. ctcae.ai lists every CTCAE v6.0 change, term by term, and CTCAE v6.0 migration guide, part 2 covers running v5.0 and v6.0 through the version transition.

What should a Part 11 audit trail capture for an AI-suggested grade?

The 2024 questions and answers set the floor (Q12). Audit trail components must include the date and time a data element was entered or modified, the individual making the change (for example, user ID and user role), and the old value and the new value. The trail should include the reason for a change where applicable and should be protected from modification and from being disabled. FDA recommends keeping it in a searchable, sortable format. Under 11.10(e), record changes must not obscure previously recorded information.

The closest analogy in the guidance is the edit check. When an edit check prompts a user to correct submitted data, FDA says the audit trail should include the original response, the fact that the edit check prompted a correction, and any change made in response (Q13). A software suggestion that an investigator accepts or changes deserves the same treatment. For each graded event, record:

1. The source: the line in the medical record the suggestion cited.
2. The suggestion as produced: CTCAE term, grade, criterion and version.
3. The attribution: an assessment for each drug in a combination regimen, and the method used, such as WHO-UMC or Kramer.
4. The clinician's action: accepted, changed or rejected, with the reason.
5. The actor and the time: user ID, role, date and time.
6. The signature: printed name, date and time, and meaning.

Illustrative audit trail for one overridden grade

The rows below are an example, not output from any system. The criterion text is the CTCAE v6.0 wording for Neutrophil count decreased.

Time	Actor (user ID and role)	Field	Old value	New value	Reason
09:02	Grading software, model version recorded	Suggested grade	(none)	Neutrophil count decreased, grade 2, CTCAE v6.0, criterion "<1000 - 500/mm3", source line "ANC 800/mm3"	Suggestion generated from the cited line
09:15	CRC-07, study coordinator	Event status	(none)	Compiled for investigator review	Not applicable
10:41	SI-014, sub-investigator	Grade	2	3	Repeat draw the same day, "ANC 450/mm3" (line cited), meets grade 3, "<500 - 100/mm3"
10:43	SI-014, sub-investigator	Signature	(none)	Printed name, date and time, meaning "Approval"	Not applicable

Once the suggestion is stored as part of the record, an override that overwrites it obscures previously recorded information, which 11.10(e) does not allow. Storing it, as the edit-check answer recommends, also shows the investigator's review was substantive.

Why a chat transcript is not a Part 11 audit trail

A transcript records what software said. It does not record, field by field, which value changed, from what, to what, and by whom. It cannot be sorted by user or filtered across a study, and the old and new values FDA expects would have to be rebuilt from prose when an inspector asks.

FDA's 2024 questions and answers, in the section on digital health technologies, note that the authorized originator of a data element can be a person or a computer system (Q20). Recording the grading software and its version as the originator of the suggestion, and the investigator as the signer of the record, keeps both visible in one trail.

Who signs an AI-assisted grade? Part 11 electronic signature rules

A person. A 21 CFR Part 11 electronic signature is one executed, adopted or authorized by an individual (11.3(b)(7)), unique to that individual and never reused or reassigned (11.100(a)). Under 312.64(b), the causality assessment on a serious adverse event is the investigator's. At many sites a coordinator compiles the event and an investigator or delegated sub-investigator signs it; that hand-off belongs in the audit trail too.

The meaning matters as much as the signature. Section 11.50 requires it on every human-readable form of the record, and "reviewed" and "approved" say different things about a software suggestion, so display the one your SOPs intend.

Two details the signature controls turn on:

• Signing in a series. Within one continuous session of controlled access, the first signing uses every signature component and later signings use at least one component only the signer can execute; signings outside a continuous session use every component each time (11.200(a)(1)).
• Finger and stylus signatures. A signature drawn with a finger or stylus is a handwritten signature under Part 11 (11.3(b)(8)), not an electronic one, and it must be linked to its electronic record (Q25).

Inspectors look at more than Part 11. BIMO inspection readiness for adverse event records covers the rest of what a BIMO inspection examines.

How Burna AI maps to the checklist

Burna AI is built for HIPAA and 21 CFR Part 11. On the items a vendor controls, the platform today works this way:

• Electronic signature (11.50, 11.70). A grade becomes a record when a qualified investigator signs it, and the signature carries what was accepted, what was overridden and the citation set as signed.
• Source citation (11.10(f)). Each grade traces to the line in the medical record that produced it, and a grade whose citation set is incomplete is flagged before it is signed.
• CTCAE version (11.10(a) configuration). Every adverse event in a note is graded against the CTCAE version the protocol names, with v5.0 and v6.0 live on one engine.
• Attribution (312.64(b)). Each event is scored for attribution against every drug in the regimen, using WHO-UMC and Kramer, with the reasoning shown.
• Export and access (11.10(b), 11.10(d)). The graded record exports for a sponsor or a monitor, and every access to patient data is recorded.

Validation for your intended use, training, the accountability policy, the delegation log and the letter of non-repudiation stay with the sponsor, CRO or site. The audit-trail fields and signing controls are set out in how Burna AI aligns with 21 CFR Part 11. What Burna AI does today lists each capability with its evidence, and the architecture a security review asks about covers PHI isolation and access. AI suggests, clinicians decide. Human-in-the-loop, always.

Why the source citation matters beyond Part 11

Section 520(o)(1)(E) of the FD&C Act excludes certain clinical decision support software from the device definition when, among other criteria, it enables a health care professional to independently review the basis for its recommendations rather than rely primarily on them (21 U.S.C. 360j(o)(1)(E)). A grade that carries its source line and CTCAE criterion is one an investigator can check independently, so the citation that makes the audit trail readable also keeps the investigator's judgment on the record. FDA's clinical decision support software guidance was revised in January 2026, and FDA clinical decision support guidance and AI adverse event grading walks through the four criteria in full.

Sponsors using AI output to support a regulatory decision should also read FDA's January 2025 draft guidance on AI for drug and biological product decision-making, which proposes a risk-based credibility assessment for a model's context of use.

Common questions about Part 11 and AI-assisted records

What are the main 21 CFR Part 11 requirements?

Subpart B covers electronic records: validation, accurate copies, record protection through retention, access and authority checks, audit trails, operational and device checks, training, accountability policies, documentation controls, signature manifestation and signature-to-record linking (11.10, 11.50, 11.70). Subpart C covers electronic signatures: uniqueness, identity verification, certification to FDA, and signature components and controls (11.100, 11.200, 11.300).

Is there such a thing as Part 11 compliant software?

Not as an FDA status. FDA does not certify electronic systems or electronic signature methods (Q28). A vendor can build a system with the controls Part 11 describes; whether its use meets Part 11 depends on how the sponsor, CRO or site validates, configures and controls it.

How long must a Part 11 audit trail be kept?

At least as long as the records it documents, and available for FDA review and copying (11.10(e)). For an investigator under an IND, 312.62(c) sets that period at two years after a marketing application is approved for the indication or, if none is filed or approved, two years after the investigation is discontinued and FDA is notified. A sponsor agreement can require longer.

Does an AI suggestion need its own electronic signature?

No. Under 11.3(b)(7) an electronic signature is executed by an individual, so software cannot hold one. The suggestion belongs in the audit trail, attributed to the software; the signature belongs to the investigator who accepted, changed or rejected it.

If your studies include grades that software suggested and an investigator signed, and you want to see the record an inspector would see, book a 15-minute conversation.