Can document automation meet 21 CFR Part 11?
Updated October 2026 · By Scott Thompson, Founder
The short answer
Yes, if the system builds in the record controls of 21 CFR 11.10 (a tamper-evident audit trail with named actors, complete copies for inspection, records retained rather than deleted, access limited by role, enforced sequencing) and, where you need them, compliant electronic signatures. DynamoDocs implements both for purchase orders, invoices, and related documents, with signatures as a setting. Compliance itself belongs to the validated system as you use it, so validation and procedures stay with you.
What Part 11 asks of a document system
Section 11.10 asks for the ability to discern altered records (a), accurate and complete copies for inspection (b), protection of records through their retention period (c), access limited to authorized people (d), secure, time-stamped audit trails that record who did what and never obscure the previous value (e), enforced sequencing of steps (f), and authority checks (g). A document-automation system that edits records an FDA inspector may later ask for has to answer each one.
An audit trail that shows tampering
Every ingest, edit, review decision, status change, and export is recorded with the named person who made it and the before and after value of every field changed. The history lives in its own append-only table the database refuses to change, and each entry is hash-chained to the one before, so an entry altered, removed, or inserted some other way breaks the chain and the check names the first broken link. Preventing a change and being able to detect one are different properties; 11.10(a) asks for the second.
Copies, retention, and no deletion
Any record exports as an inspection copy, printable or as JSON, with the extracted data, the full history, and the result of verifying the chain at that moment. Records are archived, never deleted: archiving keeps the record and its original file and is itself an attributed entry, and every record carries a retention date, seven years by default.
Roles and sequencing
Four roles (viewer, reviewer, approver, administrator) are enforced on the server, and people sign in with Microsoft 365 or Google, with roles assignable from your own Entra groups. A document cannot be posted to the ERP while review issues are open, cannot post twice, and cannot be edited once it has been exported or archived. Each of these controls is covered by named automated tests that can be walked through as part of your validation.
Electronic signatures, when you turn them on
With signatures switched on, every release (approving a document, approving its review, posting it to the ERP) is signed. The signer re-enters their credentials at that moment: their password, or a fresh Microsoft sign-in whose time of authentication the server checks against a short window (11.200). The signature shows the printed name, the date and time, and a fixed meaning such as Released to the ERP (11.50), and it is recorded on the audit entry of the action it signs, inside the hash chain, with a fingerprint of the record as signed, so it cannot be lifted onto another record (11.70). Failed attempts are logged.
What stays with you
Certifying to the FDA that your electronic signatures are the legally binding equivalent of handwritten ones (11.100(c)) is a letter your organization sends. Validation (IQ/OQ/PQ), SOPs, and training remain yours too; no software vendor can make a customer compliant. DynamoDocs provides the controls and named automated tests for each, which your quality team can walk through.
Related questions
Is DynamoDocs Part 11 certified?
There is no FDA certification for software. Part 11 compliance is a property of a validated system in use. DynamoDocs provides the technical controls of 11.10 and 11.50 to 11.200, and the evidence of how each works; your quality team validates it for your intended use.
Are Microsoft 365 logins enough for Part 11 signatures?
They are a strong foundation, not the whole answer. Microsoft establishes who the person is and can enforce multi-factor authentication, but Part 11 also asks that the credentials be entered at the moment of signing, that the signature state its meaning, and that it be bound to the record. DynamoDocs sends the signer back through Microsoft to re-authenticate, checks when that happened, and records the signature with its meaning on the record itself.
Which industries need this?
Life-science suppliers, medical-device and pharmaceutical manufacturers, and their distributors, where purchase orders, quotes, and order confirmations can become records an inspector may request.
Can we keep using our own sign-in?
Yes. Microsoft 365 (Entra ID) sign-in accepts only the tenants you list, refuses personal accounts, and can take roles from your own app roles or security groups, so membership is managed in your tenant.
Go deeper
See it on your documents
Bring a real invoice, PO, or RFQ and watch DynamoDocs take it from inbox to posted in your ERP in about 30 minutes.
More answers