21 CFR Part 11 and Cannabis: What Operators, Labs, and Future DEA Registrants Need to Know

For most of cannabis history, 21 CFR Part 11 was somebody else's problem — a pharmaceutical rule that lived in a world the plant-touching industry couldn't legally enter. That changed in April 2026, when the federal government moved FDA-approved and state-licensed medical cannabis to Schedule III. As cannabis edges toward the same regulatory framework that governs drug manufacturers, the FDA's electronic records and signatures rule is about to become a working requirement for serious operators. This guide from Cannaspire's GMP and regulatory team explains what Part 11 actually is, who it applies to, and how cannabis MSOs, manufacturers, and laboratories should approach cannabis 21 CFR Part 11 compliance now — before an auditor asks to see your audit trail.

What is 21 CFR Part 11?

21 CFR Part 11 is the section of U.S. Food and Drug Administration regulation that governs electronic records and electronic signatures. The FDA finalized it in 1997 to answer a simple question: when can an electronic record or a digital signature be trusted as much as paper and ink? The rule sets the conditions under which the FDA will accept electronic records, electronic signatures, and handwritten signatures executed electronically as trustworthy, reliable, and equivalent to paper records.

Part 11 does not stand alone. It attaches to whatever underlying FDA regulation already requires you to keep a record — what the agency calls a "predicate rule." For a drug manufacturer, the predicate rules are current Good Manufacturing Practice (cGMP) regulations in 21 CFR Parts 210 and 211. For a medical device maker, it's the Quality System Regulation. The predicate rule tells you what records you must keep and for how long. Part 11 tells you how to keep those records electronically without losing their integrity.

In 2003, the FDA narrowed how aggressively it enforces parts of the rule, issuing guidance that applies a risk-based approach and enforcement discretion to certain requirements. But the core never went away: if you maintain a required record electronically, that system has to control who can change it, prove what was changed and when, and produce accurate copies on demand. That principle is the entire ballgame.

Why 21 CFR Part 11 suddenly matters to cannabis

Until recently, this conversation was academic for plant-touching businesses. Marijuana sat in Schedule I of the Controlled Substances Act, outside the FDA's drug-manufacturing framework, so cGMP and Part 11 simply didn't reach most operators. The April 2026 rescheduling action changed the trajectory.

On April 23, 2026, the Department of Justice issued a final order placing two categories of cannabis into Schedule III: marijuana contained in FDA-approved drug products, and marijuana produced and dispensed under a qualifying state medical marijuana license. The order took effect at the end of that month. It also created an expedited DEA registration pathway for state-licensed medical cannabis entities to integrate into the federal framework that governs Schedule III substances — including federal expectations around recordkeeping, security, and labeling. A separate DEA administrative hearing on whether to reschedule marijuana more broadly is set to begin June 29, 2026.

Recreational and adult-use cannabis remains in Schedule I for now, and the broader rescheduling question is unresolved and likely to face legal challenges. But the direction is unmistakable. Schedule III is a prescription-drug schedule. As medical cannabis moves into it — and as pharmaceutical-grade products, clinical research, and FDA-approved cannabis therapeutics expand — the operators in that lane inherit the expectations of the regulated drug world. Two of the biggest are cGMP and 21 CFR Part 11.

The practical takeaway: the companies that will compete for FDA-aligned, medical, and pharmaceutical opportunity are the ones building Part 11-capable systems and cannabis GMP compliance programs before they're legally compelled to. Retrofitting data integrity into a live operation after an inspection finding is far more expensive than building it in.

The two pillars: electronic records and electronic signatures

Part 11 has two halves, and understanding the distinction keeps the rest of the rule from feeling like alphabet soup.

Electronic records

An electronic record is any combination of text, graphics, data, audio, or other information in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system — when a predicate rule requires that record. A batch production record in a manufacturing execution system, a stability result in a laboratory information management system (LIMS), a calibration log, a deviation report: all electronic records once they live in software and a regulation requires them.

Electronic signatures

An electronic signature is a computer compilation of symbols — typically a unique user ID plus a private password — that an individual adopts as the legally binding equivalent of their handwritten signature. Part 11 requires that signed electronic records clearly show the signer's printed name, the date and time of signing, and the meaning of the signature (review, approval, authorship, responsibility). Non-biometric electronic signatures must use at least two distinct identification components, and those components can't be reused or reassigned to anyone else.

The connection between the two pillars is deliberate: an electronic signature has to be permanently linked to its record so it can't be cut, copied, or transferred to falsify another document. That linkage is what makes the signature mean something.

The core 21 CFR Part 11 requirements, in plain language

Strip away the legal phrasing and Part 11 comes down to a handful of controls a compliant system must support. For a "closed system" — one where access is controlled by the same people responsible for the records — these are the load-bearing requirements:

None of these are exotic. They are the digital equivalent of locking the records room, signing in a logbook, using your own pen, and keeping every page in order. The challenge for cannabis operators is rarely understanding the principle — it's that most consumer and seed-to-sale software in the industry was never built to satisfy these controls.

Open vs. closed systems under 21 CFR Part 11

Part 11 treats two kinds of systems differently, and the distinction drives how much control you need.

A closed system is one where access is controlled by the people who are responsible for the content of the records — for example, an on-premise LIMS that only your validated, badged employees can reach. Most internal quality and manufacturing systems are closed.

An open system is one where the people controlling access are not responsible for the records — classically, records that travel across systems or third parties you don't control. Cloud and software-as-a-service deployments can introduce open-system considerations depending on how data moves and who holds the keys. Open systems require the closed-system controls plus additional measures such as encryption and, where appropriate, digital signature technology to protect records in transit and at rest.

For cannabis operators leaning heavily on cloud LIMS, eQMS, and SaaS document platforms, this matters: you can't simply assume a vendor's "Part 11 compliant" marketing claim covers your obligations. Compliance is shared. The vendor provides capabilities; you configure them correctly, validate them for your use, and own the procedures around them.

Validation: CSV, CSA, and what "validated" really means

Validation is where cannabis 21 CFR Part 11 programs most often stall, because the word gets misused. Validation is not "we tested the software once." It is documented, ongoing evidence that a system performs reliably for its intended use and protects record integrity throughout its lifecycle.

For decades the standard approach was Computer System Validation (CSV) — heavy, prescriptive, document-everything testing that often produced binders no one read. The industry reference framework, GAMP 5 (Good Automated Manufacturing Practice), has long pushed a more proportionate, risk-based model. The FDA reinforced that direction in September 2025 when it finalized its Computer Software Assurance (CSA) guidance for production and quality system software.

CSA reframes validation as a risk-based assurance exercise: focus the most testing and documentation on the software functions where a failure would actually harm product quality or patient safety, and apply a lighter touch to low-risk functions. It explicitly preserves Part 11 — the FDA's enforcement discretion under CSA does not extend to validating software used in production and the quality system, and Part 11's electronic record, signature, and audit-trail controls remain foundational regardless of which validation approach you use. CSA was written in the medical-device quality-system context, but its risk-based philosophy increasingly informs how all FDA-regulated operations think about software assurance.

What this means in practice for a cannabis operator approaching GMP:

• Inventory your software. Identify every system that creates or maintains a record a predicate rule would require — LIMS, MES, eQMS, ERP, environmental monitoring, CDS.
• Risk-rank each one. Determine its intended use and whether a malfunction is high process risk or not.
• Leverage vendor evidence. For commercial GxP systems, vendors supply functional specs, traceability, and test documentation you can use as part of your own assurance instead of re-testing from scratch.
• Keep it alive. Validation isn't a one-time event. Each significant software change or release needs a documented impact assessment.

Which cannabis operators must comply with 21 CFR Part 11

Part 11 isn't one-size-fits-all. Here's how it lands for each part of the cannabis ecosystem.

If you sit in more than one of these boxes — say, an MSO with an in-house lab pursuing medical product lines — the obligations compound. That's the realistic future for the industry's larger players, and it's why building Part 11 capability once, correctly, beats bolting it on later in each silo.

21 CFR Part 11, cannabis GMP, and data integrity (ALCOA+)

Part 11 doesn't exist for its own sake — it serves data integrity, the principle that the records proving your cannabis product is safe and made correctly can be trusted. In the GMP world, data integrity is summarized by the acronym ALCOA+: data should be Attributable, Legible, Contemporaneous, Original, and Accurate, plus Complete, Consistent, Enduring, and Available.

Read those nine attributes back against the Part 11 control list and the overlap is obvious. Attributable maps to unique logins and signatures. Contemporaneous and Original map to audit trails and protection against overwriting. Enduring and Available map to record retention and accurate copies. Part 11 is, in effect, the technical enforcement layer for ALCOA+ in any system where GMP records are kept electronically.

This is why Part 11 and cannabis GMP services are inseparable in practice. A GMP quality system defines what must be controlled — your procedures, your batch records, your release criteria. Part 11 ensures the electronic version of all of it holds up. Operators who treat them as one program, rather than two projects, get to inspection-ready far faster.

21 CFR Part 11 and DEA registration for cannabis

The April 2026 order didn't just reschedule certain cannabis — it opened an expedited pathway for state-licensed medical cannabis entities to register with the DEA and operate within the federal framework for Schedule III substances. For operators evaluating that pathway, two things are worth separating clearly.

DEA recordkeeping and Part 11 are not the same rule. The DEA's controlled-substance recordkeeping, security, and reporting requirements live in their own regulations and are distinct from the FDA's Part 11. A DEA registrant does not automatically become a Part 11 entity simply by registering.

But the two worlds converge fast. The companies most likely to pursue Schedule III registration — medical producers, research-aligned operators, and anyone building toward FDA-approved or pharmaceutical-grade products — are precisely the companies that will also operate under cGMP. Once you keep GMP-required records electronically, Part 11 applies. In other words, DEA registration is often the on-ramp to the regulated environment where Part 11 becomes mandatory, even though the DEA isn't the agency enforcing it.

If you're weighing federal registration, it pays to plan the FDA-side obligations in the same breath. Our medical marijuana DEA registration team works alongside our GMP and Part 11 specialists so registrants don't solve one regulatory problem while creating another.

Common 21 CFR Part 11 gaps cannabis operators hit

Across cultivation, manufacturing, and lab environments, the same Part 11 failures show up again and again in cannabis operations. If any of these describe your operation, they're worth addressing before they become findings.

• Shared or generic logins. A single "lab" or "production" account used by the whole shift destroys attributability — you can't prove who entered or changed a record.
• No audit trail, or audit trails turned off. Some software supports audit trails but ships with them disabled, or lets administrators edit records without a trace.
• Spreadsheets as system-of-record. Unvalidated, freely editable spreadsheets holding GMP-relevant data are among the most common integrity gaps in the industry.
• Unvalidated software. Deploying a LIMS or eQMS straight out of the box without documented validation for your intended use.
• "Compliant software" assumed to mean "compliant operation." A capable platform configured loosely, with no procedures around it, is not compliant.
• Screenshots and PDFs treated as originals. A static export is not the dynamic, audit-trailed record the rule expects.
• Electronic signatures without meaning or linkage. Clicking "approve" with no captured name, date, time, and reason — or signatures that aren't bound to the record — won't hold up.
• No retention and retrieval plan. Records that can't be produced in a readable format years later fail the protection requirement.

How to get your cannabis operation 21 CFR Part 11 ready

You don't fix Part 11 by buying a product. You fix it with a program. Here's the sequence Cannaspire uses with cannabis operators building toward GMP and FDA-aligned standards.

1. Define your scope against predicate rules

   Identify which records you're actually required to keep and under which regulation. Part 11 only applies where a predicate rule requires the record — scoping this correctly prevents over- and under-building.

2. Inventory and risk-rank your systems

   List every system touching a regulated record — LIMS, CDS, MES, eQMS, ERP, environmental monitoring — and rank each by process risk so validation effort lands where it matters.

3. Run a gap assessment

   Map each system against the Part 11 control list and ALCOA+ attributes. Document exactly where access control, audit trails, signatures, and retention fall short of the requirement.

4. Validate with a risk-based plan

   Apply a CSA-style, GAMP 5-aligned approach. Leverage vendor documentation for commercial systems and focus testing on high-risk functions. Capture documented, defensible evidence.

5. Build the procedures around the technology

   SOPs for access management, audit-trail review, electronic signatures, data backup and retention, and change control. The software enables compliance; the procedures operationalize it.

6. Train your people — and document it

   Everyone using a regulated system must be qualified and must understand the legal weight of their electronic signature. Training records are themselves a Part 11 record.

7. Keep it in a validated state

   Audit-trail reviews, periodic system reviews, and impact assessments for every significant change. Compliance is maintained, not achieved once.

This is the work our cannabis compliance consultants do. Our cultivation and manufacturing leads, Warren Harasz and Beck Selman, bring hands-on facility and GMP experience to the technical build, so the program reflects how a real operation runs — not a theoretical checklist. As a cannabis consulting firm that has guided operators through licensing, compliance, and GMP readiness across multiple states, we build Part 11 and data-integrity programs that hold up when it counts.

Cannabis 21 CFR Part 11: frequently asked questions

Disclaimer: This guide is for informational purposes only and does not constitute legal or regulatory advice. It summarizes 21 CFR Part 11 (Electronic Records; Electronic Signatures), related FDA guidance including the September 2025 final Computer Software Assurance guidance, and the April 2026 Department of Justice/DEA order rescheduling certain marijuana products to Schedule III. Federal rescheduling remains subject to an ongoing DEA administrative proceeding and potential legal challenge; the status of broader rescheduling is unresolved. Regulations and their applicability change — verify current requirements against the FDA, DEA, and the relevant statute or rule, and consult qualified regulatory counsel before making business decisions. Last updated: June 2026.