21 CFR Part 11 and the compliance imperative for Australian biomedical businesses

Visualise this: a small Australian biomedical manufacturer, maybe twenty staff, with an innovative product and serious ambition to break into the US market. They’ve done their homework. They’ve got ISO 13485 certification, a Quality Management System running on Microsoft SharePoint, and a team that takes quality seriously. Then, partway through export planning, someone asks the question nobody had thought to ask: "How do you prove your electronic records are legally equivalent to paper under FDA rules?"

That question leads straight to FDA 21 CFR Part 11, a US regulation from 1997 that most Australian manufacturers have barely heard of. Part 11 sets out what the FDA expects when companies use electronic systems to manage quality records instead of paper. Every electronic signature has to be tied to a verified individual, carry a clear statement of intent (why they’re signing), and be locked to a timestamp that can’t be altered after the fact. The system has to keep a complete audit trail of every change, every approval, and every deletion. Access has to be controlled through defined roles, with permissions following least-privilege principles. Does it sound familiar territory? identity management, access governance, logging and monitoring, and data quality. The difference is that in a pharmaceutical context, getting these wrong doesn’t just create a security risk. It can block your product from entering the US market entirely.

So how does a SharePoint setup actually meet these requirements? That’s where ISPE GAMP 5 comes in. GAMP 5 is a globally recognised framework, published by the International Society for Pharmaceutical Engineering, that delivers a structured way to validate computerised systems in regulated industries. It classifies software into categories based on how much it has been customised. SharePoint, which is typically configured with workflows, metadata, and permission structures, falls into Category 4 (configured products). 

In this presentation, I’ll walk through a project I led earlier this year for an Australian biomedical manufacturer preparing for FDA audit readiness. We used GAMP 5 to assess their SharePoint-based QMS against Part 11 requirements, working through the areas that matter most: how documents move through digitally signed approval workflows; whether signatures are properly bound to the signer’s identity with a recorded meaning and timestamp; how role-based permissions and access inheritance are configured; whether the audit trail captures enough detail to reconstruct who did what and when; and how the overall system validation evidence holds up under regulatory scrutiny, with it, access to a market worth over USD 600 billion a year.

Electronic records requirements are tightening globally. The EU has Annex 11. Australia’s TGA adopted PIC/S GMP Guide PE009-17 in September 2025, which strengthened expectations around data quality and electronic records. If you’re an Australian manufacturer looking to sell into multiple regulated markets, you’re dealing with overlapping requirements from different regulators, and the decisions you make about your cybersecurity architecture — your identity provider, your conditional access policies, your encryption and logging setup — directly affect whether your product is allowed through the door.