Published 22 October 2026 · 7 minute read
21 CFR Part 11 has a short section that does a lot of work. §11.70 says that electronic signatures must be linked to their respective electronic records so that the signatures cannot be excised, copied or otherwise transferred to falsify an electronic record by ordinary means. EU GMP Annex 11 says the same thing in fewer words: electronic signatures should be permanently linked to their respective record.
For a single document, that is simple to picture. A batch record is not a single document. It is a recipe version, a set of phases, dose actuals from the controller, operator confirmations, material scans, a line clearance, quality results, deviations and a reconciliation. So what exactly is the release signature linked to? This article looks at that question for engineers building or evaluating an electronic batch record (EBR).
Before linking comes manifestation. §11.50 requires a signed electronic record to show:
Meaning is the part most often done badly. A signature that says only "signed" tells an inspector nothing. A useful set of meanings is short and specific: RELEASED, REJECTED, APPROVED, WITHDRAWN, VERIFIED. Each signing act records one, along with the signer's name, role and the server time. Annex 11 adds that the signature should include the time and date it was applied, and should carry the same weight as a handwritten signature within the company.
§11.200 then deals with how the signer is identified. A practical, conservative design asks for the password again at every signing act, rather than relying on a session that may have been left open on a shared terminal.
The easiest way to build release is to store a signature row that points at a batch ID, and set the batch status to "Released". It looks linked. It is not, in the sense §11.70 cares about. If any part of the batch record can still change after that row is written, such as a dose value, a scan or a result, the signature now appears on a record the signer never saw. Nothing in the data shows that the content changed after signing.
The question to ask of any system is simple: if someone edits the record after release, does the signature still look valid? If the answer is yes, the link is to an identifier, not to the record.
A stronger design binds the signature to the content itself. At the moment of signing, the system computes a fingerprint (a cryptographic hash) of the full batch record exactly as it was shown to the signer, and stores that fingerprint inside the signature record.
"The full batch record" needs to mean the full record. It should include the recipe and its version, every phase with its dose actuals and confirmations, the material lots consumed, the reconciliation, linked deviations and holds, quality results, and the scan evidence: the actual barcode scans that put each lot on the line. If scan evidence is left out of the fingerprint, a lot could be swapped in the genealogy without breaking the signature.
With a content fingerprint, any later change to the record produces a different hash. The signature no longer matches the record, and that mismatch is visible and testable. The signature cannot be lifted onto another record either, because it carries the hash of the record it was applied to.
Two rules follow from the fingerprint:
For corrections to recorded consumption, one more field is worth enforcing: the source of truth. A correction that says "changed 2.3 kg to 2.5 kg, source: the PLC's own dose record" is a very different thing from one that says "changed because the operator remembered". The first is evidence. The second is an opinion. See the 0.2 kg your batch record never saw for why the PLC record matters.
Linking proves which record was signed. Segregation of duties proves the signer was the right person. A batch system should enforce, not just document:
These rules should be checked on the server for every signing request. Hiding a button is a convenience, not a control.
Part 11 §11.10(e) and Annex 11 both expect secure, computer-generated audit trails. A hash-chained, append-only trail adds a useful property: each entry includes the hash of the one before it, so removing or altering an entry breaks the chain, and a tamper check can verify it end to end. Deviations, holds, equipment and clearance records and reconciliations are good candidates for this treatment, because they are the records a release decision depends on.
In PulseMQ, every signing act asks for the password again and records the signer's name, role, time and meaning. The batch release signature binds a fingerprint of the full batch record as shown at signing, including scan evidence. Evidence is locked after release. Any correction is a signed record that names the fingerprint of the version it supersedes, and signed corrections to recorded consumption carry a reason and a source of truth. Segregation of duties is enforced on the server. Deviations, holds, equipment and clearance records and reconciliation are kept in append-only, hash-chained records with a tamper check.
These are technical controls designed for Part 11 and Annex 11. Compliance is the regulated company's responsibility for its validated system, and PulseMQ provides a validation document set to support that work. The release rules that sit in front of the signature are described in batch release by exception, and the full flow on the pharmaceutical and GMP overview. For an aerospace view of the same principles, see who can release a nonconforming roll.
Pilot it on one batch line. We connect to your PLC, map its phases and dose actuals to the record, and your own QA signs real dispositions on your own batches.
See the pharma pilotWhat does 21 CFR Part 11 §11.70 require?
Electronic signatures must be linked to their respective electronic records so that they cannot be excised, copied or otherwise transferred to falsify an electronic record by ordinary means. EU GMP Annex 11 similarly expects electronic signatures to be permanently linked to their record.
What must a Part 11 signature show?
Under §11.50, the printed name of the signer, the date and time of signing, and the meaning of the signature, such as review, approval, responsibility or authorship.
How can a signature be linked to a whole batch record?
By computing a fingerprint (cryptographic hash) of the full record as shown at signing, including scan evidence, and storing it in the signature. Any later change produces a different hash, so the mismatch is visible, and corrections become new signed records that name the version they supersede.
Is a system Part 11 compliant if it has these controls?
No system is compliant on its own. Compliance belongs to the regulated company and its validated system. Technical controls such as signature linking support that, alongside procedures and validation.