What does 21 CFR Part 11 readiness mean for Business Central?

Part 11 readiness means the electronic-records and electronic-signature controls are configured, validated, and evidenced so the system can withstand an FDA inspection. For Business Central that is a protected, attributable audit trail (Change Log), Part 11-configured approval workflows for signatures, least-privilege access through Entra ID with no shared logins, and a documented validation package. Business Central is not Part 11 compliant out of the box — readiness is achieved through configuration and validation.

Is Business Central 21 CFR Part 11 compliant out of the box?

No. Part 11 compliance is achieved through how Business Central is configured, controlled, and validated — not by the software alone. The Change Log, approval workflows, and access model are set up for the specific regulated use and then validated with documented evidence.

What is the difference between Part 11 compliance and Part 11 readiness?

Compliance means the controls meet the requirements; readiness means you can also produce the evidence quickly and clearly during an inspection. Many inspection findings arise not because a control was missing but because the evidence could not be retrieved. Readiness covers both the controls and their documentation.

Does 21 CFR Part 11 apply to Business Central in the EU?

Part 11 is FDA regulation. EU manufacturers face the equivalent EU GMP Annex 11, and companies serving the US market — or supplying those who do — typically address both. The underlying electronic-records and signature controls in Business Central largely overlap, so a single configured control set can be evidenced against either framework.

21 CFR Part 11 Readiness for Business Central

By Thomas Brünger, Managing Partner

21-cfr-part-11 · fda · electronic-records · gxpMarch 26, 2026

21 CFR Part 11 readiness for Business Central means the electronic-records and electronic-signature controls are configured, validated, and evidenced so the system can withstand an FDA inspection. Business Central is not Part 11 compliant out of the box — readiness is achieved through configuration and validation, not by the software alone. FDA 21 CFR Part 11 establishes requirements for electronic records and electronic signatures in regulated activities subject to FDA jurisdiction; for pharmaceutical, medical device, and biotech manufacturers using Business Central, Part 11 readiness is a prerequisite for US market access and inspection readiness.

Part 11 applies when electronic records are used to meet FDA requirements that would otherwise be satisfied by paper records. In a Business Central context, this typically includes batch manufacturing records, quality inspection results, deviation and CAPA records, change control approvals, and equipment calibration records.

What Part 11 readiness requires

Readiness is more than having the controls in place — it is being able to show them, and the evidence behind them, on inspection day. Four things carry the readiness of a Business Central system:

A protected, attributable audit trail for all Part 11-relevant data.
Electronic signatures configured to Part 11 semantics.
Least-privilege access with no shared accounts.
A documented validation package that ties the controls to requirements and evidence.

Audit trail configuration

Business Central SaaS is a closed system — access is controlled through Entra ID. The audit trail requirement is operationally most significant. Business Central's Change Log must be configured to capture all Part 11-relevant data entries with user identity, timestamp, and the nature of the change. The Change Log must be protected from deletion and alteration by any user including system administrators.

Electronic signature requirements

Part 11 requires that electronic signatures are unique to one individual and not reused or reassigned. Business Central's approval workflow engine supports compliant controls: each approval step requires authenticated authorisation via Entra ID, and the approval record captures user identity and timestamp. For compliance, workflows must be configured so that re-authentication is required for signature actions, the meaning of the signature is captured, and signed records are protected from subsequent modification.

Practical readiness checklist

System validation with complete documentation package
Change Log configured and protected for all Part 11-relevant tables
Entra ID as identity provider with no shared logins
Approval workflows capturing identity, timestamp, and reason for signature
Current system documentation and SOP references maintained
Personnel training records current and accessible

GxP validation for Business Central — the validation lifecycle (URS, IQ/OQ/PQ) the Part 11 controls are validated against.
21 CFR Part 11 with Microsoft 365 and SharePoint — Part 11 for the documents and quality records held outside the ERP.
Audit readiness for Business Central — producing the evidence quickly during an inspection.
Is Business Central 21 CFR Part 11 compliant? — the short answer.

Download the 21 CFR Part 11 readiness checklist for Business Central as a PDF using the link below.

Frequently asked questions

What does 21 CFR Part 11 readiness mean for Business Central?: Part 11 readiness means the electronic-records and electronic-signature controls are configured, validated, and evidenced so the system can withstand an FDA inspection. For Business Central that is a protected, attributable audit trail (Change Log), Part 11-configured approval workflows for signatures, least-privilege access through Entra ID with no shared logins, and a documented validation package. Business Central is not Part 11 compliant out of the box — readiness is achieved through configuration and validation.
Is Business Central 21 CFR Part 11 compliant out of the box?: No. Part 11 compliance is achieved through how Business Central is configured, controlled, and validated — not by the software alone. The Change Log, approval workflows, and access model are set up for the specific regulated use and then validated with documented evidence.
What is the difference between Part 11 compliance and Part 11 readiness?: Compliance means the controls meet the requirements; readiness means you can also produce the evidence quickly and clearly during an inspection. Many inspection findings arise not because a control was missing but because the evidence could not be retrieved. Readiness covers both the controls and their documentation.
Does 21 CFR Part 11 apply to Business Central in the EU?: Part 11 is FDA regulation. EU manufacturers face the equivalent EU GMP Annex 11, and companies serving the US market — or supplying those who do — typically address both. The underlying electronic-records and signature controls in Business Central largely overlap, so a single configured control set can be evidenced against either framework.

Download Guide