Digital Lab Notebooks vs. Paper Records: What 21 CFR Part 11 Requires and Why ISO 17025 Labs Are Finally Making the Switch

Data integrity deficiencies have ranked among the top five FDA 483 observations issued to dietary supplement and food manufacturing facilities for several consecutive years running. A significant share of those findings trace back to one place: paper records that were amended, backdated, corrected without proper protocol, or simply illegible. The fix isn’t complicated in concept. But the regulatory path from paper to digital is more layered than most labs expect — and the wrong ELN implementation can trade one compliance problem for a different one.

Here’s what the relevant frameworks actually require, where paper systems reliably break down, and what a credible transition looks like in practice.

What 21 CFR Part 11 Actually Requires

21 CFR Part 11 — Electronic Records; Electronic Signatures — was finalized by FDA in 1997 and remains the governing framework for any electronic record used as a substitute for a paper equivalent in an FDA-regulated context. For labs testing dietary supplements, foods, or cosmetics under cGMP requirements (21 CFR Parts 111 and 117), that scope covers raw data, instrument printouts, bench calculations, and final test results.

The regulation establishes two categories of controls: system-level and procedural. On the system side, you need closed systems with access controls, tamper-evident audit trails that timestamp every record creation, modification, and deletion, and the ability to generate complete, accurate copies of records for inspection purposes. On the procedural side, you need written policies governing who may apply an electronic signature and what constitutes a valid signature event.

The part that surprises many labs: Part 11 doesn’t require you to use an electronic lab notebook. It says that if you use electronic records in place of paper ones, those records must meet specific technical and procedural standards. The validation burden is entirely yours. FDA won’t validate the system for you, and “the vendor said it was compliant” has never been an acceptable defense in a 483 response.

How ISO 17025:2017 Frames Record Integrity

ISO/IEC 17025:2017 — the international standard governing the technical competence of testing and calibration laboratories — addresses records in Section 8.4. The language is deliberately non-prescriptive. It requires that records be legible, stored and retained in a manner that prevents deterioration or loss, and accessible only to authorized personnel within a defined retention period.

It doesn’t mandate paper. It doesn’t mandate an ELN. It mandates controlled, integrity-assured, retrievable records — and leaves the implementation to the lab.

For accredited labs certified by bodies like A2LA (American Association for Laboratory Accreditation) or NVLAP (National Voluntary Laboratory Accreditation Program), assessors have increasingly flagged paper-based systems during surveillance assessments — not because paper violates the standard, but because the controls required to keep paper records genuinely integrity-compliant are expensive to maintain and easy to fail under volume pressure. Correction procedures alone (single-line strikethrough, dated initials, stated reason, no white-out) require consistent retraining and monitoring that most labs underinvest in after the initial implementation.

The data suggests this gap between written procedure and actual practice is where most paper-related findings originate.

Where Paper Records Break Down in Practice

Let’s be specific, because this is where theory becomes operational.

Paper records fail in four predictable ways in active lab environments.

Contemporaneousness. The ALCOA+ framework — Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available — requires records to be captured at the time of the activity. Under throughput pressure, technicians commonly batch-document at end of shift or end of run. Auditors notice when a handwritten timestamp doesn’t reconcile with an instrument’s internal electronic log. That’s an automatic flag, and it’s not a gray area.

Correction integrity. FDA’s expectation is strict: single-line strikethrough, initials, date, brief reason. No overwriting. No white-out. In over a decade of managing lab operations, I haven’t encountered a facility that arrived at a fresh audit with zero paper correction violations. The failure rate isn’t about careless technicians — it’s about human writing behavior conflicting with a protocol designed for accountability, not efficiency.

Retrievability under pressure. ISO 17025:2017 requires records to be retrievable within a defined timeframe. When a client needs raw data from 22 months ago and it lives in a physical binder in off-site storage, the retrieval clock works against you in ways it wouldn’t with indexed, searchable digital records.

Disaster resilience. Paper records are destroyed in fires, floods, and building evacuations. There is no native redundancy. For labs operating in Southern California — where wildfire evacuations and seismic events are not hypothetical — the absence of an off-site backup strategy for paper records is a real business continuity exposure that rarely gets priced into the “cost of staying on paper.”

What a Real Part 11 Validation Actually Involves

This is where labs reasonably hesitate, and it’s the legitimate reason many ISO 17025 certified labs are still on paper in 2026.

Validating an ELN system isn’t buying the software and turning it on. A defensible Part 11 validation requires:

• A formal risk assessment mapping each electronic record to its paper equivalent and the applicable regulatory requirement
• Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) — the standard GAMP 5 validation lifecycle — with documented test scripts and results
• Explicit testing of audit trail functionality: deliberate record modification followed by verification that the trail captures the original value, the changed value, the user identity, and the timestamp
• Access control validation confirming that role-based permissions work as designed and that no user role can overwrite data without leaving a trace
• A documented change control and periodic review protocol, because validation isn’t a one-time event — software updates trigger revalidation scope assessments

For a mid-sized testing lab deploying a platform like LabArchives, Benchling, or LabVantage, a realistic first-time validation effort runs 120–200 documented hours depending on the scope of assay types and instrument interfaces involved. That’s not trivial, and it shouldn’t be minimized when making the business case internally. But compare it against the cost of a data integrity-related Warning Letter, a subsequent CAPA, and the reputational impact with clients who rely on your ISO 17025 accreditation — and the math changes.

What to Actually Look for in an ELN Before You Buy

Not all ELN platforms are designed for the regulatory environment that testing labs inhabit. These are the criteria that matter operationally:

An immutable, native audit trail. The audit trail must be technically impossible to delete or modify — including by administrator accounts. Ask the vendor to demonstrate this directly in a live demo, not in a slide deck. If they can’t show you a deliberate modification and its unalterable trail record in under five minutes, keep evaluating.

Substantiated Part 11 compliance claims. Many vendors advertise “21 CFR Part 11 compliant” in their materials. What you want is vendor documentation of specific functionality: electronic signature workflows, closed-system access controls, and exportable audit trail reports in human-readable format. “Ready” without documented evidence is a yellow flag.

Instrument data integration. If your HPLC, ICP-MS, or UV-Vis instrumentation can push data directly into the ELN via API or middleware integration, you eliminate the single highest-risk transcription error point in most lab workflows. This is the highest-value feature for an analytical chemistry or microbiology testing environment, and it’s worth prioritizing over interface aesthetics.

Data portability and retention terms. Records under 21 CFR Part 111 cGMP requirements for dietary supplements must be retained for 2 years minimum — but many labs hold records for 7 years as a practical safeguard. Verify the vendor’s data export policy, file format standards, and what happens to your records if the company is acquired or the product is discontinued.

A Practical Path Forward for Smaller Labs

Many ISO 17025 accredited labs testing supplements, cosmetics, or foods are 5–30 person operations running HPLC, ICP-MS, and microbiological panels. A full enterprise ELN deployment is often more infrastructure than the workload justifies. A validated hybrid approach — ELN for raw data capture, bench calculations, and instrument integration, combined with validated PDF archiving for final reports — can satisfy both ISO 17025 Section 8.4 and 21 CFR Part 11 requirements at a fraction of the full-deployment validation cost.

The system doesn’t matter as much as what the system can demonstrate on demand: that a record was created by the right person, at the right time, without unauthorized modification. Paper can satisfy that in theory. In practice, under consistent audit scrutiny, most labs find it can’t — not at scale, and not reliably.

If you’re planning a transition, start with a data integrity risk assessment scoped to your highest-volume, highest-risk assays first. Identify where your current records are most vulnerable to ALCOA+ failures. Build your ELN validation around those workflows. Expand the footprint from there, one controlled phase at a time.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• Software Validation, GAMP 5, and 21 CFR Part 11 in Regulated Lab Environments — Aurora TIC covers the full validation lifecycle for software systems used in FDA-regulated settings, including IQ/OQ/PQ documentation and audit readiness.
• COA Integrity and Supplier Documentation Standards for Raw Material Testing — Ayah Labs explains what certificates of analysis and supplier records need to demonstrate before raw materials are accepted into a testing workflow.