en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en et en en en en de en en en en de en en en fr fr en en en en en en en en en en en pt en en en en en en en en en en en en en en
You'd like to find out more about the range of services offered by the msg group?  Then visit the websites of msg and its group companies.
Select a company... msg-Gruppe BELTIOS GmbH CONPLAN GmbH finnova AG Bankware innovas GmbH Legacy Portfolio Partners GmbH m3 management consulting GmbH minnosphere GmbH msg advisors msg communications GmbH msg compliance GmbH msg DAVID GmbH msgforbanking msg GillardonBSM AG msg global solutions ag msg industry advisors ag msg life ag msg PLAUT msg services GmbH msg systems ag msg systems Österreich msg systems Romania msg systems Schweiz Nexontis Consulting GmbH Optravis LLC PiAL Consult GmbH Prevo-System AG Softproviding AG
As secure as a fingerprint
Electronic signatures in the pharmaceutical and medical devices sector
In many companies, handwritten signatures verify that everything is conducted according to regulations in essential work steps. This, for example, is how employees vouch for the creation and release of work and process instructions. The procedure is also widely accepted for the release of test specifications, manufacturing reports after production or of raw materials, bulk or finished goods in the laboratory.
A digital signature can make these and many other business processes even more secure and efficient. On the one hand, they can be used to clearly allocate who, for example, created and edited a document. Unlike handwritten signatures ("wet signature"), the digital version can neither be copied from one document to another, nor can the signed document be changed or forged unnoticed. On the other hand, the signature process is now faster because you can work from any location and no longer need a printer or scanner.
If one decides to use an electronic signature instead of a handwritten signature in a regulated environment, the question of which regulatory requirements need to be considered arises immediately, in addition to the technical implementation. The following chapters provide an overview of the essential legal requirements, explain the concept of electronic signatures in the context of the pharmaceutical and MedTech industry, and specify recommendations for their use.
Legal framework: eIDAS as a pan-European guideline
In addition, eIDAS defines the European framework requirements for electronic signatures in the GxP environment. In the pharmaceutical industry, an electronic signature may be necessary for digital legal transactions, e.g., to comply with the German Packaging Act (VerpackG) or contractual written requirements for quality agreements.
However, eIDAS neither requires the use of electronic signatures, nor does it specify which signatures must be used. It follows the approach of the “Code of Federal Regulations” (CFR), which in 21 CFR Part 11 defines the regulations of the United States Food and Drug Administration (FDA) on electronic records and electronic signatures.
There, too, the use of electronic signatures is not required, only the requirements for these are specified. Pharmaceutical manufacturers should pay particular attention to 21 CFR Part 211. It defines in which cases (purpose!) a signature is required at all. For medical devices approved in the USA, 21 CFR Part 820 specifies when a signature is required. Only in these cases, the requirements of 21 CFR Part 11 apply. Thus, it is therefore directed to medical device manufacturers.
Types of signature variants
An electronic signature (or electronic signature seal) is a general term for an electronic process used to express acceptance of agreement to a contract or form. A digital signature is a special type of electronic signature. The eIDAS differentiates between “simple” electronic, advanced electronic and qualified electronic signatures. 21 CFR Part 11 distinguishes between an "electronic signature" and a "digital signature".
Figure 1: eIDAS and 21 CRF Part 11 © msg industry advisors
According to elDAS, these are defined as follows:
data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign.
No requirements for the technical implementation are defined for basic electronic signature.
These are special types of electronic signatures that meet the highest legal requirements and the identity of the signer to be assigned without any doubt. For this purpose and according to elDAS Article 26, this type
It must be uniquely linked to the signatory.
It must be capable of identifying the signatory.
It must be created using electronic signature creation data that the signatory can, with a high level of confidence, use under his sole control.
It must be linked to the data signed therewith in such a way that any subsequent change in the data is detectable.
From a technical point of view, advanced signatures are equivalent to software certificates. Signature cards with a certificate and a card reader (secure signature creation device = SSCD) are not required to create advanced electronic signatures.
This is the only type of electronic signature that, according to eIDAS, has the same legal value as a handwritten signature. According to eIDAS, it must fulfil all the requirements of advanced electronic signatures as well as the following criteriah
be based on a qualified certificate that is valid at the time the signature is created, and
have been produced with a secure device for creating signatures.
Signers must use a certificate-based digital ID for qualified signatures. This is issued by accredited EU trust services – in Germany, for example, by Deutsche Telekom AG and Deutsche Post – and is stored on a device suitable for creating qualified signatures. This includes USB tokens, chip cards or one-time-use passwords transmitted via smartphones.
The precise requirements for the trust service provider and the qualified certificates are also described in eIDAS. An up-to-date overview of the certified EU trust services can be found in the publicly accessible EU Trust List (EUTL).
Guidelines for the use of electronic signatures
The guidelines for the use of certain electronic signatures derive from other legal provisions other than the regulations already mentioned. The following sources are relevant here:
Article 126 of the German Civil Code (BGB) defines the following requirements:
(1) “If written form is prescribed by statute, the document must be signed by the issuer with his name in his own hand, or by his notarially certified initials
(3) “Written form may be replaced by electronic form, unless the statute leads to a different conclusion. If the “written form” is required by law and an electronic format is used, then qualified signatures must always be used. The written form is the higher-value form compared to the text form. The textual form is a legible, permanent form of documentation that is valid without a signature. It is often used for pure communications.
German and European GxP regulations
In the German Medicines Act (AMG), only one section states that a signature is required, namely Article 24 on expert opinions. No obligation to use the signatures defined in eIDAS can be derived from the Ordinance/Decree for the Manufacture of Medicinal Products and Active Pharmaceutical Ingredients (AMWHV) and the EU-GMP guidelines. Only in the Central Office of the Federal States for Health Protection Regarding Drugs and Medical Products (ZLG) vote V1100302 is an advanced electronic signature according to elDAS Article 26 recommended for the manufacturing, test reports and the confirmation of release.
The FDA takes a risk-based approach to the question of which signatures are “sufficient”. To this end, a distinction is made between “closed systems” and “open systems”. The various requirements for the systems are specified in 21 CFR Parts 11.10. and 11.30.
A system that transmits data via the internet, for example, is regarded as an open system. The risk of external manipulation is higher in open systems, therefore appropriate extended measures are required. The protection with a "digital signature" prevents abuse here. Advanced electronic signatures according to eIDAS fulfil this requirement.
Management tips: introducing electronic signatures correctly
Check the legal basis that must be taken into account in Germany/your country, as well as the regulatory GxP requirements for documents you want to sign electronically. The stipulation for signatures and, if necessary, the requirement to use them can be found, for example, in the AMWHV, the EU GMP guidelines, 21 CFR Part 210/211, the GCP-VO, the MDR or in the ChemG.
In the next step, determine the type of signature and the technical solution, i.e., technical measures.
Clarify to what extent the technical solutions are accepted by the authorities and whether internal organizational procedures need to be regulated. Qualified electronic signatures may already be used in your company, for example, to comply with the German Packaging Act (VerpackG).
In addition, companies in the regulated environment should note that in ERP systems, MES or LIMS signatures are often linked to workflow or business processes, but in document management systems they are more often linked to the document itself. Here, you should implement the relevant process in the computer system yourself – and ensure that electronic signatures continue to run in a validated environment and that data integrity requirements are met.
Dr. Heike Sütterlin | Senior Consultant
Dr. Heike Sütterlin provides quality management consulting for companies in the pharmaceutical and medical device industries. Her expertise also includes the subjects of laboratory digitalization, data integrity and computer systems validation.
msg industry advisors ag
+49 89 96 10 11 300
+49 89 96 10 11 040
Form Download PDF Modal Link (EN)
Ergon Design GmbH becomes part of the msg group
Secure digital identities with msg mySaveID GmbH – a new msg group company
msg acquires Bern-based ICT consulting company baeriswyl tschanz & partner ag
msg is now a member of BITKOM
Merge of msg services and msg treorbis as msg services GmbH
msg is an independent international group of companies with autonomous regional companies and subsidiaries and over 9,000 employees.
The msg group is active in over 25 countries in the banking, insurance, automotive, food, life science & healthcare, public sector, telecommunications, travel & logistics and utilities sectors. msg also develops integrated software solutions and advises its clients in all aspects of information technology.
© 2022 msg industry advisors ag
The msg industry advisors ag uses cookies to provide an optimal website experience that is tailored to your specific needs. These includes cookies that are necessary for ensuring the smooth operation and the security of our web pages, as well as those used for anonymous statistical purposes, to help us reach our commercial business goals, or to display personalized content. You have the right to choose which categories you wish to allow. Please note that your decisions may affect which page functions are available while using our site. Further information can be found in our data protection information.
Required cookies are used to ensure the smooth operation of our web pages and to make them user friendly. They also enable security-related functions. Furthermore, these types of cookies help us identify whether you would like to remain logged in under your profile, thereby allowing us to make our services available to you even faster the next time you visit our site.
In order to ensure continuous improvement of our content, structure and our website in general, we record anonymized data for statistical purposes. With your consent, data on your user behavior will be transmitted anonymously to Google Analytics. We use these cookies, for example, to determine how many times a specific page is accessed or the effect of certain pages of our web presence; we then use that information to optimize our site.