Verification done for 21 CFR Part 11 Electronic Records

[Bing Ren]

If I'm trying to validate Jira Cloud's issue tracking for compliance of 21 CFR Part 11, any existing reports provided by Atlassian I can refer to?

[Trudy Claspill · Accepted solution]

Hello @Bing Ren 

I asked Chrome Gemini:

"summarize how the Atlassian Jira application complies with 21 CFR Part 11"

This is the response it provided:

Atlassian Jira is not natively compliant with FDA 21 CFR Part 11 out-of-the-box. By default, it lacks immutable audit trails and enforced credential re-authentication during actions. To achieve compliance, teams must adopt specific Atlassian Marketplace apps and implement strict administrative configurations. [1, 2, 3]

How Jira is Adapted for Compliance

To satisfy FDA requirements, organizations must configure Jira to address three main regulatory pillars: [4]

1. Audit Trails and Record Integrity

• The Problem: Default Jira only displays the current state of a ticket. It does not record the exact reasons for a change or provide an immutable log of who edited what.
• The Solution: Organizations use marketplace applications like eSign Electronic Signatures for Jira or Sign for Jira to generate immutable, time-stamped audit trails and track all field differences. [5, 6]

2. Electronic Signatures

• The Problem: A standard Jira transition (like clicking "Approve") does not require a user to re-enter their credentials.
• The Solution: Specialized compliance apps mandate two-factor authentication or enforce the entry of a unique Signing PIN or password when signing off on issues. These apps also freeze issue content to prevent unauthorized edits after approval. [2, 6, 7, 8]

3. Workflow Controls and Access

• The Problem: By default, Jira permits users to delete records.
• The Solution: Jira administrators must use workflow properties to restrict deletion and lock certain statuses (e.g., preventing edits once a ticket is closed or approved). [7]

Necessary Marketplace Add-ons

Teams typically integrate trusted third-party applications from the

Atlassian Marketplace

to automate these controls within their instances. Popular solutions include:

• eSign Electronic Signatures for Jira
• Sign for Jira

Important Caveats

• Software Validation: Using Jira in a regulated environment requires strict internal system validation (IQ/OQ/PQ) by your organization.
• Jira Cloud Limitations: Many life sciences companies prefer self-hosted Jira Data Center over Jira Cloud, as Atlassian Cloud forces frequent automatic updates that can complicate continuous regulatory validation. [1, 4, 11]

If you'd like, I can:

• Compare different Atlassian Marketplace e-signature apps
• Provide a checklist for Jira workflow permissions needed for regulatory control
• Explain how to build an immutable audit trail process [12]

Let me know how you'd like to proceed.

AI responses may include mistakes.

[1] https://www.ketryx.com/blog/21-cfr-part-11-compliance-guide-for-jira-atlassian

[2] https://community.atlassian.com/forums/Confluence-questions/p11-compliant-approvals-in-Confluence-cloud/qaq-p/683109

[3] https://community.atlassian.com/forums/App-Central-articles/21-CFR-11-Compliant-e-Signatures-on-Confluence-Cloud/ba-p/2880062

[4] https://www.linkedin.com/pulse/compliance-jira-core-atlassian-cloud-rina-nir

[5] https://marketplace.atlassian.com/apps/253749785/sign-for-jira

[6] https://jira.atlassian.com/browse/JRACLOUD-69893

[7] https://www.youtube.com/watch?v=IoJCcyWqK1g

[8] https://community.atlassian.com/forums/Confluence-questions/Discussion-on-FDA-Part-11-compliant-Confluence-setups-for/qaq-p/785070

[9] https://titanapps.io/blog/jira-service-management-automation

[10] https://visuresolutions.com/visure-solutions-vs-jira/

[11] https://www.youtube.com/watch?v=fIzhMqC2QVo

[12] https://www.agile-innovations.tech/blog/understanding-part-11-compliance-in-jira-cloud/

[Matteo Gubellini _SoftComply_]

Hello,

I doubt Atlassian have anything of the sort.

Keep an eye on backups of comments and tracking of changes.

Matteo

[Mitchell Thornton - Baseline for Jira]

Hello @Bing Ren 

You can try to do this natively by creating a custom transition in your workflow (Step 1, Step 2) but it's kind of messy and the results aren't great. Plus you'll have to incorporate some type of signature service like eSign which @Trudy Claspill mentioned.

Additionally, you probably want some baked in hashing to ensure requirements / items remain unchanged/can represent them at time of freeze.

Depending on your setup I think there are some options to check out like SoftComply or AppFire's Comola Document Manager

We're actually working on a Forge app specifically for this use case —happy to share more if you're interested.