Disclosure: I'm the developer of Sign for Jira, one of the apps mentioned below. The first half of this article is about what Jira does without any app.
Pharma, biotech and medtech teams run change requests, CAPAs, deviations and design reviews in Jira. Sooner or later QA asks: "Can we sign these in Jira, or do we print them and sign on paper?" The answer depends on what your procedures require. Here is what Jira Cloud gives you natively and where FDA 21 CFR Part 11 or EU GMP Annex 11 asks for more.
What Jira does natively
- Work item history. Every field change is recorded with who made it and when. That gives you an audit trail of the record itself.
- Audit log. Site admins see configuration changes: workflows, permissions, fields.
- Approvals. Jira Service Management has approval steps on every plan. Since February 2026, Jira Premium and Enterprise also have approval steps in workflows, in both company-managed and team-managed spaces. Each decision is logged on the work item with who approved or rejected it and when, and it can be searched with JQL.
For many teams that is enough. If your procedures don't require an electronic signature on a record, a logged approval plus history may do the job.
Where it stops for Part 11
When a predicate rule or your own SOP requires a signature, Part 11 asks for things a logged approval doesn't provide:
Part 11 asks for | Native Jira |
|---|
The meaning of the signature (approval, review, responsibility) shown with it (§11.50) | An approval records approve or reject, not a meaning you define |
Two distinct identification components when signing (§11.200) | The approver is already logged in and clicks Approve; nothing is asked again at signing |
The signature linked to the record, so it can't be moved or reused (§11.70) | History lets you reconstruct what the record looked like, but nothing flags that a signed record changed afterwards |
Controls on the credentials used to sign: uniqueness, periodic change, lockout (§11.300) | Your identity provider's policies cover the login, not a separate signing credential |
None of this is a criticism of Jira's approvals. They were built for workflow decisions, not regulated signatures.
Closing the gap with an app
This is the gap Sign for Jira fills. Here is how it works, mapped to the table above:
- Meaning (§11.50). The space admin defines meanings such as Approval or QC Review, each with a statement. The signer picks one, and the meaning and statement are stored with the signature, together with an optional consent message.
- Two components (§11.200). Each signature needs a personal 6-digit Signing PIN on top of the Atlassian login. PINs expire after 30 days, lock after 5 wrong attempts, and are stored only as hashes, so admins can't read them either.
- Link to the record (§11.70). The space admin chooses which fields a signature covers. Their values are hashed when you sign, and the signature shows Invalid if any of them changes later. Signatures can't be edited or deleted; to sign a changed record, you sign again.
- In the workflow. A condition or validator can hide or block a transition until the work item is signed, or until the person moving it has signed. Since version 5.0, a Jira Automation action checks whether each signature is still valid and returns the result as smart values, for example to notify QA when a signed record changes. JQL fields and a read-only REST API expose the same data.
- Evidence. Audit logs of signatures, PIN events and settings changes. Export to CSV or JSON, or print.
- Where the data lives. The app runs entirely on Atlassian Forge and has the "Runs on Atlassian" badge, so no data leaves Atlassian. That shortens the vendor part of your validation.
Whatever tool you use
No app makes a process Part 11 compliant on its own. You still validate the system for your intended use and write the procedures around it: who may sign what, PIN handling, training, record retention. Atlassian's GxP resources cover the platform side.
If you sign records in Jira today, with an app or on paper, I'd like to hear in the comments what your auditors asked to see.
Sign for Jira on the Marketplace (free for up to 10 users)
Sources for the native part: Approvals that keep work moving (Atlassian, 20 Feb 2026). Part 11 sections cited: 11.50, 11.70, 11.200 and 11.300.
Drafted with the help of AI
