An electronic signature under Part 11 has to be uniquely tied to one individual, and it has to include the printed name, the date and time, and the meaning of the signature, approval, review, or authorship. It cannot be reused by, or reassigned to, anyone else.
A biometric signature relies on a physical characteristic, a fingerprint or similar, to confirm identity at the moment of signing. Most software platforms instead use a non biometric approach, password reauthentication at the moment of signing, separate from whatever login session was already active, to confirm it is actually that person taking the action.
A system that treats an earlier login as sufficient proof of identity for a later signature leaves open the possibility that someone else used an unattended, still logged in session to sign on another person's behalf. Requiring a fresh credential at the exact moment of signing closes that gap.
Look for a system where the signature event, the reauthentication, and the record being signed are all captured together, with the meaning of the signature explicit rather than implied. A signature with no stated meaning next to it leaves room for dispute later about what, exactly, was being approved.
A short walkthrough of how GxPForge keeps traceability current as your team works, instead of reconstructing it before a release.
Book a demo