Which Combination-Product 4.4 Path Still Applies After QMSR?

Mark the facility and the 4.4 path before you copy an ISO 13485 clause list

When the United States Food and Drug Administration (FDA) implemented the Quality Management System Regulation (QMSR) on February 2, 2026, medical device quality systems underwent their most significant structural overhaul in three decades. By incorporating ISO 13485:2016 by reference into 21 CFR Part 820, the agency aligned device manufacturing expectations with international standards. For manufacturers of drug-device and biologic-device combination products, the remaining question is which current good manufacturing practice (CGMP) identity 21 CFR 4.4 still requires under 21 CFR Part 4 Subpart A.

Two errors still circulate: treating an ISO 13485 registrar certificate as the 4.4 showing, and citing the 2017 guidance's 21 CFR 820.20, 820.30, 820.50, 820.100, 820.170, and 820.200 list as current 4.4(b)(1). Neither matches the regulation now in force. Compliance under 21 CFR 4.4 is a facility-specific identity determination: mark product type and facility status before copying any clause list.

Treat 21 CFR 4.4 as a one-facility worksheet rather than a copied ISO 13485 clause list or a corporate QMS label. This article establishes that worksheet for a single manufacturing plant. It is not individual legal or clinical advice, does not replace the comprehensive combination products regulatory pathway guide, does not replicate a device-only QMSR transition gap analysis, and does not address postmarketing safety reporting rules under 21 CFR Part 4 Subpart B.

flowchart TD
    A["Step 1: Product Combination Type"] -->|"21 CFR 3.2(e)(1) Single-Entity or (e)(2) Co-Packaged"| B["Step 2: Facility Co-Location Status"]
    A -->|"21 CFR 3.2(e)(3)/(4) Cross-Labeled"| X["Ineligible for 4.4 Streamlining<br/>Follow Full Independent CGMPs"]
    B -->|"4.4(c) Separate Facility<br/>(One Constituent Type Only)"| Y["Comply with Full Constituent CGMPs<br/>(No Streamlining Allowed)"]
    B -->|"4.4(d) Same Facility<br/>(Two or More Constituent Types Present)"| C{"Step 3: 21 CFR 4.4(a) Election"}
    C -->|"4.4(a)(1)"| D["Dual Compliance<br/>Each applicable 4.3 CGMP set"]
    C -->|"4.4(a)(2)"| E{"Step 4: Which operating system has been shown"}
    E -->|"Drug CGMP or medical-gas CGMP base"| F["21 CFR 4.4(b)(1)<br/>Specified ISO 13485 clauses plus 820.10/820.35"]
    E -->|"QMSR base, drug not a medical gas"| G["21 CFR 4.4(b)(2)<br/>Specified Part 211 provisions"]

Is this combination even eligible for 4.4 streamlining?

Before analyzing specific quality system clauses, an organization must verify whether the product meets the threshold definition that unlocks 21 CFR 4.4. Under 21 CFR 4.1, the scope of Subpart A is explicitly restricted: it provides a regulatory framework for designing and implementing CGMP operating systems at facilities that manufacture co-packaged or single-entity combination products.

The definitions in 21 CFR 3.2(e) govern this classification:

• Single-Entity Combination Products (21 CFR 3.2(e)(1)): Products comprised of two or more regulated components (such as drug and device, biologic and device, or drug and biologic) that are physically, chemically, or otherwise combined or mixed and produced as a single entity. Canonical examples include prefilled syringes, auto-injectors with integrated prefilled glass cartridges, drug-eluting vascular stents, transdermal delivery patches with integrated active pharmaceutical reservoirs, and antimicrobial-impregnated surgical meshes. These products fall squarely within the 4.4 streamlining scope.

• Co-Packaged Combination Products (21 CFR 3.2(e)(2)): Two or more separate products packaged together in a single package or as a unit and comprised of drug and device products, device and biological products, or biological and drug products. Illustrative configurations include a surgical tray that packages a disposable scalpel with a topical anesthetic vial, or an empty reconstitution syringe packaged with a lyophilized drug vial. These co-packaged configurations are eligible for 4.4 streamlining at the co-packaging facility once 4.4(d) is met.

• Cross-Labeled Combination Products (21 CFR 3.2(e)(3) and (e)(4)): These are separately packaged products intended for use only with a specified other product. 21 CFR 3.2(e)(3) covers a product whose investigational plan or proposed labeling is for use only with an approved, individually specified product, where approval would require a labeling change to that approved product. 21 CFR 3.2(e)(4) covers an investigational product whose proposed labeling is for use only with another individually specified investigational product. Neither identity is a 4.4 streamlining candidate.

The regulatory consequence for cross-labeled combinations is stark and absolute: cross-labeled combinations stay entirely off the 21 CFR 4.4 streamlining worksheet. As confirmed in the preamble to the 2013 Part 4 final rule (78 FR 4307) and reaffirmed in FDA guidance, because cross-labeled constituent parts are manufactured, packaged, and distributed as independent commercial articles, each constituent part must comply with the full CGMP regulations applicable to that product type as if it were not part of a combination product. A medical device manufacturing plant fabricating a dedicated nebulizer intended for cross-labeled use with an inhalation drug cannot invoke 4.4(b) streamlining; it must maintain a complete QMSR operating system covering all applicable requirements of ISO 13485:2016 and 21 CFR Part 820.

Which 4.3 CGMP sets attach before any streamlining choice?

Once product eligibility is confirmed under 21 CFR 4.1 and 3.2(e), the quality team must inventory which CGMP regimes legally attach to the combination product. Under 21 CFR 4.3, which CGMP sets attach is determined by constituent-part type. Streamlining does not delete those sets; it changes how a same-facility operating system may demonstrate them.

Section 4.3 establishes five specific CGMP attachments:

• 21 CFR Parts 210 and 211 (Drug CGMP): Applies to any combination product that includes a drug constituent part other than a medical gas. This encompasses active pharmaceutical ingredients, finished dosage forms, liquid injectables, ointments, and transdermal matrices.

• 21 CFR Part 820 (QMSR): Applies to any combination product that includes a medical device constituent part. Under 21 CFR 4.2, the regulation explicitly defines 'QMSR' as the requirements under Part 820. Furthermore, Section 4.2 codifies a vital legal principle: a device that is a constituent part of a combination product is considered a finished device within the meaning of the QMSR. Even if a device constituent is molded, stamped, or subassembled at a facility prior to drug filling, it is legally regulated as a finished medical device.

• 21 CFR Parts 600 through 680 (Biological Products): Applies to a combination product that includes a biological-product constituent, to the extent those manufacturing requirements would apply if that constituent were not part of a combination product.

• 21 CFR Part 1271 (Human Cells, Tissues, and Cellular and Tissue-Based Products): Applies when the combination product includes human cells or cellular matrices (HCT/Ps), mandating donor screening, donor testing, and current good tissue practice (CGTP).

• 21 CFR Part 213 (Medical Gas CGMP): Applies when the drug constituent part is a medical gas. The June 2024 medical-gas final rule (89 FR 51738) added part 213 and the 4.4(b)(3) overlay.

Additionally, quality teams must understand how 21 CFR 4.2 defines the term manufacture. In combination product regulation, manufacture is not limited to commercial assembly line operations. It encompasses designing, fabricating, assembling, filling, processing, testing, labeling, packaging, repackaging, holding, and storage. An off-site warehouse holding filled combination product autoinjectors prior to release is engaged in manufacturing and must comply with the holding and distribution provisions of the applicable CGMP framework.

4.4(c) and 4.4(d): streamlining starts at the same facility, not at corporate HQ

Streamlining is a facility identity, not a corporate-system identity. Do not treat a 4.4(c) constituent-part site as already streamlined because another site in the network uses 4.4(b). This assumption violates 21 CFR 4.4(c) and 4.4(d).

Under 21 CFR 4.4(c), during any period in which the manufacture of a constituent part occurs at a separate facility from the other constituent part(s) of a single-entity or co-packaged combination product, that facility's operating system must be shown to comply with all CGMP requirements applicable to that specific type of constituent part. The 2013 preamble (78 FR 4307) explains that if a facility manufactures only one type of constituent part of a co-packaged or single-entity combination, it must comply with the CGMPs for that type of product.

Conversely, 21 CFR 4.4(d) governs the point in time and physical location where a streamlined operating system may legally commence. Section 4.4(d) establishes that application of a 4.4(b) streamlined operating system may begin only when:

1. Arrival Condition: Two or more types of constituent parts have physically arrived at the same facility; or

2. Co-Manufacturing Condition: The manufacture of two or more types of constituent parts is proceeding at the same facility.

4.4(a) still lets you show every CGMP set, or elect 4.4(b)

When a manufacturing facility satisfies the co-location requirements of 21 CFR 4.4(d), management must establish its regulatory compliance strategy under 21 CFR 4.4(a). The regulation provides two distinct, fully recognized compliance pathways:

• 21 CFR 4.4(a)(1) — Dual Compliance: The manufacturer demonstrates that the facility's operating system complies with the specifics of each current good manufacturing practice regulation listed under 21 CFR 4.3 as they apply to each constituent part. That showing is each applicable 4.3 set. It is not a 211-plus-820 pair that silently drops parts 600 through 680, part 1271, or part 213 when those constituent types are included.

• 21 CFR 4.4(a)(2) — Streamlined Compliance: The manufacturer elects to implement a streamlined operating system under 21 CFR 4.4(b), using one established CGMP framework as the foundational base and adding specifically enumerated provisions from the secondary framework.

A common misconception that emerged following the publication of the QMSR final rule was that dual compliance had been phased out or that manufacturers were mandated to convert all combination product facilities to a streamlined QMSR model. This is incorrect. Dual compliance under 4.4(a)(1) remains available after 2 February 2026. Streamlining is an election, not a mandatory QMSR conversion.

The Jurisdictional Assignment Fallacy: Lead Center vs. Operating System Base

Perhaps the most damaging error promoted in commercial consulting literature is the claim that a combination product's lead center assignment or Primary Mode of Action (PMOA) dictates its 4.4(b) streamlining path. Industry commentary frequently asserts that 'drug-led' combinations assigned to the Center for Drug Evaluation and Research (CDER) must use 4.4(b)(1) (drug CGMP base), while 'device-led' combinations assigned to the Center for Devices and Radiological Health (CDRH) must use 4.4(b)(2) (device QMSR base).

The text of 21 CFR 4.4 contains no such restriction. The regulatory standard is based strictly on which operating system the facility has been shown to satisfy, not on premarket product jurisdiction:

• A CDRH-Cleared Device-Led Product in a Drug Facility: As a hypothetical illustration, consider an iontophoresis transdermal drug delivery system where CDRH has primary jurisdiction under a 510(k) clearance. If commercial co-packaging or assembly occurs at a plant whose operating system has been shown to comply with the drug CGMPs, that facility may use 4.4(b)(1): drug CGMP as the base, plus the specified ISO 13485 clauses and 820.10/820.35 provisions.

• A CDER-Approved Drug-Led Product in a Device Facility: Conversely, as a hypothetical illustration, consider an NDA-approved prefilled inhalation device where CDER holds premarket jurisdiction. If final assembly occurs at a facility whose operating system has been shown to comply with the QMSR for devices, and the drug constituent is not a medical gas, that facility may use 4.4(b)(2): QMSR as the base, plus the eight specified part 211 provisions.

If drug CGMP or medical-gas CGMP is the base: the current 4.4(b)(1) ISO 13485 clauses

When a manufacturing facility elects to operate under 21 CFR 4.4(b)(1), it uses an operating system demonstrated to comply with drug CGMP requirements (21 CFR Parts 210 and 211) or medical-gas CGMP requirements (21 CFR Part 213) as its foundation. 4.4(b)(1) also uses the definitions in Clause 3 of ISO 9000:2015. To satisfy the listed device showing, the facility must demonstrate the specified clauses of ISO 13485:2016 and designated provisions of 21 CFR Part 820.

The text of 4.4(b)(1) states: upon demonstrating compliance with the drug CGMP requirements and these specified provisions, no additional showing of compliance with the QMSR requirements for devices is required. That is a limit on the additional QMSR showing, not a silent restoration of every unlisted ISO 13485 clause, and not a statement about what an internal auditor may choose to implement beyond the regulation.

The QMSR final rule (89 FR 7496 at 7522) codified the current 4.4(b)(1) list across six distinct clauses, replacing the former 1996 Quality System Regulation section numbers:

The Explicit Risk Management Mandate in Design Controls

Regulatory professionals must pay meticulous attention to the precise phrasing added to 21 CFR 4.4(b)(1)(ii). The regulation does not merely cite ISO 13485 Clause 7.3; it contains an explicit mandatory qualification: Clause 7.3 and its subclauses, with documented risk-management processes in product realization and retained risk-management records.

The QMSR final rule added that risk-management sentence to 4.4(b)(1)(ii). The showing is documented risk-management processes in product realization and retained records — not a named edition of ISO 14971. Related reading on benefit-risk and ISO 14971 is a separate article; it is not an extra 4.4(b)(1)(ii) clause.

What 820.10 and 820.35 still add on top of those ISO clauses

A frequent compliance pitfall under 21 CFR 4.4(b)(1) is failing to implement the FDA-specific additions codified in 21 CFR Part 820. While ISO 13485:2016 supplies the core structural clauses, the QMSR incorporates explicit regulatory bridges that are unique to United States law. Specifically, 21 CFR 820.10 and 21 CFR 820.35 add FDA-specific duties on top of the listed ISO 13485 clauses.

The Three Subsections of 21 CFR 820.10

Section 820.10 is cited alongside ISO 13485 Clauses 4.1, 5, and 6.1 in 4.4(b)(1)(i). Quality systems must address each of its three codified subsections:

• 820.10(a) — Documented Quality Management System: Requires manufacturers to document a quality management system that complies with the applicable requirements of ISO 13485 and other applicable requirements of Part 820. Critical boundary: 820.10(a) is not a back-door mechanism that silently reinstates every unlisted ISO 13485 clause. 4.4(b)(1) explicitly guarantees that once the specified clauses are shown, no additional showing of QMSR compliance is required. Section 820.10(a) simply mandates that the quality manual and core SOPs formally document how the manufacturer satisfies the applicable showing.

• 820.10(b) — Applicable regulatory requirements: Section 820.10(b) ties listed ISO 13485 clauses to other Title 21 requirements, as appropriate:

  • Unique Device Identification (UDI): For ISO 13485 Clause 7.5.8 (identification), document a unique-device-identification system in accordance with 21 CFR part 830.

  • Medical Device Tracking: For ISO 13485 Clause 7.5.9.1 (traceability—general), document traceability procedures in accordance with 21 CFR part 821, if applicable.

  • Medical Device Reporting (MDR): For ISO 13485 Clause 8.2.3 (reporting to regulatory authorities), notify FDA of complaints that meet 21 CFR part 803 reporting criteria.

  • Corrections and Removals: For ISO 13485 Clauses 7.2.3, 8.2.3, and 8.3.3, handle advisory notices in accordance with 21 CFR part 806.

• 820.10(c) — Design and Development Device Classification: Section 820.10(c) requires Clause 7.3 and its subclauses for class II devices, class III devices, class I devices automated with computer software, and the class I devices listed in 820.10(c) table 1. Do not invent a QMSR-era rule that every combination-product device constituent now owes a full design-and-development file. Mark the 820.10(c) class identity of the device constituent on the worksheet.

21 CFR 820.35(a): Mandatory FDA Complaint Record Fields

Under 21 CFR 4.4(b)(1)(iv), ISO 13485 Clause 8.2.2 (complaint handling) must be supplemented with the record requirements of 21 CFR 820.35(a). While ISO 13485 requires organizations to maintain records of complaint investigations, it does not mandate specific data fields. Section 820.35(a) closes this gap by establishing rigid recordkeeping requirements for complaints involving possible failure of a device, labeling, or packaging to meet specifications.

For any complaint that is reportable under 21 CFR Part 803, any complaint that the manufacturer determines must be investigated under its procedures, and any complaint that the manufacturer investigates regardless of threshold, the record must contain the following mandatory fields:

1. Device Identification: Name of the device; any Unique Device Identifier (UDI), Universal Product Code (UPC), and other device identification.

2. Receipt Date: The date the complaint was received.

3. Complainant Contact Details: Name, address, and phone number of the complainant.

4. Incident Details: The nature and details of the complaint.

5. Corrective Action: Any correction or corrective action taken.

6. Reply to Complainant: Any reply to the complainant.

820.35(a) also requires records of the review, evaluation, and investigation for complaints involving possible failure of a device, labeling, or packaging to meet any of its specifications. If an investigation has already been performed for a similar complaint, another investigation is not necessary, but the manufacturer must keep records documenting the justification for not performing it.

When servicing is part of the operating system, 21 CFR 820.35(b) requires servicing records to include, at a minimum: the name of the device serviced; any UDI or UPC and other device identification; the date of service; the individual(s) who serviced the device; the service performed; and any test and inspection data. If servicing is not part of the operating system, mark 4.4(b)(1)(vi) not-applicable rather than inventing a servicing program.

If QMSR is the base: the 4.4(b)(2) part 211 provisions that still have to be shown

When a manufacturing plant chooses to base its operating system on the QMSR (21 CFR Part 820 incorporating ISO 13485:2016), 21 CFR 4.4(b)(2) governs the demonstration when the operating system has been shown to comply with the QMSR for devices and the drug constituent is not a medical gas. That assignment is not made by primary mode of action or lead center.

The QMSR final rule amended the introductory text of 4.4(b)(2) to replace 'QS regulation' with 'QMSR requirements for devices', but left the underlying substantive list of Part 211 provisions entirely unchanged. Upon demonstrating compliance with the QMSR and these eight specified drug CGMP provisions, no additional showing of compliance with the drug CGMP requirements is required.

Labeled boundaries: medical gas, biologics, HCT/Ps, and ISO 13485 certificates

A complete facility worksheet must also define the labeled boundaries that sit alongside 4.4(b)(1) and 4.4(b)(2): specialized constituent overlays, the 4.4(e) conflict rule, 4.4(f) incorporation by reference, and the status of commercial registrar certificates.

Specialized Constituent Part Overlays

• Medical Gas Streamlining under 21 CFR 4.4(b)(3): Promulgated in the June 2024 final rule (89 FR 51738), Section 4.4(b)(3) establishes that if the drug constituent is a medical gas and the operating system is based on the QMSR, the facility must show compliance with specified provisions of 21 CFR Part 213 (specifically 213.84, 213.94, 213.122, 213.165, 213.166, 213.204, and 213.208) rather than Part 211.

• Biological Products Overlay under 21 CFR 4.4(b)(4): If the combination product includes a biological product constituent, the operating system must demonstrate compliance with all applicable manufacturing requirements of 21 CFR Parts 600 through 680. Streamlining does not alter or eliminate biologics regulations. Applicable manufacturing requirements in those parts are not replaced by the ISO 13485 clauses in 4.4(b)(1) or by a 4.4(b)(2) part 211 showing. Postmarketing biological-product deviation reporting is a separate duty, not this CGMP overlay.

• HCT/P Overlay under 21 CFR 4.4(b)(5): If the product incorporates human cells, tissues, or cellular/tissue-based products, the operating system must demonstrate compliance with 21 CFR Part 1271 current good tissue practice, including donor eligibility, screening, and communicable disease testing.

The Conflict Rule: 21 CFR 4.4(e)

Under 21 CFR 4.4(e), the Subpart A requirements and the part 210, 211, 213, 820, 600 through 680, and 1271 requirements listed in 4.3 supplement, and do not supersede, each other unless a regulation explicitly provides otherwise. In a conflict, the regulations most specifically applicable to the constituent part in question supersede the more general.

For instance, if a conflict arises regarding analytical release testing of the active liquid formulation in an autoinjector, the specific chemical and biological testing requirements of Part 211 supersede general inspection provisions under ISO 13485. Conversely, if a conflict arises regarding injection mechanism tolerance testing, the device design control provisions of ISO 13485 Clause 7.3 supersede general drug batch records.

4.4(f) incorporation by reference is not a third streamlining path

21 CFR 4.4(f) incorporates ISO 9000:2015 Clause 3 and ISO 13485:2016 by reference for section 4.4. It is an incorporation-by-reference notice, not a third streamlining path and not a rule that an ISO 13485 certificate satisfies 4.4(b)(1). Cite the clause numbers 4.4 names; do not treat 4.4(f) as an alternative to the 4.4(b)(1) or 4.4(b)(2) showing.

Why an ISO 13485 Certificate Is Not a 4.4(b)(1) Showing

An ISO 13485 certificate issued by a commercial registrar is not a 4.4(b)(1) showing and does not exempt a facility from FDA inspection. FDA has explicitly rejected this position.

In the QMSR final rule preamble (89 FR 7496, Comment 80), FDA disagreed with accepting certification to ISO 13485 in lieu of FDA inspection, for two reasons stated in that response:

1. Third-Party Jurisdiction: ISO 13485 certificates are issued by organizations outside FDA.

2. FDA-Specific Add-Ons: QMSR compliance also includes other FDA device requirements such as parts 803, 806, 821, and 830. 4.4(b)(1) still lists 820.10 and 820.35 as specified showings on top of the ISO clauses.

FDA device inspections now follow Compliance Program CP 7382.850. That inspection technique is related reading for a facility that still owes listed QMSR provisions; it is not this identity worksheet, and a registrar certificate is not the 4.4(b)(1) showing.

Labeled fictional map: one facility, every identity field

The following labeled fictional worksheet maps one facility through the identity fields. Use the structure; do not treat the filled cells as an actual quality manual, ISO 13485 certificate, Form FDA 483, or inspection observation.

Related reading this worksheet does not recast

This page is a post-QMSR 4.4(b)(1) versus 4.4(b)(2) versus 4.4(c) clause-identity worksheet for one labeled facility. Link the following hubs instead of retelling them:

• 21 CFR Part 4 combination-product CGMP encyclopedia — Subpart A and Subpart B overview, not this clause map.

• Combination-product pathway guide — OCP, RFD, and Article 117 identity, not 4.4 streamlining clauses.

• 21 CFR 4 Subpart B PMSR worksheet — report type, clock, and system, not CGMP streamlining.

• QSR-to-QMSR transition and device-only QMSR gap analysis — Part 820 conversion, not 4.4(b)(1)/(b)(2).

• CP 7382.850 inspection preparation and pre-2026 QMSR remediation — inspection technique and warning-letter history, not this identity worksheet.

• ISO 13485 implementation, ISO 13485 certification, and ISO 13485 internal audit — registrar certification is not a 4.4(b)(1) showing.

• Design controls, CAPA, complaint handling, management review, and DHF/DMR/DHR — device QMS procedures that 4.4(b)(1) cites by ISO clause number, not a second encyclopedia.

• GMP versus CGMP and QMSR supplier quality agreements — manufacturing and purchasing context, not the 4.4 election.

• Prefilled syringes and autoinjectors, GLP-1 delivery devices, connected autoinjectors, and 2026 container-closure draft — product-class strategy, not this facility worksheet.

• Pre-RFD playbook — lead-center identity, which does not assign 4.4(b)(1) versus 4.4(b)(2).

• Benefit-risk and ISO 14971 — related reading for risk-management records, not a substitute 4.4(b)(1)(ii) standard.

Mark the product type and the facility first, then the operating-system election, then the clause list that election still requires. Keep dual compliance available, keep 4.4(c) sites on full constituent CGMPs, and do not substitute a registrar certificate or a 2017 820 section-number list for current 4.4(b)(1).