Combination Product Safety Reports: Which Clock, Which System, Which Applicant?

Mark applicant identity before you pick a clock or a system

When an adverse event, malfunction, or manufacturing excursion occurs involving a commercial drug-device, biologic-device, or drug-biologic combination product, regulatory affairs and pharmacovigilance teams frequently default to a familiar filing routine. Teams accustomed to medical devices immediately evaluate Medical Device Reporting criteria under 21 CFR Part 803, while teams rooted in biopharmaceuticals check 15-day alert criteria under 21 CFR 314.80 or 600.80. Under United States Food and Drug Administration regulations codified at 21 CFR Part 4 Subpart B (Postmarketing Safety Reporting for Combination Products), jumping straight to a report form or clock without establishing legal identity leads directly to non-compliance, missing add-on reports, or rejected electronic submissions.

Under 21 CFR 4.100, the scope of Subpart B is explicitly limited to combination products that have received marketing authorization under an application, or whose constituent parts have each received authorization under separate applications held by different entities. Investigational combination products subject to an Investigational New Drug (IND) application or Investigational Device Exemption (IDE) fall outside Subpart B and follow their respective investigational safety rules. Furthermore, this worksheet addresses postmarketing adverse events and routing; it does not replace or repeat Part 4 Subpart A CGMP requirements, which govern design controls, purchasing controls, and manufacturing quality systems. It is also not the OCP, RFD, and EU MDR Article 117 encyclopedia. This page is not individualized legal or clinical advice.

Who is the applicant for this combination?

The foundational pillar of 21 CFR Part 4 Subpart B is applicant classification. In 21 CFR 4.101, FDA established clear, non-interchangeable definitions that dictate every subsequent postmarketing duty:

• Combination Product Applicant: An entity that holds the marketing application(s) for a combination product. This includes single-application combination products (such as a prefilled syringe or drug-eluting stent approved under a single NDA, BLA, or PMA) as well as cross-labeled products where the same entity holds both separate marketing authorizations.

• Constituent Part Applicant: An entity that holds an application for a constituent part of a combination product whose other constituent parts are marketed under applications held by different applicants (cross-labeled combination products co-developed or co-marketed across separate corporate sponsors).

• Device Application: Specifically enumerated in 4.101 as a Premarket Approval Application (PMA) under section 515, a Product Development Protocol (PDP) under section 515, a Premarket Notification (510(k)) under section 510(k), a De Novo classification request under section 513(f)(2), or a Humanitarian Device Exemption (HDE) under section 520(m) of the Federal Food, Drug, and Cosmetic Act.

Recognizing your exact status is critical because statutory duties diverge immediately based on this identity. A combination-product applicant is legally accountable for the whole product and must monitor both constituent parts, adding the reporting requirements specified in 21 CFR 4.102(c). In sharp contrast, a constituent-part applicant is only legally accountable for its own constituent part's baseline requirements under 21 CFR 4.102(b), combined with a mandatory 5-calendar-day information-sharing obligation under 21 CFR 4.103 to transfer safety signals to the other applicant. A constituent-part applicant does not submit 4.102(c) add-on reports for constituent parts it does not own.

Keep the 4.102(b) baseline for the application type

A common operational pitfall when navigating 21 CFR Part 4 is the mistaken assumption that combination-product safety reporting creates a brand-new, standalone regulatory regime that displaces standard drug, device, or biologic rules. Paragraph 4.102(b) explicitly refutes this assumption: the baseline reporting requirements of your underlying marketing application never disappear.

Every applicant must continually fulfill the complete suite of postmarketing safety requirements associated with its marketing application type, regardless of whether the event touches the primary mode of action or the secondary constituent part:

• Device Application Baseline: If authorized under a PMA, PDP, 510(k), De Novo, or HDE, the applicant must satisfy all requirements of 21 CFR Part 803 (Medical Device Reporting), including manufacturer 30-calendar-day death, serious-injury, and malfunction reports under 803.50 and 5-day reports under 803.53 when that trigger is met, plus reports of corrections and removals under 21 CFR Part 806. User-facility reports under 803.30 and importer reports under 803.40 are duties of those other person types, not extra combination-product-applicant ICSR forms.

• Drug Application Baseline: If authorized under an NDA or ANDA, the applicant must satisfy all requirements of 21 CFR Part 314, including 15-day alert reports under 314.80(c)(1), periodic adverse drug experience reports (PADER) or periodic benefit-risk evaluation reports (PBRER) under 314.80(c)(2), and other postmarketing reports under 314.81.

• Biological Product Application Baseline: If authorized under a BLA, the applicant must satisfy all requirements of 21 CFR Part 600, including 15-day alert reports under 600.80(c)(1), periodic reporting under 600.80(c)(2), and blood establishment requirements under 21 CFR Part 606 if applicable.

Maintaining the baseline ensures that core statutory obligations—such as 314.80(c)(2) periodic reporting intervals, lot distribution data, and baseline death or serious injury assessments—remain unbroken. For example, an NDA holder for a prefilled autoinjector cannot omit its 314.80(c)(2) periodic safety reports (PADER or PBRER) or fail to capture adverse drug reactions simply because a device constituent malfunction occurred during the period.

Add only the 4.102(c) reports that belong to the other constituent

Once the 4.102(b) baseline is established, a combination-product applicant must evaluate whether additional safety reports are owed under 21 CFR 4.102(c). The purpose of paragraph (c) is to ensure that critical safety mechanisms unique to one constituent part are not lost when that constituent is embedded inside a combination product led by a different application type.

The add-on obligations depend strictly on the nature of the other constituent part present in the combination product:

• When a Device Constituent Part is Present: The combination-product applicant must submit (i) 5-day reports under 21 CFR 803.53; (ii) malfunction reports under 21 CFR 803.50; and (iii) correction or removal reports under 21 CFR 806.10, while maintaining 806.20 records for unreportable corrections.

• When a Drug Constituent Part is Present: The combination-product applicant must submit (i) Field Alert Reports under 21 CFR 314.81(b)(1); and (ii) 15-day alert reports under 21 CFR 314.80(c)(1). Crucial statutory exception: If the combination product was authorized under a device application, the deadline for submitting the 314.80(c)(1) alert report is modified by 4.102(c)(2)(ii) to 30 calendar days instead of 15 calendar days.

• When a Biological Product Constituent Part is Present: The combination-product applicant must submit (i) Biological Product Deviation Reports under 21 CFR 600.14; and (ii) 15-day alert reports under 21 CFR 600.80(c)(1). Crucial statutory exception: If the combination product was authorized under a device application, the deadline for submitting the 600.80(c)(1) alert report is likewise modified by 4.102(c)(3)(ii) to 30 calendar days instead of 15 calendar days.

Clock table: regulation, not folklore

Postmarketing safety compliance hinges on statutory deadlines, not informal industry conventions. Part 803 clocks start when the applicant becomes aware of the information (803.50, 803.53). Fifteen-day reports under 314.80(c)(1) and 600.80(c)(1) run from initial receipt of the information by the applicant. Field-alert reports run from receipt by the applicant (314.81(b)(1)). Do not convert calendar days into working days, or working days into calendar days.

The following table compiles the named reporting clocks under 21 CFR Part 4 Subpart B and the report-type regulations it incorporates. FDA's July 2019 PMSR guidance Table 1 restates these clocks from the cited regulations. That guidance is labeled non-binding except where it quotes a statute or regulation; it does not create typical industry clocks:

Notice the critical distinction between work days (excluding federal weekends and statutory holidays) and calendar days. A 5-day report under 803.53 grants 5 work days, whereas a 4.103 constituent-part information share strictly grants 5 calendar days.

4.104: FAERS, eMDR, or VAERS for this ICSR

Once you have determined that an Individual Case Safety Report (ICSR) is legally required, 21 CFR 4.104 dictates the electronic gateway through which that report must be transmitted. Under paragraph 4.104(a), constituent-part applicants simply submit reports in the manner specified by their underlying application type. For combination-product applicants, paragraph 4.104(b) establishes two crucial routing exceptions that override default constituent pathways:

1. The Device-to-Drug/Biologic Routing Exception (4.104(b)(1)): If your combination product was authorized under an NDA or ANDA, any 5-day reports and malfunction reports owed under 4.102(c)(1)(i) and (ii) for the device constituent must be submitted in accordance with 21 CFR 314.80(g). If authorized under a BLA, they must be submitted in accordance with 21 CFR 600.80(h). In practice, this means device malfunction reports for drug-led products are submitted through FAERS, not through eMDR.

2. The Drug/Biologic-to-Device Routing Exception (4.104(b)(2)): If your combination product was authorized under a device application (PMA, 510(k), De Novo, HDE), any 15-day alert reports owed under 4.102(c)(2)(ii) or (c)(3)(ii) for the drug or biological product constituent must be submitted in accordance with 21 CFR 803.12(a). In practice, this means adverse drug experience reports for device-led products are submitted through eMDR, not through FAERS.

To operationalize these rules, FDA modified its electronic intake systems (FAERS, eMDR, and VAERS) and published dedicated data element mapping guidelines. The table below outlines the precise routing destination for each combination scenario:

Important system distinction: Do not assume every BLA report routes to VAERS. Vaccine combination products route to VAERS, while therapeutic biological products (such as monoclonal antibodies, fusion proteins, or cytokines in delivery devices) route to FAERS under CDER or CBER specifications.

When one electronic ICSR can satisfy more than one 4.102 requirement

To prevent unnecessary duplication while capturing complete clinical and engineering safety data, 21 CFR 4.102(b) and 4.102(c) provide an explicit streamlining mechanism: a combination-product applicant is not required to submit a second ICSR for the same event if three strict statutory tests are satisfied.

• 1. Same-Event Test: Both reportable duties arise from the exact same adverse event or incident. For example, a single incident where an autoinjector fails to deploy completely, resulting in an inadequate therapeutic dose and severe clinical disease flare.

• 2. Same-Manner Test: Under 21 CFR 4.104, both reports are required to be submitted in the same manner to the same electronic portal (for example, both routing through FAERS via 314.80(g) or both routing through eMDR via 803.12(a)).

• 3. Deadline Compliance Test: The consolidated submission is transmitted within the shortest applicable statutory deadline among the triggered reports.

FDA's July 2019 Guidance provides clear operational applications of this streamlining rule:

• NDA Combination Product (Adverse Experience + Device Malfunction): Suppose an event triggers both a 314.80 15-day alert report (serious unexpected adverse drug reaction) and an 803.50 malfunction report (delivery device failure). Both reports route to FAERS under 314.80(g). Because the 15-day clock is shorter than the 30-day malfunction clock, the applicant may submit a single electronic ICSR to FAERS within 15 calendar days, provided the report contains all required adverse drug experience information and all required device malfunction descriptors.

• PMA Combination Product (5-Day Remedial Trigger + 806.10 Correction): If a device-led combination product encounters an event requiring remedial action to prevent unreasonable risk of substantial harm, triggering a 5-day report under 803.53, and the firm simultaneously initiates a device correction or removal under 806.10, submitting a single 5-day report within 5 work days containing all information required by 806.10 satisfies both obligations pursuant to 21 CFR 806.10(f).

• Follow-Up Submissions: The July 2019 guidance also states that follow-up reports may be used to submit a different ICSR type for the same event. Supplemental clinical or engineering details go to the same gateway as a follow-up, without creating a duplicate initial record. Streamlining is not permission to drop a report type whose trigger is met.

Streamlining is not permission to omit data elements. If an applicant combines a drug adverse reaction and a device malfunction into a single FAERS ICSR, every mandatory field for both Form FDA 3500A and the electronic combination product technical specifications must be populated. If required fields are omitted, the single submission fails to satisfy both duties.

4.103 five-calendar-day share is not the FDA report

When constituent parts of a combination product are marketed under separate applications held by different corporate entities (cross-labeled products), 21 CFR 4.103 establishes a mandatory communication protocol between the co-applicants. It is not a substitute for manufacturer complaint intake, and it is not an FDA ICSR.

Under 21 CFR 4.103, when a constituent-part applicant receives information regarding:

• A death or serious injury as described in 21 CFR 803.3; or

• An adverse experience as described in 21 CFR 314.80(a) or 600.80(a), associated with the use of the combination product;

it must provide that information to the other constituent-part applicant(s) no later than 5 calendar days after receipt. Under 21 CFR 4.103(b), the sender must keep a copy of the information, the date received, the date provided, and the name and address of the other constituent-part applicant(s). 4.105(a) then requires constituent-part applicants to retain those 4.103(b) records for the longest applicable 4.102(b) recordkeeping period.

Three date layers and the VMSR boundary

Understanding the compliance history of 21 CFR Part 4 Subpart B is necessary to navigate conflicting commercial literature and out-of-date consultancy guidance. The rule unfolded across three distinct temporal layers:

• Layer 1: The Final Rule (81 FR 92603): Published on December 20, 2016, and effective January 19, 2017. 21 CFR 4.102(a) and (b), 4.104(a), and 4.105(a)(1) used that effective date as the compliance date. The new combination-specific provisions—4.102(c) and (d), 4.103, 4.104(b), 4.105(a)(2), and 4.105(b)—had an 18-month compliance date of July 19, 2018.

• Layer 2: The April 2019 Compliance Policy: In April 2019, FDA delayed enforcement of 4.102(c) and (d), 4.104(b)(1) and (b)(2), and 4.105(b) so combination-product applicants could update reporting and IT systems. FDA did not delay 4.102(a) and (b), 4.103, 4.104(a), or 4.105(a). 4.103 therefore kept its original July 19, 2018 compliance date; 4.102(a) and (b) kept the January 19, 2017 effective-date compliance date.

• Layer 3: Current Enforceable Reality: FDA completed system updates for FAERS and eMDR, initiating full enforcement of application-based combination ICSR requirements on July 31, 2020 for combination products using FAERS and eMDR, and on January 31, 2021 for combination products using VAERS. Literature or vendor templates citing July 2019 or January 2020 represent obsolete intermediate extension targets, not active regulatory boundaries.

Another critical boundary is the Voluntary Malfunction Summary Reporting (VMSR) Program. FDA's combination-product PMSR page points to Federal Register notices describing a voluntary malfunction summary-reporting program available for certain device-led combination products. VMSR is an alternative format for eligible malfunction reporting, not this identity worksheet:

• Where eligible, VMSR is limited to combination products authorized under a device application whose device product code is listed as eligible. It does not replace five-day, death/serious-injury, FAR, BPDR, or 806.10 duties, and it does not change 4.101 applicant identity or 4.104 routing.

• VMSR never applies to reportable events involving death or serious injury, 5-day reports under 803.53, drug or biological constituent events, Field Alert Reports, Biological Product Deviation Reports, or Part 806 corrections.

• VMSR does not exempt applicants from establishing 4.101 applicant identity, maintaining 4.105 complaint records, or complying with 4.103 information-sharing protocols.

Finally, combination-product applicants must track two ongoing obligations codified in 21 CFR 4.102(d): (1) If the combination contains a device constituent and was authorized under an NDA, ANDA, or BLA, periodic safety reports under 314.80 or 600.80 must include a summary and analysis of the 4.102(c)(1)(i) and (ii) five-day and malfunction reports submitted during the interval; and (2) If the combination was authorized under a device application, additional postmarketing safety information is required only if FDA notifies the applicant in writing, stating the reason, due date, and related event(s).

Labeled fictional packet: one event, every identity field

Case Scenario: A patient self-administering a weekly maintenance injection of a labeled drug product with the fictional 'CardioShield Autoinjector' (authorized under a single New Drug Application, fictional NDA #999999, held by fictional sponsor Apex Biopharma) experiences a mechanical failure. During administration, the automated needle guard retracts prematurely and jams, discharging half the liquid volume onto the patient's skin. Due to the incomplete dose and localized mechanical trauma, the patient experiences acute symptom recurrence requiring emergency hospital admission for IV stabilization. Apex Biopharma receives the customer complaint and clinical report on Day 0. This packet treats the hospitalization as a serious unexpected adverse drug experience for worksheet purposes; unexpectedness on a live product still depends on the approved labeling.

The following decision diagram maps the complete logic path applied in this worksheet:

flowchart TD
    A["Adverse event or malfunction received"] --> B{"Applicant identity 4.101"}
    B -->|"Constituent-part applicant"| C["5-calendar-day share 4.103"]
    C --> D["Own 4.102(b) baseline to FDA"]
    B -->|"Combination-product applicant"| E{"Application type 4.102(b)"}
    E -->|"NDA or ANDA"| F["Part 314 baseline"]
    E -->|"BLA"| G["Part 600 baseline"]
    E -->|"Device application"| H["Part 803 and 806 baseline"]
    F --> I{"Device constituent present? 4.102(c)(1)"}
    G --> I
    I -->|"Yes"| J["Add 5-day, malfunction, and 806.10"]
    J --> K["ICSRs via 314.80(g) or 600.80(h): FAERS or VAERS"]
    H --> L{"Drug or biologic constituent present? 4.102(c)(2)/(3)"}
    L -->|"Yes"| M["Add 15-day ICSR at 30 calendar days plus FAR or BPDR"]
    M --> N["15-day ICSR via 803.12(a) eMDR; FAR/BPDR stay off ICSR systems"]
    K --> O{"Same event, same manner, deadline met?"}
    N --> O
    O -->|"Yes"| P["One electronic ICSR on the shortest applicable clock"]
    O -->|"No"| Q["Separate submissions"]

By anchoring every postmarketing decision to this structured sequence—establishing applicant identity under 4.101, locking in the application baseline under 4.102(b), evaluating constituent add-ons under 4.102(c), observing statutory clocks, and following 4.104 routing exceptions—regulatory affairs and quality teams maintain airtight compliance across the full lifecycle of complex combination products.