21 CFR Part 4: Combination Product cGMP Quality Systems for Drug-Device Manufacturers

How drug-device combination product manufacturers implement quality systems under 21 CFR Part 4 — streamlined approach, QMSR update, design controls, stability, and EU MDR Article 117.

Combination Products Sit Between Two Regulatory Worlds — Here Is How to Bridge Them

Drug-device combination products — prefilled syringes, drug-eluting stents, transdermal patches, metered-dose inhalers, autoinjectors, and antimicrobial-coated catheters — represent one of the fastest-growing segments in medical technology. The global combination products market was valued at approximately $145 billion in 2025 and is projected to exceed $220 billion by 2030, driven by the growth of biologic drug delivery, wearable injectors, and minimally invasive drug-eluting technologies.

Yet for all this growth, combination product manufacturers face a unique regulatory challenge: their products must comply with quality system requirements designed for both drugs and devices. Drug cGMP (21 CFR Parts 210/211) and device quality system requirements (21 CFR Part 820, transitioning to the Quality Management System Regulation — QMSR — in February 2026) were developed independently, in different eras, with different terminologies, and different compliance philosophies.

21 CFR Part 4 is the FDA regulation that bridges these two worlds. Published as a final rule in January 2013, Part 4 provides a framework for combination product manufacturers to demonstrate compliance with applicable cGMP requirements without operating two completely separate quality systems.

This guide explains how 21 CFR Part 4 works, the two compliance approaches available, what the QMSR transition means for combination product manufacturers, how EU MDR Article 117 intersects with drug-side quality requirements, and practical strategies for building a compliant, efficient combination product quality system.

What Are Combination Products and Why Does Part 4 Exist?

Definition and Types

Under 21 CFR 3.2(e), a combination product is a product composed of two or more regulated components — drug, device, or biological product — that are combined, co-packaged, or cross-labeled. FDA recognizes nine specific types, but three categories cover the vast majority of combination products:

Category	Description	Examples
Single-entity	Drug and device physically, chemically, or otherwise combined into a single product	Prefilled syringes, drug-eluting stents, transdermal patches, antimicrobial sutures
Co-packaged	Drug and device packaged together as a unit	First-aid kits, vials of drug packaged with syringes or transfer sets
Cross-labeled	Drug and device sold separately but intended for use together	Light-emitting device with light-activated drug, imaging device with imaging agent

Single-entity and co-packaged combination products must comply with cGMP requirements applicable to all their constituent parts. Cross-labeled products are generally subject to the cGMP requirements applicable to each individual constituent part.

The Regulatory Problem Part 4 Solves

Before Part 4, manufacturers of drug-device combination products faced a practical dilemma: drug cGMP (21 CFR Parts 210/211) and device quality system regulation (21 CFR Part 820) contain overlapping but not identical requirements. Operating under both systems in their entirety creates redundancy — dual document control systems, duplicate training records, parallel CAPA processes — without improving product quality.

Part 4 addresses this by providing a "streamlined approach" that allows combination product manufacturers to operate under one primary quality system and incorporate only the specific additional provisions from the other system that are necessary to ensure complete coverage.

The Two Compliance Approaches Under 21 CFR Part 4

Approach 1: Full Dual Compliance

Under 21 CFR 4.4(a), a manufacturer may demonstrate compliance with all cGMP regulations applicable to each constituent part. A drug-device combination product manufacturer following this approach would operate a quality system that is fully compliant with both 21 CFR Parts 210/211 (drug cGMP) and 21 CFR Part 820 (device QSR/QMSR).

This approach is straightforward conceptually but operationally burdensome. It requires maintaining two parallel sets of procedures, forms, and records for many quality system elements. Most combination product manufacturers do not choose this approach unless they already operate separate drug and device manufacturing facilities with distinct quality systems.

Approach 2: The Streamlined Approach

Under 21 CFR 4.4(b), manufacturers of single-entity and co-packaged drug-device combination products may implement a "streamlined approach" that demonstrates compliance with either:

Drug cGMP as the base (21 CFR Parts 210/211), supplemented with specific device quality system provisions from 21 CFR Part 820, OR
Device QSR/QMSR as the base (21 CFR Part 820), supplemented with specific drug cGMP provisions from 21 CFR Parts 210/211

The streamlined approach avoids redundant compliance activities while ensuring that quality system requirements specific to each constituent part are met. The selection of the base framework typically follows the product's primary mode of action (PMOA) — the single mode of action that provides the most important therapeutic effect — though the choice of quality system base is independent of which FDA center has lead review jurisdiction.

Device Provisions Required When Drug cGMP Is the Base

Manufacturers whose quality system foundation is drug cGMP (21 CFR Parts 210/211) must additionally demonstrate compliance with the following device-specific provisions:

Design Controls (21 CFR 820.30)

Design controls are the most significant device-specific requirement that drug manufacturers must add. Drug cGMP does not include an equivalent to the device design control framework. Under Part 4, drug-based combination product manufacturers must implement:

Design and development planning
Design inputs (including functional, performance, and interface requirements)
Design outputs (meeting design input requirements and acceptance criteria)
Design review (at appropriate stages, with documented results)
Design verification (confirming design outputs meet design inputs)
Design validation (confirming the device conforms to defined user needs and intended uses)
Design transfer (translating design outputs to manufacturing)
Design changes (documenting and controlling modifications)
Design history file (compilation of records describing the design history)

For combination products like prefilled syringes or autoinjectors, design controls apply to the device constituent (the delivery mechanism, needle system, safety features, etc.) but must be integrated with the drug development process.

Management Responsibility (21 CFR 820.20)

This provision requires that management with executive responsibility establishes quality policy, ensures adequate resources, conducts management reviews, and appoints a management representative. While drug cGMP includes management responsibilities, the device provision emphasizes quality planning and organizational structure in ways that complement the drug framework.

Purchasing Controls (21 CFR 820.50)

Device purchasing controls require evaluation and selection of suppliers based on their ability to meet specified requirements, including quality requirements. Drug manufacturers accustomed to supplier qualification under drug cGMP will find the device provision adds emphasis on supplier evaluation criteria, purchasing data, and verification of purchased product.

Corrective and Preventive Action — CAPA (21 CFR 820.100)

CAPA is a core device quality system element. Drug cGMP includes investigation and corrective action requirements, but the device CAPA framework is more structured, requiring analysis of quality data sources, investigation of root causes, implementation of corrective and preventive actions, verification of effectiveness, and documentation of all activities. For combination products, the CAPA system must address both drug and device quality issues.

Installation (21 CFR 820.170) and Servicing (21 CFR 820.200)

These provisions apply when the combination product requires installation at the user site or when servicing is a specified requirement. Not all combination products trigger these provisions — a prefilled syringe generally does not require installation — but drug-eluting pump systems or implantable drug delivery devices may.

Drug Provisions Required When Device QSR/QMSR Is the Base

Manufacturers whose quality system foundation is the device QSR/QMSR must additionally demonstrate compliance with specific drug cGMP provisions:

Stability Testing and Expiration Dating

Drug cGMP requires stability testing programs that establish and verify expiration dates for drug products. This includes:

Written testing program with sample size and test intervals
Stability-indicating assay methods
Storage condition specifications
Ongoing stability monitoring through the product's shelf life

For combination products, stability testing must evaluate both the drug constituent and the device-drug interface. Prefilled syringes, for example, require stability studies that assess drug-container interactions, extractable and leachable profiles, functional performance of the delivery device over time, and sterility maintenance.

Batch Release Testing and Laboratory Controls

Drug cGMP requires specific laboratory controls including:

Identity and strength testing of each active ingredient
Release testing of each batch before distribution
Laboratory control records with complete data
Reserve samples for each batch
Out-of-specification (OOS) investigation procedures

Device manufacturers entering combination product territory must establish these pharmaceutical-grade laboratory controls, even if their device manufacturing processes did not previously require this level of analytical testing.

Written Procedures and Batch Records

Drug cGMP requires written procedures for each manufacturing step and batch production records that document complete manufacturing history for each batch. While device quality systems include production documentation, drug batch records are more prescriptive and must capture specific data points including yields, material additions, in-process testing results, labeling verification, and reconciliation.

Complaint Handling for Drug Products

Drug cGMP includes specific complaint handling and investigation requirements that may be more prescriptive than device complaint handling alone. For combination products, the complaint handling system must be capable of identifying whether a complaint is related to the drug constituent, the device constituent, or the interaction between the two, and must route investigations accordingly.

The QMSR Transition: What Changes for Combination Products

From QSR to QMSR

On February 2, 2024, FDA issued a Final Rule amending the device Quality System Regulation (21 CFR Part 820) to create the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. The QMSR became effective on February 2, 2026.

This transition has significant implications for combination product manufacturers operating under the streamlined approach. Key changes include:

ISO 13485 terminology and structure: The QMSR aligns device quality system requirements with the ISO 13485:2016 framework, using its terminology and organizational structure
Risk management integration: ISO 13485 explicitly integrates risk management throughout the quality system, complementing the risk-based approaches in drug cGMP
Design and development: The ISO 13485 design control framework maps closely to the existing 21 CFR 820.30 requirements but adds emphasis on design transfer and design change management
Supplier controls: Enhanced supplier and subcontractor control requirements that may affect how combination product manufacturers qualify and monitor suppliers of both drug and device components

Part 4 Conforming Amendments

FDA has made conforming amendments to 21 CFR Part 4 to reflect the QMSR transition. The fundamental streamlined approach structure remains — manufacturers still choose a base system and supplement with provisions from the other — but the specific device provisions referenced in Part 4 now point to the QMSR rather than the former QSR.

For drug-based combination product manufacturers, the device provisions they must add to their drug cGMP foundation are now found in the QMSR framework. The updated Part 4.4(b)(1) now references specific ISO 13485 clauses (together with definitions from ISO 9000, Clause 3) rather than the former 21 CFR 820 section numbers. The core elements (design controls, management responsibility, purchasing controls, CAPA, installation, servicing) remain substantively the same, but the terminology, documentation requirements, and integration of risk management reflect the ISO 13485:2016 structure.

Postmarket Safety Reporting (Part 4, Subpart B)

In addition to cGMP requirements, 21 CFR Part 4 Subpart B addresses postmarket safety reporting (PMSR) for combination products. This is often overlooked in quality system planning but is critical for compliance:

Combination products regulated as devices must comply with Medical Device Reporting (MDR) requirements under 21 CFR Part 803
Combination products regulated as drugs must comply with drug adverse event reporting under 21 CFR Part 310.305 (for marketed products) and 21 CFR Part 314.80 (for NDA holders)
When a reportable adverse event involves a combination product, the manufacturer must submit the report to the center with lead jurisdiction and provide a copy to the Office of Combination Products

The PMSR requirements mean that combination product quality systems must include complaint handling and adverse event evaluation procedures capable of determining whether an event is related to the drug constituent, the device constituent, or the interaction between the two — and reporting accordingly.

EU MDR Article 117: The European Dimension

What Article 117 Requires

For combination products marketed in the European Union, EU MDR Article 117 creates additional quality system and regulatory requirements. Article 117 amends the Medicinal Product Directive (2001/83/EC) to require Notified Body involvement in the assessment of drug-device combination products marketed as medicinal products.

Specifically, for integral drug-device combination products (where the device is combined with the drug and the drug provides the primary mode of action):

The marketing authorization application must include either a Declaration of Conformity, an EU certificate issued by a Notified Body, or a Notified Body Opinion (NBOp) on the conformity of the device part with the relevant General Safety and Performance Requirements (GSPRs) of MDR Annex I
The Notified Body assesses the device part's compliance with applicable GSPRs and provides an opinion to the national competent authority or EMA
The final marketing authorization decision remains with the medicines authority (EMA or national competent authority)

How Article 117 Intersects with Part 4

For manufacturers selling combination products in both the US and EU, 21 CFR Part 4 and MDR Article 117 create overlapping but distinct requirements. Part 4 addresses quality system compliance (how you manufacture), while Article 117 addresses product conformity (whether the device part meets EU safety and performance requirements).

Practically, manufacturers need to:

Maintain a quality system that satisfies both Part 4 and EU requirements — the ISO 13485-based QMSR alignment helps here, as ISO 13485 is also the foundation for EU MDR quality system compliance
Prepare technical documentation for the device part that satisfies both FDA design control requirements and EU MDR GSPRs
Coordinate Notified Body assessments with both FDA inspections (for cGMP compliance) and the Article 117 NBOp process

Practical Implementation: Building a Compliant Combination Product Quality System

Strategy 1: Choose the Right Base System

The choice between drug cGMP and device QMSR as the base framework should reflect your organization's existing capabilities, the product's PMOA, and the dominant regulatory pathway:

Drug companies entering combination products (e.g., adding an autoinjector to a drug product) typically choose drug cGMP as the base, adding device design controls, CAPA, and purchasing controls
Device companies adding drug components (e.g., adding an antimicrobial coating to a catheter) typically choose the device QMSR as the base, adding stability testing, batch release, and laboratory controls
Companies with both drug and device expertise may choose either base, but should select the framework that best aligns with their existing organizational structure and the product's primary regulatory pathway

Strategy 2: Integrate, Don't Duplicate

The most common implementation mistake is creating parallel systems — a drug quality system and a device quality system running side by side. This defeats the purpose of the streamlined approach. Instead:

Merge document control into a single system that captures both drug and device records
Unify CAPA so that a single investigation process handles complaints and nonconformances from both drug and device sources
Integrate training so that personnel are qualified for both drug and device operations
Align change control to evaluate changes against both drug and device regulatory requirements simultaneously

Strategy 3: Address the Seams

The greatest compliance risk in combination product quality systems lies at the interfaces between drug and device requirements — what the FDA calls the "seams." Common seam issues include:

Drug-device interaction: How does the drug constituent affect the device constituent, and vice versa? Stability testing must address both directions.
Complaint triage: Is a complaint related to the drug, the device, or the combination? The investigation process must be capable of distinguishing and routing correctly.
Supplier oversight: A supplier providing both drug and device components must be qualified against both sets of requirements.
Post-market reporting: Combination products may be subject to both device Medical Device Reports (MDRs) and drug Adverse Event reporting requirements under 21 CFR Part 4, Subpart B.

Strategy 4: Prepare for Inspections

FDA inspects combination product manufacturers using inspectors who may be primarily trained in either drug or device cGMP. Under Part 4, the inspection team should include expertise relevant to the applicable cGMP requirements, but manufacturers should be prepared to explain:

Which compliance approach they are using (full dual or streamlined)
Which system is the base and what supplemental provisions have been added
How the integrated quality system addresses both drug and device requirements
How complaint handling, CAPA, and change control processes cover both constituent parts

Cross-Market Dossier Preparation

For combination products requiring regulatory submissions in both drug and device frameworks, the documentation challenge is significant. The drug-side dossier follows the CTD (Common Technical Document) or eCTD (electronic CTD) format — a standardized structure used globally for pharmaceutical marketing authorization applications. The device-side documentation follows technical file or STED (Summary Technical Documentation) format.

Manufacturers of drug-device combination products often need expertise in both documentation formats. While the drug CTD/eCTD and the device technical documentation serve different regulatory purposes, they share common data sources — preclinical studies, risk analyses, manufacturing process descriptions, and stability data — that must be prepared and maintained in a coordinated manner.

For drug-eluting stents, prefilled syringes, and other products where the drug constituent provides the primary mode of action, the marketing application is typically an NDA or BLA that incorporates device technical data. The CTD/eCTD submission must include the device-related information in the appropriate modules (typically Module 3 for quality and Module 5 for clinical data). Manufacturers who need specialized guidance on pharmaceutical regulatory dossier preparation and drug approval processes can refer to PharmaDossier, which covers CTD/eCTD submissions and drug registration in depth — a resource that complements the device-side regulatory guidance found on this site.

Key Takeaways

21 CFR Part 4 provides a practical framework for combination product quality system compliance, but it requires deliberate implementation:

The streamlined approach allows manufacturers to operate under one primary quality system while incorporating specific provisions from the other framework — avoiding the burden of full dual compliance
Device companies adding drug components must add stability testing, batch release, laboratory controls, and drug-specific complaint handling
Drug companies adding device components must add design controls, CAPA, purchasing controls, and device-specific management responsibility
The QMSR transition (effective February 2026) aligns device quality system requirements with ISO 13485:2016, improving international harmonization for combination product manufacturers
EU MDR Article 117 adds Notified Body assessment requirements for the device part of drug-led combination products
The greatest risk lies at the seams — the interfaces between drug and device quality requirements where gaps most commonly occur

Combination products will continue to grow as drug delivery technologies advance and as the boundary between drug and device innovation continues to blur. Manufacturers that invest in integrated, streamlined quality systems will be better positioned to bring safe and effective combination products to market efficiently.