1Which CGMP rules apply at your site.
Each constituent part keeps its own CGMP rules: Parts 210 and 211 for a drug, Part 820 for a device, Parts 600 to 680 for a biological product, Part 1271 for a human cell, tissue or cellular or tissue-based product (HCT/P) and, since 2 February 2026, Part 213 for a medical gas (4.3).¹² A site holding both a drug and a device part can meet each set in full or take a streamlined route, and the route need not follow the primary mode of action: a drug-led product can run on a device-based system, and the reverse.³ These rules supplement each other; if two conflict, the one most specific to the constituent part wins (4.4(e)).¹
| Your situation | What you must show | Rule |
|---|---|---|
| One part only at this site | All of that part’s CGMP rules | 4.4(c)¹ |
| Both parts at one site | Every set in full, or a streamlined system once both parts have arrived | 4.4(a), (b) and (d)¹ |
| Cross-labelled | Made apart: each site meets its own part’s rules. Together: FDA “does not intend to object” to a streamlined system | FDA guidance II.C.1³ |
| Also sells device alone | That device cannot run on the drug-based system | FDA guidance II.C.1³ |
| Biologic or HCT/P inside | Add Parts 600 to 680 or Part 1271, on either route | 4.4(b)(4) and (5)¹ |
2The drug-based route: 4.4(b)(1) since 2 February 2026.
A site whose system has been shown to meet Parts 210 and 211 adds the provisions below, after which “no additional showing of compliance with respect to the QMSR need be made” (4.4(b)(1)).¹ The third column is the citation FDA’s 2017 guidance and Compliance Program 7356.000 still print.³⁴
| 4.4(b)(1) item | Required now | Old citation | What FDA says drug sites add |
|---|---|---|---|
| (i) Management | ISO 13485 clause 4.1, clause 5 and subclauses, clause 6.1, and 21 CFR 820.10 | 820.20 | Management reviews of the quality system at defined intervals, which drug CGMP does not explicitly address |
| (ii) Design | Clause 7.3 and subclauses, plus a documented risk management process in product realisation, with records | 820.30 | Design procedures, a design file for the whole product, verification and validation |
| (iii) Purchasing | Clause 7.4 and subclauses | 820.50 | Evaluation of device part suppliers and services such as sterilisation; notice of changes |
| (iv) Data and complaints | Clause 8.2.2 with 820.35(a), clause 8.4, and clause 8.5 and subclauses | 820.100 | Corrective and preventive action (CAPA) covering every constituent part, the whole product and other sites. Complaint records are new: see below. |
| (v), (vi) Installation, servicing | Clause 7.5.3; clause 7.5.4 with 820.35(b) | 820.170; 820.200 | Rarely relevant to a single-entity or co-packaged product |
One change is easy to miss at a drug-based site. The old list called out 820.100 only; item (iv) now names complaint handling, clause 8.2.2 and 820.35(a), and FDA added 8.2.2 in response to a comment.⁵ FDA still calls these conforming edits that “do not impact the CGMP requirements for combination products”, but a drug site’s complaint file now needs the 820.35(a) fields in the checklist below. Clauses 8.3 and 8.2.3 stay off the list because they “are covered sufficiently in part 211”.⁵
Section 820.10 also limits design and development to class II and III devices and the class I devices it lists.⁶
3The device-based route: eight Part 211 sections.
A site whose system has been shown to meet Part 820 adds the eight sections below (4.4(b)(2)). The list did not change in 2026: FDA said the QMSR does “not alter or change the requirements set forth at part 210 or part 211”.¹⁵
| Section | What it means for a combination product |
|---|---|
| 211.84 Components | Test drug components, containers and closures, including a device part that is the container or closure. |
| 211.103 Yield | Yield for the drug part at each phase, verified by a second person, or by one person if automated equipment calculates it. Not required for device parts, but rejected syringes show up as lost drug. |
| 211.132 Tamper-evident | Over-the-counter products only. |
| 211.137 Expiry | Backed by stability data. A combined product can expire sooner than its parts; one date on a co-package is the earliest. |
| 211.165 Release testing | Every batch of a single-entity product; every batch of the drug part of a co-package. |
| 211.166 Stability | On the drug as it sits in the finished single-entity product. |
| 211.167 Special tests | Sterility and pyrogens, ophthalmic ointments and controlled release, where they apply. |
| 211.170 Reserve samples | The whole product for a prefilled syringe or drug-eluting stent; the cartridge alone for a cartridge used in an injector. |
Part 211 sections that these cross-refer to, such as 211.192 from 211.170, are met through the device system’s own CAPA and controls, FDA says.³
4Gap checklist: a drug site adding a device part.
Records an investigator can ask for at a plant new to the drug-based route. Applicant reporting: see subpart B below.
| Check | Evidence to have ready | Requirement |
|---|---|---|
| Route declared | Quality manual names it; investigators told at the start; each facility’s route in the Common Technical Document (CTD) or premarket approval application (PMA) | FDA guidance II.C.2³ |
| Management review | Defined intervals; covers combination product data and contract sites | 4.4(b)(1)(i);¹ FDA guidance IV.A.1³ |
| Design procedures | Design and development, design change, verification and validation; documented risk management in product realisation, with records | 4.4(b)(1)(ii);¹ CP 7356.000 Part V⁴ |
| Design file | Shows the device part suits this drug; supplier design data referenced and retrievable during the inspection | CP 7356.000 Att. B;⁴ FDA guidance V.A³ |
| Suppliers | Evaluation and approved list for device part suppliers and services; change notice in agreements | 4.4(b)(1)(iii);¹ FDA guidance IV.A.3³ |
| Incoming testing | A device part that is also the container or closure tested under 211.84 | FDA guidance IV.B.1³ |
| Complaint records | For complaints reportable under Part 803 or investigated: device name, date received, unique device identifier (UDI) or universal product code (UPC) and any other device identification, complainant, details, correction, reply | 820.35(a)⁷ |
| Data and CAPA | Trends across both parts; CAPA linked across sites | 4.4(b)(1)(iv);¹ FDA guidance IV.A.4³ |
| Not applicable | Written reason installation and servicing do not apply | FDA guidance III.D³ |
5Who answers for what: owner, CDMO and suppliers.
| Party | Answers for | Source |
|---|---|---|
| Application holder | Has “overall responsibility” for the product’s CGMPs, even if it makes nothing itself; can describe how each facility meets them | CP 7356.000 Part II;⁴ FDA guidance III.D.3³ |
| CDMO or filler | The CGMPs for each process at its site, its duties set out in writing | FDA guidance III.D.3³ |
| Single-part supplier | Only its own system (Part 820, or Parts 210 and 211), if it does nothing else on the product | FDA guidance III.D.3³ |
| Specification developer | Holds the design records; the finished product maker needs access, and assurance of its design control system | FDA guidance III.D.3³ |
Quality agreements can say which facility does what and keeps which records.³
6Example: a prefilled syringe gap assessment.
The company, product and dates are invented. Harrowfen Pharma makes Moxatrelin 50 mg/mL injection in vials under Part 211 at Site 1. It plans a 1 mL prefilled syringe of the same formulation, filled there from bought-in syringe components: a single-entity combination product, as in FDA’s prefilled syringe scenario.³
| Field | Entry |
|---|---|
| Record | GA-26-031, opened 6 July 2026, approved by the head of QA on 31 July 2026 |
| Route | Drug-based, 4.4(b)(1), named in quality manual revision 9 and in the CTD |
| Covered by Part 211 | 211.84 tests of barrels and plungers; stability and reserve samples of filled syringes, under existing procedures |
| Gap 1, management | Reviews covered drug metrics only. Procedure revised to add syringe complaints, supplier data and design changes. |
| Gap 2, design | No design procedure. SOP-QA-140 written; design file built on supplier data, with viscosity and dose as inputs. |
| Gap 3, risk | Drug hazards only. Wrong dose, loss of sterility and syringe failure added, each with a control. |
| Gap 4, purchasing | No change clause. Agreement amended: notice before any barrel or plunger material change. |
| Gap 5, complaints | No device identification or reply fields. Form revised to the seven 820.35(a) fields. A syringe properly bearing a National Drug Code (NDC) needs no UDI under FDA’s draft, so NDC and lot identify it. |
| Gap 6, reporting | No device reporting process. Procedure written for five-day, malfunction and correction or removal reports, to apply from approval. |
| Status, 30 October 2026 | 4 of 6 closed. Gaps 2 and 3 close when verification and a use study with intended users end, before submission. |
FDA’s guidance supports the design call: earlier drug development is “not itself subject to design controls”.³
7Postmarket safety reporting: Part 4 subpart B.
Subpart B applies once a product has marketing authorisation, not to investigational products (4.100(b)).¹ Each applicant files what its application type requires, a new drug application (NDA), abbreviated application (ANDA), biologics licence application (BLA) or device application (4.102(b)). A combination product applicant, which holds the application or applications for the whole product, also adds the other constituent’s key reports (4.102(c)).¹
| Your application | You already file | Part 4 adds |
|---|---|---|
| NDA, ANDA or BLA | Part 314 reports, including 15-day and field alert reports, or Parts 600 and 606 reports | Five-day, malfunction, and correction or removal reports; periodic reports summarise the first two |
| Device application | Parts 803 and 806 reports | Field alert reports (drug) or biological product deviation reports (biologic), plus 15-day reports |
The clocks come from the underlying rules: five-day report, 5 work days; malfunction report, 30 calendar days; correction or removal, 10 working days; field alert, 3 working days; 15-day report, 15 calendar days (30 on a device application).⁸⁹¹⁰¹ Where different companies hold the drug and device applications, each passes deaths, serious injuries and adverse experiences to the other within 5 calendar days (4.103).¹
8How FDA inspects a combination product site.
Compliance Program 7356.000 covers CDER-led and CDRH-led products; CBER-led products follow CBER’s programmes. Investigators use the base system’s programme, then the called-out provisions. On a device base that is now 7382.850, which on 2 February 2026 replaced 7382.845, 7383.001 (PMA preapproval and postmarket inspections) and the Quality System Inspection Technique.⁴¹¹¹² A streamlined site’s citations “should ONLY be to provisions of the base CGMPs and to the relevant called-out provisions from the other CGMP system”.⁴
Have three things ready on day one, because FDA asks the lead centre or the firm for them before or early in any inspection (Parts II and III): the route you chose (drug-based, device-based or full compliance); which facilities design, make and supply the product, who holds the design history file and who handles complaints; and procedures and records for the called-out provisions, reachable on site.⁴
Pre-approval inspections focus on “the combination product for which marketing approval is sought”. Table 1: a drug-based NDA or ANDA runs under programme 7346.832, plus Attachment B coverage of 820.20, 820.30, 820.50 and 820.100 in the old citations. Process validation coverage comes from the lead centre, including “what process validation activities are expected to be complete”.⁴ Attachment B: “Evaluation of design controls should start with the DHF”, the design history file, which can reference supplier data but must show the part suits this product.⁴ On surveillance, a comprehensive inspection is listed “For the initial coverage of called-out provisions after introduction of combination product manufacturing operations to a facility that previously manufactured only a drug, device, or biological product”.⁴
Significant findings that can justify withholding approval or official action include “Where design controls are required, no design controls procedure(s) for the combination product”, or no CAPA or purchasing procedure.⁴
FDA’s letter of 5 September 2017 to Meridian Medical Technologies, maker of EpiPen, cited Parts 211 and 820 together, including design validation (820.30(g)):¹³
However, your firm has not completed any validation testing of the design of EpiPen products in order to ensure that the products conform to the defined intended uses.
EyePoint Pharmaceuticals’ letter of 12 July 2024 cites Part 4 and Parts 210 and 211 alone: it failed to investigate an atypical release rate result (211.192).¹⁴
9Edge cases the sources settle.
- Container or device? The test is generally “whether the article is designed to deliver the drug it contains or merely to hold it”. Piston syringes, metered dose inhalers and IV bags are device constituent parts.³
- Exempt devices. If a device part’s exemptions from Part 820 cover every 4.4(b)(1) provision, Part 211 alone is enough. A dropper built into a bottle cap may be a new use that loses the exemption.³
- Products never developed under design controls. For ophthalmic drugs packaged with an eye cup or dropper, firms are “not expected to retroactively prepare certain parts of the development plan or conduct design review meetings”, but need a design plan for future changes.¹⁵
- Older marketed products. FDA “deliberately does not use” the term “legacy”, because it could wrongly suggest fewer obligations. To judge a marketed product’s design controls, it suggests reviewing “premarket submissions, the product risk profile, and postmarket experience”.³
10What changed in 2024 to 2026.
- 2 February 2026: the QMSR and the medical gas rule’s Part 4 changes took effect.⁵²
- June 2025, draft: FDA’s UDI draft says a single-entity combination product must carry a UDI unless it properly bears an NDC, which affects the UDI field in 820.35(a).¹⁶
- Draft, October 2026: FDA’s revised draft on essential drug delivery performance characteristics ties delivery testing to clause 7.3 through 4.4(b)(1)(ii).¹⁷
11How the EU and UK differ.
The EU frames the question by product, and neither Article 1(8), Article 1(9) nor Article 117 of the Medical Device Regulation offers a quality system choice like 4.4(b).¹⁸ Medicines law governs a single integral product used only in that combination and not reusable, such as a single-use prefilled syringe (Article 1(9)), and a product whose incorporated medicinal substance has the principal action (Article 1(8)). The medicine is made under EU GMP; the device part must meet Annex I, shown in the dossier by a declaration of conformity, a notified body certificate or, where one would be needed, its opinion (Article 117).¹⁸¹⁹ A co-packaged or referenced device stays under device law: “Co-packaged and referenced medical devices should be in compliance with the applicable medical device legal framework.” Article 117 does not apply to combined advanced therapy medicinal products.²⁰
MHRA treats a syringe marketed pre-filled as covered by medicines legislation, with the relevant essential requirements of the UK Medical Devices Regulations 2002 (UK MDR) applying to the device part; a device included separately in a pack “will still need to comply with the UK MDR 2002”.²¹
12How it runs in Seal.
In Seal, the combination product is the common parent record. Each finished lot or unit keeps its drug or biologic source, device revision and component lots, assembly and test execution, and disposition, and one event model covers deviations and nonconformances, so a syringe complaint or a supplier change notice is traced once rather than through two quality systems. Seal does not make the regulatory determination; it makes the control strategy you chose executable and reviewable.
Design work sits in design control, where each design input links to its outputs, verification and validation, and a requirement with no linked test is listed as a gap. Manufacturing references the released design outputs, and a change is assessed across both constituents before approval.
References
- 121 CFR Part 4, Regulation of Combination Products, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 4 (read 8 November 2026) - 2Medical gases CGMP and labeling final rule, FDA, 89 FR 51738, 18 June 2024. https:/
/ www. federalregister. gov/ documents/ 2024/ 06/ 18/ 2024- 13190/ current- good- manufacturing- practice- certification- postmarketing- safety- reporting- and- labeling (read 8 November 2026) - 3Current Good Manufacturing Practice Requirements for Combination Products, guidance, FDA, January 2017. https:/
/ www. fda. gov/ media/ 90425/ download (read 8 November 2026) - 4Compliance Program 7356.000, Inspections of CDER-led or CDRH-led Combination Products, FDA, implemented 4 June 2020. https:/
/ www. fda. gov/ media/ 138592/ download (read 8 November 2026) - 5Medical Devices; Quality System Regulation Amendments, final rule, FDA, 89 FR 7496, 2 February 2024. https:/
/ www. govinfo. gov/ content/ pkg/ FR- 2024- 02- 02/ html/ 2024- 01709. htm (read 8 November 2026) - 621 CFR 820.10, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 820. 10 (read 8 November 2026) - 721 CFR 820.35, Control of records, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 820. 35 (read 8 November 2026) - 821 CFR 803.50 and 803.53, device reporting, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ part- 803 (read 8 November 2026) - 921 CFR 806.10, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 806. 10 (read 8 November 2026) - 1021 CFR 314.81(b)(1), eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 314. 81 (read 8 November 2026) - 11CDRH Compliance Programs, FDA, content current as of 12 May 2026. https:/
/ www. fda. gov/ medical- devices/ quality- and- compliance- medical- devices/ center- devices- and- radiological- health- cdrh- compliance- programs (read 8 November 2026) - 12Compliance Program 7382.850, Inspection of Medical Device Manufacturers, FDA, implemented 2 February 2026. https:/
/ www. fda. gov/ media/ 80195/ download (read 8 November 2026) - 13Meridian Medical Technologies, Inc., a Pfizer company, warning letter, FDA, 5 September 2017. https:/
/ www. fda. gov/ inspections- compliance- enforcement- and- criminal- investigations/ warning- letters/ meridian- medical- technologies- inc- pfizer- company- 525881- 09052017 (read 8 November 2026) - 14EyePoint Pharmaceuticals, Inc., warning letter, FDA, 12 July 2024. https:/
/ www. fda. gov/ inspections- compliance- enforcement- and- criminal- investigations/ warning- letters/ eyepoint- pharmaceuticals- inc- 679747- 07122024 (read 8 November 2026) - 15Certain Ophthalmic Products: Policy Regarding Compliance With 21 CFR Part 4, guidance, FDA, March 2022. https:/
/ www. fda. gov/ media/ 157067/ download (read 8 November 2026) - 16Unique Device Identifier (UDI) Requirements for Combination Products, draft guidance, FDA, June 2025. https:/
/ www. fda. gov/ media/ 187245/ download (read 8 November 2026) - 17Essential Drug Delivery Performance Characteristics for Devices Intended to Deliver Drugs and Biological Products, draft guidance, FDA, October 2026. https:/
/ www. fda. gov/ media/ 179545/ download (read 8 November 2026) - 18Regulation (EU) 2017/745 on medical devices, EUR-Lex. https:/
/ eur- lex. europa. eu/ legal- content/ EN/ TXT/ HTML/ ?uri=CELEX:32017R0745 (read 8 November 2026) - 19Directive 2001/83/EC on medicinal products for human use, Article 46(f), EUR-Lex. https:/
/ eur- lex. europa. eu/ legal- content/ EN/ TXT/ HTML/ ?uri=CELEX:02001L0083- 20220101 (read 8 November 2026) - 20Guideline on quality documentation for medicinal products when used with a medical device, EMA, 22 July 2021. https:/
/ www. ema. europa. eu/ en/ documents/ scientific- guideline/ guideline- quality- documentation- medicinal- products- when- used- medical- device- first- version_ en. pdf (read 8 November 2026) - 21Borderlines between medical devices and medicinal products, MHRA, last updated 31 December 2020. https:/
/ assets. publishing. service. gov. uk/ media/ 5fedc5a7e90e0776ab4e2069/ Borderlines_ between_ medical_ devices_ and_ medicinal_ products. pdf (read 8 November 2026)
AQuestions and answers
Which FDA centre leads on a combination product?
CDER when the primary mode of action is a drug, CDRH when it is a device, and CBER or CDER when it is a biological product, depending on which of them reviews that biologic. The primary mode of action is the one expected to contribute most to the therapeutic effect. If that is unclear, a sponsor can ask the Office of Combination Products for an informal pre-request for designation or a formal request for designation. The lead centre runs premarket review and leads CGMP compliance, but it does not decide which quality system route your site uses.
Does a co-packaged kit need both a drug and a device quality system?
Part 4 applies to the kit, but not always both systems in full. If every item is legally marketed on its own and packed unchanged, the kit maker only covers its own assembly, packaging, labelling and any sterilisation. If it repackages, relabels or changes an item’s intended use, it must cover the constituent parts too, and it can use either streamlined route to do so.
Who holds design controls when a CDMO fills a client’s prefilled syringes?
Whoever does the design work is a manufacturer for that activity, which is usually the product owner or a specification developer it appoints. The filling site still needs the design outputs it builds to, and FDA expects the design history file to be reachable during an inspection even when it sits elsewhere. Write the split into the quality agreement so each party knows which records it must produce.
Can we still rely on FDA’s 2017 combination product CGMP guidance?
Yes, for how FDA reads Part 4: its scenarios, edge cases and Part 211 discussion still stand. Its device citations do not. Where it cites 820.20, 820.30, 820.50, 820.100, 820.170 or 820.200, read the matching ISO 13485 clauses now named in 21 CFR 4.4(b)(1), and say so in any procedure that quotes the guidance.
Does Part 4 apply to combination products in clinical trials?
Partly. Phase 1 production of the drug part is generally exempt from Part 211, though not from the statutory duty to follow good manufacturing practice, and the exemption ends once the product is used in phase 2 or 3. An investigational device part is exempt from most of Part 820 but not from design and development. The postmarket reporting rules in subpart B do not apply until the product is authorised.