21 CFR Part 4 Combination Products & Human Factors Guide

Combination products, medical products that combine two or more of a drug, device, and biological product into a single therapeutic offering, are governed in the United States by a distinct regulatory chapter: 21 CFR Part 4. Finalized on January 22, 2013 and effective July 22, 2013, Part 4 Subpart A sets out current good manufacturing practice (CGMP) requirements for combination products (^[1]), and Hogan Lovells describes the regulation as establishing "a streamlined framework for both single-entity and co-packaged combination products" to avoid duplicative drug and device requirements (^[2]). A combination product, defined at 21 CFR 3.2(e), is classified into one of four statutory categories, most commonly a "single-entity" product such as a prefilled syringe or drug-eluting stent, or a "co-packaged" convenience kit (^[3]). Jurisdiction over review turns on the product's Primary Mode of Action (PMOA), defined in peer-reviewed literature as "the single mode of action that contributes most to the overall intended therapeutic effects," which FDA's Office of Combination Products (OCP) uses to assign a lead center among its drug, device, and biologics centers (^[4]).

Two structural developments define the current compliance landscape. First, FDA's Quality Management System Regulation (QMSR), published February 2, 2024, replaced the legacy device Quality System Regulation with a framework built on ISO 13485:2016, and became effective on February 2, 2026; Greenberg Traurig calls it "the first significant revision to the QSR since 1996" (^[5]), while Covington & Burling notes that "manufacturers are not required to obtain certification to ISO 13485" despite the harmonization (^[6]). Second, FDA finalized "Application of Human Factors Engineering Principles for Combination Products: Questions and Answers" in September 2023, and trade publication MD+DI reports that under this guidance "combination product critical tasks reflect the use-related risks resulting from both the drug and device constituent parts" (^[7]). FDA's human-factors guidance recommends a general practical minimum of 15 participants per distinct user population for validation testing, with product-specific justification for the sample size. It also recommends that validation testing avoid "think aloud" techniques because they can alter actual use behavior (^[8]).

Enforcement history illustrates the stakes. FDA's September 2017 warning letter to Meridian Medical Technologies, manufacturer of the EpiPen and EpiPen Jr. auto-injectors for Mylan, cited "significant violations of current good manufacturing practice (CGMP) requirements for combination products" (^[9]), and CNBC reported the letter disclosed the firm "received samples of 171 EpiPens related to complaints" that the device failed to activate between 2014 and 2017 (^[10]). Litigation over jurisdiction, including PREVOR v. FDA and Genus Medical Technologies v. FDA, has further tested the limits of FDA's classification discretion, with the D.C. Circuit vacating an FDA drug classification and remanding it for reconsideration in April 2021 (^[11]). Recent FDA data reported by the regulatory publication TheFDALawBlog found that "74% (25 of 31) of combination products were found to have a chemical PMOA" in fiscal year 2023, underscoring how heavily drug-led review still dominates classification outcomes (^[12]).

Commercially, a 2024 peer-reviewed review in Frontiers in Medical Technology states "the worldwide market for drug-device CPs was valued at US$138 billion" in 2023 (^[13]), a figure Grand View Research independently corroborates at $138.47 billion, projecting growth to $251.87 billion by 2030 (^[14]); MarketsandMarkets and BCC Research offer somewhat different figures depending on scope and base year, a discrepancy this report addresses directly rather than presenting a single false-precision number. Growth is increasingly driven by self-administered injectables: industry analysis from Kindeva notes the GLP-1 therapy market alone is "growing rapidly, with a projected value of $186.6 billion by 2032," pushing a "significant shift from traditional vial-based delivery to more patient-friendly options like prefilled syringes and autoinjectors" (^[15]) (^[16]). For manufacturers, the practical implication is that Part 4 compliance now sits at the intersection of drug CGMP, device QMSR, and combination-product-specific rules, a structural complexity that life-sciences technology consultancies increasingly build software and advisory practices around (^[17]).

Modern therapeutics increasingly do not fit neatly into the historical regulatory silos of "drug," "device," or "biologic." An insulin pen combines a mechanical injection device with a biologic or drug formulation. A drug-eluting cardiovascular stent combines a metal scaffold with an antiproliferative coating. A prefilled autoinjector combines a spring-loaded delivery mechanism with a life-saving medication such as epinephrine. The U.S. Food and Drug Administration (FDA) refers to these products collectively as combination products, a category formally defined at 21 CFR 3.2(e) and regulated through a dedicated chapter of the Code of Federal Regulations, 21 CFR Part 4 (^[3]).

Academic reviewers frame the underlying design challenge plainly: combination products "tend to present more design challenges than individual drugs, devices, or biologics" precisely because heterogeneous constituent parts, each with its own historical regulatory vocabulary, must function together as a single therapeutic system (^[18]). Before Part 4 existed, manufacturers of drug-device or biologic-device combinations faced genuine uncertainty about which set of manufacturing rules applied. The January 22, 2013 final rule closed that gap, and Hogan Lovells' regulatory analysis describes the resulting framework as designed "to avoid the redundancy that would occur" if manufacturers had to separately satisfy every drug and device requirement in full (^[19]).

This report explains, in detail, how 21 CFR Part 4 works: how FDA defines and classifies combination products, how the agency assigns jurisdiction through its Primary Mode of Action framework and Office of Combination Products, what CGMP and design control obligations apply under the streamlined and standalone compliance pathways, what human factors engineering and usability validation FDA expects before a product reaches patients, how postmarket safety reporting operates once a product is on the market, and what marketing application pathway a sponsor should expect to use. It also examines the regulatory system's recent evolution, particularly the transition to FDA's harmonized Quality Management System Regulation, which became fully effective on February 2, 2026, a milestone trade coverage describes as replacing "the Quality System Regulation (21 CFR Part 820) that had governed device manufacturing since 1996" (^[20]).

Because combination products sit across FDA's institutional boundaries, a genuinely cross-disciplinary compliance challenge follows. A pharmaceutical company launching a prefilled syringe must build not only drug-quality systems but also device design controls and usability engineering capabilities that, historically, have been the province of medical device firms; a peer-reviewed review of complex combination products notes that "current regulations do not fully address complex combination products" in emerging categories such as personalized 3D-printed drug-device scaffolds, underscoring that the framework is still evolving to keep pace with novel technology (^[21]). Life-sciences organizations navigating this convergence, including technology and advisory firms such as IntuitionLabs, a life-sciences and artificial intelligence consultancy and official Veeva Vault CRM X-Pages Partner, describe regulatory compliance as a foundational design requirement for the software and data systems they build for pharmaceutical and device clients rather than an afterthought layered on at the end (^[22]). The remainder of this report proceeds section by section through the statutory and regulatory architecture, the quantitative data on FDA review activity and market size, five named real-world cases illustrating how the framework operates in practice, and the implications of the current regulatory trajectory for manufacturers and their advisors.

The Statutory Definition and the Four Categories

FDA's regulations at 21 CFR 3.2(e) define a combination product using four distinct statutory categories rather than a single test. The first, and most commercially familiar, covers products "that are physically, chemically, or otherwise combined or mixed and produced as a single entity," such as a prefilled drug syringe or a drug-eluting stent (^[23]). A second category, the co-packaged or convenience kit product, involves "drug and device provided as individual constituent parts within the same package" rather than physically joined (^[24]). The remaining two categories cover "cross-labeled" products, separately packaged constituent parts that FDA's labeling designates for use only with another, individually specified product, including investigational drug-device combinations.

FDA lists prefilled drug delivery systems, including "prefilled drug syringe, auto-injectors, metered-dose inhalers, dry powder inhalers, nasal-spray, pumps, transdermal systems," as the textbook example of single-entity combination products (^[25]). Devices coated or impregnated with a drug form a separate cluster of examples, including contact lenses coated with a drug, drug-eluting stents, drug-eluting leads, and condoms with spermicide. Where classification gets genuinely difficult is at the boundary between a delivery mechanism and a mere container: American Pharmaceutical Review frames the test as turning on "whether the article is designed to deliver the drug it contains, or merely to hold it," a distinction that separates a combination product's device constituent from an ordinary drug packaging component (^[26]). Peer-reviewed literature notes this convergence exists because combination products carry "the potential to give greater therapeutic benefits than single-entity devices such as medicines and biologics," pairing a delivery mechanism's precision with a therapeutic agent's biological activity (^[27]).

Table 1 below summarizes the four statutory categories, illustrating why the classification a product receives at the outset determines nearly every downstream regulatory obligation it will face.

Category	Structural Definition	Representative Examples
Single-entity	Constituent parts physically, chemically, or otherwise combined into one inseparable product	Prefilled syringes, auto-injectors, drug-eluting stents, transdermal patches
Co-packaged (convenience kit)	Constituent parts packaged together but not physically joined	Diagnostic reagent-and-applicator kits, surgical kits pairing a drug and delivery device
Cross-labeled (investigational or marketed)	Separately packaged, individually specified products whose labeling requires use only with each other	An investigational drug labeled for use only with a specific approved infusion pump

The table underscores a point manufacturers frequently underestimate: classification is not a formality. A single-entity product and a cross-labeled product can contain identical therapeutic agents and devices yet trigger materially different CGMP pathways, application types, and postmarket reporting timelines, precisely because Part 4's compliance provisions, detailed in the prose above and cited to FDA's own typology, are keyed to these categories.

Primary Mode of Action and Lead-Center Assignment

Once a product is confirmed to be a combination product, FDA must decide which center leads its review. The deciding concept is the Primary Mode of Action (PMOA), which peer-reviewed literature defines as "the single mode of action that contributes most to the overall intended therapeutic effects" of the combination product (^[4]). Regulatory training publisher Greenlight Guru offers a similarly plain explanation for industry audiences: "the primary mode of action is the single mechanism that provides the primary therapeutic effect" of a combination product (^[28]). A 2005 FDA final rule codified the concept and "sets forth an algorithm the agency will use to assign" jurisdiction when the PMOA cannot be determined with reasonable certainty, with the first tier directing FDA to "assign the combination product to the agency component that regulates" other combination products presenting similar safety and effectiveness questions (^[29]) (^[30]).

The Office of Combination Products (OCP) administers this process. Hogan Lovells' regulatory history notes that "since its creation in 2002, FDA's Office of Combination Products" has been charged with resolving jurisdictional questions, and the office's core statutory function is "to classify medical products as drugs, devices, biological products or combination products and assign them to an FDA center for premarket review and regulation, where their classification or assignment is unclear or in dispute" (^[31]) (^[32]).

Sponsors facing genuine uncertainty about classification or jurisdiction can use a Request for Designation (RFD), a formal, binding process. The regulatory publication TheFDALawBlog explains that OCP "must" resolve an RFD "within 60 calendar days of filing... by determining the primary mode of action (PMOA)" (^[33]), and the same source reports that in fiscal year 2023, FDA's own data showed "74% (25 of 31) of combination products were found to have a chemical PMOA," a strong tilt toward drug-led jurisdiction that shapes which center, and therefore which marketing application type, most sponsors should expect (^[12]). A less formal Pre-RFD option, which Hogan Lovells notes FDA "implemented... in February 2018" and revised again in November 2025, lets a sponsor "obtain informal non-binding feedback regarding their combination product" before committing to the formal process (^[34]) (^[35]).

Jurisdiction disputes are not merely theoretical. FDA's own jurisdictional update on drug-eluting cardiovascular stents states that "FDA has concluded that the primary mode of action for the combination product is that of the device component," assigning the device center primary responsibility even though the agency has separately applied human drug Current Good Manufacturing Practices to the manufacture of the drug component of the combination product (^[36]). This dual-track outcome, device-led review paired with drug-quality obligations for a coating, is characteristic of how PMOA determinations play out across constituent parts even after a lead center is assigned, and is examined further in the case studies section below.

The Streamlined and Standalone Compliance Paths

The heart of Part 4's manufacturing framework is 21 CFR 4.4, which gives manufacturers of single-entity and co-packaged combination products two ways to demonstrate CGMP compliance. Under the first, the standalone approach, a firm complies "with each applicable regulation in its entirety," meaning full compliance with both the relevant drug CGMPs (21 CFR Parts 210 and 211, which apply to a combination product's non-medical-gas drug constituent under 21 CFR 4.3) and the device quality system requirements (^[37]) (^[38]). Under the second, the streamlined approach, a firm may instead demonstrate compliance "of either the drug CGMPs or the QS regulation, rather than both," provided it layers in specified supplemental provisions drawn from the regulation it did not use as its base (^[39]).

Hogan Lovells summarizes the underlying rationale for industry readers: "FDA has established a streamlined approach to avoid the redundancy that would occur" if manufacturers had to fully satisfy both drug and device quality systems in parallel (^[19]). The regulatory text at 21 CFR 4.4 requires that "compliance with all applicable current good manufacturing practice requirements for the combination product shall be achieved through the design and implementation of a current good manufacturing practice operating system" (^[40]). When a manufacturer builds its operating system on the drug CGMPs, it must incorporate specific ISO 13485 provisions, including "General requirements and management responsibility. Clause 4.1, Clause 5 and its subclauses, Clause 6.1 of ISO 13485" (^[41]). FDA's guidance clarifies that under this drug-based streamlined option, "the manufacturer must demonstrate compliance with applicable drug CGMPs plus the six specified provisions from part 820, as applicable, but the manufacturer does not need to demonstrate compliance with the other specific provisions in part 820" (^[42]).

Table 2 below lays out the practical differences between the standalone and the two streamlined variants, since the choice materially affects both the initial system-design burden and the ongoing inspection scope a manufacturer should expect.

Compliance Approach	Base Regulatory System	Supplemental Requirements Layered In	Best Suited For
Standalone (full dual compliance)	Both drug CGMPs (21 CFR 210/211) and the device QMSR in their entirety	None; both systems fully implemented	Firms already operating mature, separate drug and device quality systems, e.g., large diversified manufacturers
Streamlined, drug-CGMP based	21 CFR 210/211 (drug CGMP)	Six specified device provisions per FDA's compliance guidance ([43])	Drug-led combination products, e.g., prefilled syringes manufactured primarily as pharmaceutical products
Streamlined, device-QMSR based	Device QMSR (incorporating ISO 13485:2016)	Specified drug CGMP provisions applicable to the drug constituent	Device-led combination products, e.g., drug-eluting stents manufactured primarily as devices

As the table shows, the streamlined approach does not eliminate cross-disciplinary obligations; it simply lets a manufacturer choose which regulatory language frames its primary quality system while still requiring it to absorb targeted provisions from the other. West Pharmaceutical Services, a delivery-device manufacturer, frames the practical reality for combination product engineers plainly: design teams "operate under strict ISO 13485 certified quality system and FDA 21 CFR 820.30 requirements" simultaneously, not one or the other in isolation (^[44]).

Design Controls, the QMSR Transition, and CAPA

Design controls under 21 CFR 820.30 require device manufacturers to "establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met," spanning design and development planning, design input and output, review, verification, validation, transfer, and a Design History File (^[45]). For combination products, FDA's guidance explicitly extends this framework beyond devices alone: "For combination products that include a device constituent part, design controls must be applied to the combination product," citing 21 CFR 4.4 directly (^[46]). Because drug development historically has not used a formal "design controls" vocabulary, FDA acknowledges the terminology gap directly, noting that "many pharmaceutical development practices (for example, Quality by Design principles) can be leveraged and built upon when demonstrating compliance with design controls for a combination product" (^[47]). An industry white paper affiliated with the Parenteral Drug Association frames Quality by Design's practical value for delivery-device teams: "it really enables manufacturers to focus on what matters the most" for patient safety and efficacy rather than spreading engineering effort evenly across every design parameter (^[48]).

The most consequential recent change to this landscape is the Quality Management System Regulation (QMSR). FDA's February 2, 2024 final rule was issued "to amend the device current good manufacturing practice (CGMP) requirements of the Quality System (QS) regulation to harmonize and modernize the regulation" by incorporating ISO 13485:2016 by reference (^[49]), and confirms the rule "is effective February 2, 2026" (^[50]). Law firm K&L Gates notes the device quality regulation being replaced "had not been significantly revised since 1996," and Greenberg Traurig independently corroborates that the QMSR is "the first significant revision to the QSR since 1996," underscoring the scale of the modernization (^[51]) (^[5]). Trade publication Quality Magazine details the practical scope of the change: "thirteen of the fifteen subparts of the original QSR" have been marked reserved in favor of ISO 13485:2016 clauses, though the same analysis cautions that "FDA inspections do not result in ISO certificates," meaning the agency retains full independent inspection authority regardless of a firm's certification status (^[52]) (^[53]). Covington & Burling's analysis makes the same point from a legal-compliance angle, clarifying that "manufacturers are not required to obtain certification to ISO 13485" even though the underlying substantive requirements now track that standard (^[6]). An FDA spokesperson quoted by industry outlet PharmaCircle framed the rationale in market-access terms: "harmonizing differing requirements helps sponsors trying to bring their devices into market," including combination products with a device constituent (^[54]).

The transition also carries operational, not just terminological, consequences. MD+DI's coverage of the QMSR rollout reports that regulatory affairs consultants describe a new requirement for "distinct procedures for corrective action and preventive action," since ISO 13485 splits CAPA into two formal processes where the legacy QSR allowed a single combined procedure (^[55]), while the same coverage notes FDA's preamble is explicit that the risk-management standard "ISO 14971 is not incorporated by reference," so combination product manufacturers are not strictly bound to it even though many already use it as a de facto risk-management framework (^[56]). As of this report's publication, FDA's own current guidance page confirms the agency "began utilizing the inspection process described in the updated Inspection of Medical Device Manufacturers Compliance Program: 7382.850," retiring the prior inspection approach (^[57]), consistent with Sutton's Creek's independent confirmation that "the associated FDA Quality System Inspection Technique (QSIT) inspection guideline will also be withdrawn" (^[58]), which also cautions that "an ISO 13485 certificate does not prevent FDA from questioning why supplier corrective actions stalled" (^[59]). The final rule amended both the device quality regulation and 21 CFR Part 4 simultaneously, and the codified text of Part 4 Subpart A itself confirms the amendment, noting it was "amended at 89 FR 7522, Feb. 2, 2024; 89 FR 51766, June 18, 2024" (^[60]).

Importantly, Hogan Lovells' analysis states the QMSR "expressly states that it does not 'impact the CGMP requirements for combination products,'" even though "the QMSR's harmonization with ISO 13485 introduces certain changes" to how compliance is documented and assessed, and the firm separately notes the broader intent of the rule "to establish a globally consistent approach to quality management for medical devices" (^[61]) (^[62]). Independent regulatory analysis at InsiderTheFDAGroup confirms that "the combination product compliance program references the medical device compliance program directly," meaning that "if a product contains a device component, the QMSR applies" to it regardless of which center leads its review (^[63]).

Corrective and Preventive Action (CAPA) processes present a distinct multi-facility challenge for combination product manufacturers, who often manufacture the drug and device constituent parts at different sites. FDA's guidance permits flexibility here: "A CAPA system that is shared between facilities, or facility-specific CAPA systems with established links between them, may facilitate handling of issues requiring multi-facility collaboration" (^[64]). Design controls apply even during clinical development: because "investigational devices are exempt from part 820 except for design control requirements under 21 CFR 820.30," that carve-out extends to investigational combination products with a device constituent part (^[65]). A gmp-compliance.org analysis of a 2017 combination product warning letter illustrates how this bridging works in enforcement practice, noting FDA cited the drug failure-investigation regulation while a footnote separately observed that "21 CFR 820.100 (CAPA)" should be taken into account, the device-side corrective and preventive action requirement (^[66]).

FDA's Core Human Factors Framework

Human factors engineering (HFE), referred to internationally as usability engineering (UE), evaluates how real users interact with a medical product's interface to identify and mitigate use errors before they reach patients. The Journal of the Parenteral Drug Association observes that "interest in human factors usability testing has seen a sharp increase" among manufacturers of injectable combination products, reflecting nearly two decades of accumulated regulatory experience with use-related device failures (^[67]), and the same journal notes plainly that "device risk hazards are likely due to device usability" rather than mechanical unreliability alone (^[68]).

FDA's foundational guidance, "Applying Human Factors and Usability Engineering to Medical Devices," issued February 3, 2016, harmonizes its core definitions with the international standard "ANSI/AAMI/IEC 62366-1:2015+AMD1:2020" (^[69]). That underlying international standard itself, per the International Organization for Standardization, exists to "specify, develop and evaluate the USABILITY of a MEDICAL DEVICE as it relates to SAFETY," the technical foundation both FDA and the European Union reference for usability engineering (^[70]). A critical task is "a user task which, if performed incorrectly or not performed at all, would or could cause serious harm to the patient or user" (^[71]), a plain-language definition Research Collective's industry explainer echoes for combination products specifically: a critical task is one that, "if done wrong or not done at all, could harm the patient or user" (^[72]). A use-related risk analysis (URRA) is the systematic use of available information to identify use-related hazards and estimate use-related risk, the analytical process manufacturers use to surface which tasks are, in fact, critical.

Human Factors Validation Testing: FDA Recommendations

FDA's guidance distinguishes exploratory formative evaluation from validation testing, but guidance describes FDA's current thinking and does not establish legally binding requirements. For human-factors validation testing, FDA recommends a general practical minimum of 15 participants per distinct user population; the appropriate sample size should be justified for the device and available preliminary analyses (^[8]). FDA also recommends that validation testing not use the "think aloud" method because it can change actual use behavior, while it may be useful in formative testing. Academic literature describes the commonly used N=15-per-distinct-group convention, distinct from small, iterative formative evaluations earlier in design (^[73]).

For combination products specifically, this validation obligation is embedded directly in the design control process. FDA's guidance requires that "design validation must include a risk analysis where appropriate," and independent regulatory science firm Exponent's analysis of FDA's September 2023 final guidance confirms that "design controls should include a use-related risk analysis (URRA) of the combination product as a whole," not merely of its individual constituent parts in isolation (^[74]) (^[75]). Trade publication MD+DI's coverage of the same finalized guidance reports that FDA frames "combination product critical tasks" as reflecting "the use-related risks resulting from both the drug and device constituent parts" together, rather than evaluating each constituent's usability separately (^[7]).

Why Human Factors Matters: Documented Use Errors and Institutional Friction

The stakes of getting human factors wrong for combination products are well documented in the peer-reviewed literature. A 2018 systematic literature review covering PubMed and Scopus publications from 2000 to 2017 identified "232 instances of use errors and close calls, which were classified into 10 main categories and then 39 subcategories" across 38 eligible publications on auto-injection devices (^[76]). Among the most consequential failure modes documented was "unintentional injection or a needle-stick injury caused by a use error related to incorrect orientation of the device," a hazard directly tied to the physical interface design rather than the drug itself (^[77]). A separate peer-reviewed narrative review of the Auvi-Q epinephrine auto-injector's development process observed more broadly that "device labeling and usability are critical and have the potential to impact clinical outcomes" for drug-device combination products (^[78]). A more recent 2025 qualitative literature review of 80 studies similarly found that "incorporating HCD in DDCP design leads to significant improvements in safety and usability," where human-centered design (HCD) is applied specifically to drug-device combination product (DDCP) development (^[79]).

An institutional dimension compounds the technical challenge. A conference paper published through the Human Factors and Ergonomics Society describes a structural tension between FDA centers reviewing combination products: "each FDA Center's requirement often presents a Catch-22, particularly when product Sponsors postpone usability evaluations," since the device center's focus on interface usability and the drug center's focus on labeling comprehension can pull design and testing priorities in different directions if not coordinated early (^[80]). A broader, quantitative signal comes from FDA's own adverse event data: a peer-reviewed 2020 analysis of the agency's Manufacturer and User Facility Device Experience (MAUDE) database covering 2010 to 2018 found that "use error is significantly represented in adverse event reporting, constituting 28.1% of reports labeled with device problem codes" across the device population generally (^[81]). An industry white paper affiliated with the Parenteral Drug Association corroborates this pattern from a design perspective, noting that delivery device design "relies on human factors (HF) data in many cases to guide reduction of risk" of medication error before a product ever reaches the market (^[82]).

Subpart B: Postmarketing Safety Reporting

Once a combination product reaches the market, 21 CFR Part 4, Subpart B, governs how safety information must flow between constituent-part applicants and to FDA. This subpart, added by a final rule published December 20, 2016, "does not apply to investigational combination products, combination products that have not received marketing authorization, or to persons other than combination product applicants and constituent part applicants," meaning its obligations activate only after approval (^[83]). Under 21 CFR 4.103, an applicant that learns of "a death, serious injury, or adverse experience" associated with the combination product "must provide the information to the other constituent part applicant(s) for the combination product no later than 5 calendar days of your receipt of the information" (^[84]). The rule also harmonizes timelines that would otherwise conflict between drug and device reporting regimes: standard drug adverse-event "fifteen-day reports as described in Section 314.80" must instead "be submitted within 30 calendar days instead of 15 calendar days if your combination product received marketing authorization under a device application" (^[85]).

FDA has also shown willingness to phase in Subpart B's operational burden rather than enforce it rigidly from day one. Law firm client alert publisher JD Supra reported that in a March 2018 compliance policy, "the FDA does not intend to enforce certain requirements under the PMSR final rule," giving applicants additional time to build the reporting and IT systems needed to meet the new cross-applicant notification deadlines (^[86]).

The Single-Application Marketing Pathway

A defining feature of combination product regulation is that sponsors generally do not need to submit separate applications for each constituent part. The governing statute directs FDA to "conduct the premarket review of any combination product under a single application, whenever appropriate" (^[87]). Which application type a sponsor uses, a New Drug Application, Biologics License Application, Premarket Approval, 510(k), or De Novo classification, generally follows the product's PMOA determination, and separate applications remain the exception, reserved mainly for cross-labeled combination products whose constituent parts are separately distributed and individually specified. This statutory architecture traces to Section 3038 of the 21st Century Cures Act, enacted in December 2016, which amended the FD&C Act's combination product coordination provisions.

Inter-Center Coordination

Because a single combination product application may require simultaneous expertise from two or three FDA centers, coordination mechanisms matter as much as the underlying substantive rules. FDA's Inter-Center Consult Request (ICCR) process exists to "request, receive, process, and track the progress of Inter-Center Consult Requests" between the agency's drug, device, and biologics centers, and covers such consults for "combination products and non-combination products" alike (^[88]). FDA discusses ICCR volume periodically at industry conferences; a slide deck from FDA's Office of Combination Products presented at the AFDO/RAPS Combination Product Summit and archived by the International Pharmaceutical Quality journal references "Intercenter Consult Request (ICCR) Program" data for fiscal year 2023, illustrating that the agency actively tracks and reports this coordination workload to industry stakeholders (^[89]).

Before the modern ICCR structure existed, FDA's centers relied on older bilateral instruments: in 1991, the centers "entered into three Intercenter Agreements," bilateral memoranda covering jurisdictional questions that predate the formal combination products framework, which FDA now describes candidly as carrying limited legal weight, since these older agreements constitute guidance that is not binding on the public or the agency (^[90]).

Translating Part 4's requirements into an operating quality system requires manufacturers to sequence several distinct workstreams rather than treating combination product compliance as an extension of either a pure drug or pure device program. A practical build-out generally follows this order:

• Classify early. Determine the product's statutory category under 21 CFR 3.2(e) and, where jurisdiction is genuinely uncertain, use a Pre-RFD for informal feedback before committing to a formal, binding Request for Designation, keeping OCP's statutory 60-day RFD determination clock in mind when planning submission timing.
• Select a CGMP compliance path deliberately. Choose between the standalone and streamlined approaches under 21 CFR 4.4 based on which constituent part, drug or device, dominates the manufacturing and quality risk profile, rather than defaulting to whichever team built the product first (^[40]).
• Build design controls that span the whole product. Apply design control discipline to the combined product, not merely to the device housing, treating ISO 13485 conformance and 21 CFR 820.30 as concurrent obligations rather than alternatives (^[44]).
• Run a formal use-related risk analysis before locking the design. Treat the combination product as a single system for URRA purposes, since regulatory science reviewers confirm FDA expects a "use-related risk analysis (URRA) of the combination product as a whole," not siloed drug and device analyses (^[75]).
• Budget for human-factors validation testing with adequate sample sizes. FDA's nonbinding guidance describes 15 participants as a general practical minimum for each distinct user population, subject to a higher number when warranted by the device and preliminary analyses. For testing intended to demonstrate safe and effective use in the United States, FDA says participants should reside in the United States, with case-by-case exceptions supported by sound rationale (^[91]).
• Split CAPA into distinct corrective and preventive procedures. Under the QMSR, plan for separate corrective- and preventive-action procedures rather than the single combined process the legacy QSR allowed (^[55]).
• Map postmarket reporting timelines against both regulatory clocks. Build a single tracking system for the 5-day inter-applicant notification requirement and the harmonized 30-day drug adverse-event timeline for device-led products (^[84]).
• Treat ISO 13485 conformance as necessary but not sufficient. Remember that certification alone will not satisfy an FDA inspector, since "an ISO 13485 certificate does not prevent FDA from questioning why supplier corrective actions stalled" during an audit (^[59]).

This sequencing matters because Part 4 compliance failures rarely stem from ignorance of a single rule; they stem from treating drug quality, device quality, and combination-product-specific requirements as three separate projects that are reconciled only at the point of an FDA inspection, a pattern visible in the enforcement history discussed below.

FDA Review Activity: A Five-Year Trend

FDA's Office of Combination Products has published Performance Reports to Congress annually for fiscal years spanning FY2019 through FY2024. Original combination product submission volume has been notably volatile: it rose to a five-year high of 735 applications in FY2023 before falling to 645 original submissions in FY2024, while formal RFD decision volume stayed consistently low, with OCP issuing two combination product RFD decisions in FY2022, four in FY2023, and five in FY2024, alongside a comparable number of non-combination-product decisions each year (^[92]). This low volume of formal decisions is consistent with TheFDALawBlog's finding that "74% (25 of 31) of combination products were found to have a chemical PMOA" in FY2023, indicating that most classification outcomes tilt toward drug-led review once a case does reach a formal determination (^[12]).

Inter-center coordination volume has been comparatively stable, with OCP recording between roughly 1,146 and 1,202 consults for combination products annually across FY2020 through FY2024, including 1,162 in FY2024 itself (^[93]). Historically, CDER has dominated combination product review, and prefilled drug delivery devices and systems have consistently been the single most common combination product category FDA reviews, consistent with the market growth in autoinjectors and prefilled syringes documented below.

Market Size: A Genuine Discrepancy Across Research Firms

Commercial market-size estimates for combination products vary substantially by scope, base year, and methodology, and this report presents that variance transparently rather than collapsing it into a single misleadingly precise figure. A peer-reviewed 2024 review in Frontiers in Medical Technology states that "the worldwide market for drug-device CPs was valued at US$138 billion" in 2023 (^[13]), a figure Grand View Research independently corroborates at $138.47 billion, projecting growth to $251.87 billion by 2030, a 9.0 percent compound annual growth rate (^[14]), and finds North America held "the revenue share of 41.31% in 2023," the largest of any region (^[94]). MarketsandMarkets, using a different base year and methodology, projects the same broad category will reach $379.17 billion by 2030, up from $243.02 billion in 2025 (^[95]). BCC Research offers a third figure, projecting the market will "grow from $129.4 billion in 2024" to "$199.8 billion by the end of 2029" (^[96]).

Table 3 below places these originator estimates side by side, alongside two narrower, delivery-device-specific figures from Grand View Research, since prefilled syringes and autoinjectors are frequently cited in discussions of combination products but represent a subsegment rather than the full drug-device combination market.

Research Source	Market Scope	Base Year Value	Forecast Year Value	CAGR
Frontiers in Medical Technology (academic)	Global drug-device combination products	$138B (2023)	Not projected	Not stated
Grand View Research	Global drug-device combination products	$138.47B (2023)	$251.87B (2030)	9.0%
MarketsandMarkets	Global drug-device combination products	$243.02B (2025)	$379.17B (2030)	9.3%
BCC Research	Global drug-device combinations	$129.4B (2024)	$199.8B (2029)	9.1%
Grand View Research	Global autoinjectors (subsegment)	$10.2B (2025)	$28.3B (2033)	13.8%
Grand View Research	Global prefilled syringes (subsegment)	$8.72B (2025)	$18.12B (2033)	9.7%

The convergence between the independent academic estimate and Grand View Research's commercial estimate, both near $138 billion for 2023, lends confidence to that figure as a reasonable anchor, even though the MarketsandMarkets and BCC Research estimates diverge by tens of billions of dollars due to differing base years and category scope. The two narrower Grand View Research subsegments, autoinjectors and prefilled syringes, both show markedly higher growth rates than the broader category, at 13.8 percent and 9.7 percent respectively (^[97]) (^[98]), consistent with delivery-device manufacturer Kindeva's observation of a "significant shift from traditional vial-based delivery to more patient-friendly options like prefilled syringes and autoinjectors," driven substantially by GLP-1 receptor agonist therapies whose market Kindeva projects will reach "$186.6 billion by 2032" (^[16]) (^[15]).

The EpiPen and Meridian Medical Technologies Warning Letter

The most consequential public enforcement action involving 21 CFR Part 4 concerns the EpiPen and EpiPen Jr. epinephrine auto-injectors, manufactured by Meridian Medical Technologies, a Pfizer company, for Mylan. On September 5, 2017, FDA issued a warning letter to Meridian's Brentwood, Missouri facility citing "significant violations of current good manufacturing practice (CGMP) requirements for combination products," explicitly invoking 21 CFR part 4, 21 CFR parts 210 and 211 (drug CGMP), and 21 CFR part 820 together, the exact three-way regulatory intersection Part 4 was designed to address (^[9]). Independent news coverage corroborated the severity of FDA's findings from multiple angles: CNBC reported the warning letter disclosed Meridian "received samples of 171 EpiPens related to complaints" that the device failed to activate between 2014 and 2017 (^[10]), while The Washington Post reported the manufacturer "failed to properly investigate more than 100 complaints" of device malfunction during life-threatening emergencies, including cases preceding patient deaths (^[99]), and Bloomberg similarly reported that Pfizer's Meridian unit "neglected hundreds of complaints about defects in the auto-injecting pens" (^[100]). Pfizer defended the product's broader safety record at the time, noting the company had "shipped more than 30 million EpiPen Auto-Injectors globally" (^[101]).

Regulatory trade publication RAPS reported that Meridian had already "recalled 13 lots of EpiPens over concerns that a defective part" could prevent activation months before the warning letter landed (^[102]), and separately noted the episode arrived amid public criticism of Mylan for "raising the price of its EpiPen by more than 400%" (^[103]). Taken together, the Meridian case is the clearest public illustration of what happens when a manufacturer's CAPA and complaint-handling systems fail to meet Part 4's combination-product-specific CGMP expectations: a life-saving emergency device whose failure mode was documented internally, and independently reported across multiple news outlets, for years before triggering a nationwide recall.

Drug-Eluting Cardiovascular Stents: A Device-Led Jurisdictional Determination

Drug-eluting stents illustrate how PMOA determinations can assign a product entirely to one review center while still layering in obligations from the other, as FDA's own jurisdictional update on this product category establishes in the definitions section above. This case demonstrates in practice the streamlined compliance architecture described earlier in this report: a single lead center for premarket review under the PMA pathway, paired with constituent-specific drug-CGMP manufacturing obligations for the coating that survive the jurisdictional assignment.

Classification Litigation: PREVOR v. FDA and Genus Medical Technologies v. FDA

Two federal court cases illustrate that FDA's classification and PMOA determinations are not immune from judicial challenge. In PREVOR v. FDA, a federal district court reviewed FDA's designation of Diphoterine Skin Wash, a chemical-burn treatment product marketed outside the United States "as a device since 1996 and registered/licensed as a medical device" in other jurisdictions, which FDA had instead classified domestically as a drug-device combination product with a drug primary mode of action (^[104]). The court "concludes that FDA acted arbitrarily and capriciously in designating DSW as a drug-device combination product with a drug primary mode of action," a rare instance of judicial reversal of an FDA classification decision (^[105]).

A second, more recent case reached the D.C. Circuit Court of Appeals. In Genus Medical Technologies LLC v. FDA, the appellate court considered "whether the U.S. Food and Drug Administration (FDA) enjoys discretion to classify" as a drug a contrast imaging agent, Vanilla SilQ, that also met the statutory definition of a device (^[106]). In its filings, "FDA's Office of Combination Products said Genus's Vanilla SilQ products meet the definitions for both a device and a drug" (^[107]). The D.C. Circuit disagreed: on April 16, 2021, "the court thus vacated FDA's decision to classify Genus's product as a 'drug,' and remanded the issue to FDA," a ruling that meaningfully narrowed FDA's asserted classification discretion for products meeting both statutory definitions (^[11]). Together, PREVOR and Genus show that OCP's classification and PMOA authority, while broad, operates within judicially enforceable limits when a sponsor believes the agency has misapplied the statutory framework.

Wegovy (Semaglutide): Human Factors Review as a Documented Part of Approval

FDA's approval record for Wegovy (semaglutide) injection provides a concrete, primary-source illustration of human factors review functioning as an integral part of a modern combination product approval rather than an afterthought. FDA's official Summary Review for New Drug Application 215256 lists a dedicated "OSE/DMEPA, Human Factors" discipline reviewer among the FDA staff who evaluated the application (^[108]), confirming that human factors expertise was formally represented on the review team. The same document records a "PDUFA Goal Date June 4, 2021" for the application, and FDA approved Wegovy, an injectable GLP-1 receptor agonist delivered via a prefilled, single-entity combination product, for chronic weight management that same day (^[109]). Enforcement attention on delivery-device combination products has not been limited to injectables, either: trade publication ExpertBriefings reported EyePoint Pharmaceuticals received an FDA warning letter and a prior Form 483 tied to CGMP shortfalls at manufacturing associated with its Yutiq ocular implant, a drug/device combination product, after the company had earlier "sold the product rights for the drug/device product to Alimera" (^[110]), indicating that Part 4 enforcement risk extends well beyond autoinjectors into implantable delivery devices. Wegovy's approval record demonstrates, through a primary FDA source rather than a secondary summary, that human factors review is embedded directly in the standard NDA review discipline structure for a self-administered injectable combination product, exactly the category of product the 2016 and 2023 combination-product human factors guidance documents were designed to address, and exactly the delivery format driving the GLP-1-fueled growth documented in the data section above.

FDA's combination product guidance agenda shows the framework is actively evolving rather than settled. On June 28, 2024, FDA published a draft guidance introducing the Essential Drug Delivery Outputs (EDDO) framework, intended to standardize how the agency reviews drug-delivery performance data for both stand-alone delivery devices and combination products, and roughly three weeks later issued a revised final guidance on Application User Fees for Combination Products replacing the prior version issued in 2005 (^[111]). FDA's Office of the Chief Medical Officer 2026 guidance agenda continues to list planned updates to combination-product CGMP guidance as an active priority, signaling that the compliance target manufacturers must hit will keep shifting through at least the remainder of the decade.

The QMSR transition is the single most significant near-term structural change. Now that the regulation is fully effective as of February 2, 2026, manufacturers should expect inspection findings to be framed increasingly in ISO 13485 terminology, even though, as Hogan Lovells emphasizes, the rule "does not impact the CGMP requirements for combination products" at a substantive level (^[61]). Independent regulatory analysis published in January 2026 frames the compliance risk directly: "combination products sit at the intersection of drug CGMPs, device QSR/QMSR, and Part 4 integration requirements," a structural position that this analysis affirms concentrates inspection and enforcement risk precisely at the seams between regulatory systems rather than within any single system alone (^[112]). Broader FDA enforcement activity offers a supporting, if indirect, signal: trade outlet Pharmaceutical Online reported FDA issued a "total of 303 warning letters (WLs) to drug and biologics products in Fiscal Year 2025," a 59 percent year-over-year increase, though this figure spans all drug and biologics enforcement rather than combination products specifically (^[113]).

For manufacturers, the practical implication is that combination product compliance now requires genuinely integrated program design rather than bolted-together drug and device quality systems. This is precisely the kind of cross-functional, data-intensive compliance challenge that has drawn technology and consulting investment from firms serving the life-sciences sector. IntuitionLabs, for instance, positions itself around embedding regulatory awareness directly into the enterprise software and data systems pharmaceutical and device organizations already use for quality, safety, and commercial operations, an approach the firm frames around ensuring underlying platforms carry "built-in compliance with FDA, EMA, and global regulations" rather than treating compliance as a separate downstream check (^[17]). Whether such technology-enabled approaches meaningfully reduce combination-product-specific compliance risk is, as of this report's publication, better supported by the structural logic of the QMSR and Part 4 convergence than by any published, independent outcome study, and manufacturers should treat vendor and consultancy claims in this space with the same evidentiary skepticism applied to any other unverified market claim.

Looking forward, three developments merit close monitoring by combination product sponsors: continued OCP guidance activity on the EDDO framework, the practical effect of the QMSR's terminology and inspection-program changes on Form 483 observation patterns for combination products specifically, and whether the roughly three-quarters tilt toward chemical PMOA determinations that TheFDALawBlog documented for FY2023 persists as GLP-1 and other self-administered injectable therapies continue to grow (^[12]). None of these trends currently point toward regulatory simplification; each points toward continued, incremental convergence of drug and device quality expectations under Part 4's existing streamlined-versus-standalone architecture.

What is 21 CFR Part 4? It is the chapter of FDA's regulations that governs combination products, drug-device, biologic-device, or drug-biologic products regulated together. Subpart A covers CGMP requirements, effective July 22, 2013, and Subpart B covers postmarketing safety reporting, effective from a December 2016 final rule (^[1]).

What counts as a combination product? Any product combining a drug, device, or biologic constituent, defined at 21 CFR 3.2(e), across four statutory categories: single-entity, co-packaged, and two cross-labeled variants (^[3]).

How does FDA decide which center reviews a combination product? Through the Primary Mode of Action, "the single mode of action that contributes most to the overall intended therapeutic effects," determined by the Office of Combination Products, with a formal algorithm applied when PMOA cannot be determined with reasonable certainty (^[4]).

What human factors validation testing does FDA require for combination products? Summative usability testing with a minimum of 15 participants per distinct user population, conducted without think-aloud protocols, following a use-related risk analysis that evaluates the combination product "as a whole" rather than its constituent parts separately (^[8]) (^[75]).

How do design controls overlap with human factors engineering for combination products? Design controls must be applied to the entire combination product, and use-related risk analysis, a human factors discipline, is an explicit input to the design validation risk analysis FDA expects under those controls, reflecting risks "resulting from both the drug and device constituent parts" (^[7]).

What is the difference between the streamlined and standalone CGMP approaches? Standalone requires full compliance with both drug CGMPs and the device QMSR; the streamlined approach, described by Hogan Lovells as designed "to avoid the redundancy that would occur" under full dual compliance, lets a manufacturer build its quality system around one regulation while incorporating specified supplemental provisions from the other (^[19]).

Can a combination product be marketed under one FDA application? Yes, in most cases. FDA's governing statute directs the agency to review a combination product "under a single application, whenever appropriate," with the application type keyed to the product's PMOA; separate applications are generally reserved for cross-labeled products (^[87]).

How long does an FDA Request for Designation take? FDA must resolve an RFD "within 60 calendar days of filing... by determining the primary mode of action," and FY2023 data show 74 percent of resolved cases were found to have a chemical, drug-led PMOA (^[12]).

Has the FDA Quality Management System Regulation (QMSR) changed CGMP requirements for combination products? The QMSR "does not impact the CGMP requirements for combination products" at a substantive level, but it does change terminology, documentation structure, and the inspection program FDA uses to assess compliance, effective February 2, 2026, and manufacturers "are not required to obtain certification to ISO 13485" despite the harmonization (^[61]) (^[6]).

Twenty-one CFR Part 4 exists because modern therapeutics increasingly refuse to sort cleanly into FDA's historical drug, device, and biologic categories, and the regulation gives manufacturers a defined, if genuinely complex, path through that ambiguity. Subpart A's streamlined and standalone CGMP options let a manufacturer anchor its quality system in either drug CGMPs or the device Quality Management System Regulation while absorbing targeted provisions from the other, and Subpart B's postmarket safety reporting rules reconcile drug and device reporting clocks that would otherwise conflict once a product reaches patients. Human factors engineering, addressed in FDA's current August 2026 general device guidance (originally issued in 2016) and its September 2023 combination-product-specific guidance, is an important part of designing self-administered drug-device products to support safe and effective use (^[91]; FDA combination-product HFE guidance).

The regulatory architecture is not static. The QMSR's full effectiveness on February 2, 2026 marks the most significant structural change to device-side compliance in nearly three decades, and FDA's own guidance agenda signals continued refinement of the Essential Drug Delivery Outputs framework and combination-product-specific CGMP guidance well beyond this report's publication date. Sponsors evaluating a combination product pathway, whether a prefilled syringe, an autoinjector, a drug-eluting stent, or a genuinely novel drug-device architecture, should treat classification, design controls, human factors validation, and postmarket reporting as a single integrated program from the earliest stages of development rather than as sequential compliance checkpoints, since FDA's own enforcement history shows the costliest failures occur precisely at the seams between these previously separate regulatory systems.