21 CFR Part 4: cGMP Requirements for Combination Products

21 CFR Part 4 is the FDA regulation that establishes which current good manufacturing practice requirements apply to combination products and identifies postmarketing safety reporting requirements for combination product applicants and constituent part applicants.

Its two subparts address different questions. Subpart A, whose scope is set out in 21 CFR 4.1, addresses applicable current good manufacturing practice (cGMP) requirements. Subpart B, introduced by 21 CFR 4.100(a), addresses postmarketing safety reporting for combination product applicants and constituent part applicants.

Part 4 identifies biological products, devices and drugs as constituent-part types in 21 CFR 4.2. For the formal combination-product definition and classification boundaries, consult the current text of 21 CFR 3.2(e) and FDA’s About Combination Products page. The worked cases below assume an established classification; they do not determine one from a product nickname.

Two applicant roles recur throughout Subpart B, and 21 CFR 4.101 defines both. An applicant is a person holding an application under which a combination product or a constituent part has received marketing authorization, such as approval, licensure or clearance. A combination product applicant holds the application or applications for the combination product itself; a constituent part applicant is the applicant for a constituent part of a combination product. The role determines what is reported and to whom information must be passed.

This article keeps four categories separate so readers can distinguish obligations from implementation choices:

• Binding regulatory provisions establish the legal requirements within their stated scope.
• FDA explanatory guidance provides agency explanation, distinct from the regulatory text.
• Practice-based recommendations describe ways to organize decisions, responsibilities and evidence—not additional legal duties.
• Software support concerns record handling, not a determination of compliance or a substitute for human review and release.

Use the comparison of neighboring terms for terminology; the sections below focus on product-specific applicability, manufacturing evidence and reporting decisions.

Start with separate questions: what is the product configuration, what activities occur at each facility, and who is the applicant? A practical applicability assessment records each answer independently; a site’s role in manufacturing does not, by itself, identify the applicant responsible for postmarketing reporting.

Manufacture is broader than final assembly. Under 21 CFR 4.2, it includes designing, fabricating, assembling, filling, processing, testing, labeling, packaging, repackaging, holding and storage. Map those activities across the manufacturing network rather than assessing only the location where the finished combination product takes shape.

During separate-facility manufacture of a constituent for a co-packaged or single-entity combination product, 21 CFR 4.4(c) requires that facility’s operating system for the constituent to demonstrate compliance with all cGMP requirements applicable to that constituent type. Evaluate that manufacturing period explicitly, not merely the eventual combined configuration.

As industry practice—not a prescribed regulatory form—maintain a boundary record with these decision fields:

• Product configuration and constituent types.
• Manufacturing facilities and the activities performed at each.
• Applicant identity, application type and marketing-authorization status.
• The point at which constituents are brought together, with the preceding separate-facility activities identified.

Postmarketing scope is a separate assessment. 21 CFR 4.100(b) excludes investigational combination products, combination products without marketing authorization, and persons other than combination product applicants and constituent part applicants from Subpart B. Use the postmarketing reporting map later in this article for reporting duties. Do not infer manufacturing exemptions from those exclusions: 21 CFR 4.1 separately establishes Subpart A’s combination-product cGMP scope.

The operating-system routes in 21 CFR 4.4 apply to single-entity and co-packaged combination products; the section heading and paragraph (a) are limited to those configurations. For them, a manufacturer can demonstrate, under § 4.4(a)(1), the specifics of each constituent-part regulation listed in § 4.3, or, under § 4.4(a)(2), use a streamlined operating system built under paragraph (b). The streamlined approach means showing compliance with one base set of CGMP regulations plus the specified additions from the other; under § 4.4(b)(1), once those additions are demonstrated, "no additional showing of compliance" with respect to the QMSR need be made.

For a drug-device combination, 21 CFR 4.4(b)(1) provides a drug-CGMP-based or medical-gas-CGMP-based route, as applicable. The selected incorporated ISO 13485 clauses, together with the referenced definitions, and specified other QMSR provisions must also be satisfied. This is a defined demonstration route—not permission to ignore the device constituent.

Conversely, a device and non-medical-gas drug combination can use a QMSR-based operating system with the selected drug CGMP additions under 21 CFR 4.4(b)(2). For a device and medical-gas combination, 21 CFR 4.4(b)(3) identifies a separate set of medical gas CGMP additions. Do not treat those two QMSR-based routes as interchangeable.

Check the complete selected-additions list in the current text of the relevant paragraph. For example, § 4.4(b)(2)(viii) lists § 211.170, reserve samples, within the non-medical-gas route. By contrast, § 4.4(b)(3)(vi)–(vii) lists § 213.204, returned medical gases, and § 213.208, salvaging of medical gases. These examples identify additions; they neither reproduce their underlying requirements nor exhaust either list.

Timing matters when constituent parts are made in different places. Under § 4.4(d), a paragraph (b) operating system may begin when two or more types of constituent parts to be included in a single-entity or co-packaged product have arrived at the same facility, or their manufacture is proceeding at the same facility. Upstream facilities that make only one constituent part continue under that part's own CGMP regulations.

Document the basis, not just the checklist

The governing principle in 21 CFR 4.4(e) is that the applicable regulations supplement rather than supersede one another unless explicitly provided otherwise. If applicable regulations conflict, the regulation most specifically applicable to the constituent part supersedes the more general regulation. A preferred operating-system basis therefore does not, by itself, resolve a regulatory conflict.

As an implementation practice, choose the basis against actual processes, competent reviewers and evidence coverage—not the shortest checklist. Reuse the facility-boundary analysis above when defining the decision’s scope. Compare the site’s existing drug CGMP controls and QMSR operating framework, then document the selected route, each addition, its process owner and the records reviewers will examine. Test the map against a representative manufacturing record: can a reviewer find the evidence without relying on an undocumented explanation? Record gaps and assign their resolution before treating the map as operationally complete.

For United States combination products, build the constituent map before documenting how compliance will be demonstrated. The table identifies manufacturing requirements by constituent; it does not select among the operating-system routes. Keep those decisions in separate, linked records.

As an implementation practice, create a traceable chain: product configuration → applicability decision → constituent lot genealogy → execution evidence → safety assessment. Record the configuration revision, decision owner and rationale, constituent lot identifiers, evidence locations and unresolved exceptions. Use production context tagging to preserve these relationships when records sit in different systems.

For example, link a non-medical-gas drug constituent’s applicability decision to its Part 211 requirements, then to the relevant lot and execution records. Carry those identifiers into any related safety assessment. This is a recommended evidence model, not a regulatory database schema.

Use this implementation sequence to connect the applicability map to daily operations. It is manufacturing and quality practice, not a universally prescribed Part 4 workflow.

Classification and facility mapping → cGMP operating-system selection → purchasing and receipt → manufacture → evidence review → human disposition → complaint intake → controlled change and targeted applicability review.

Assign an authoritative system and accountable owner for each record class. This example allocates responsibilities; actual assignments should reflect organizational roles and quality agreements.

Keep applicant-side application information and safety decisions distinct from factory or contract-manufacturer execution responsibilities. Name handoff owners so that manufacturing investigations reach the applicant’s safety team without treating the factory as the applicant.

For a generic architecture, link ERP receipts to manufacturing execution records using receipt, constituent-lot, product-revision and batch identifiers. Connect laboratory sample/result IDs and quality-system event IDs to that same context. Define interface ownership across MES–ERP integration and MES–LIMS integration: technical teams recover transfers; record owners resolve meaning and status.

Preserve the original event, detect failed or duplicate transfers, and reconcile source and destination counts. Quarantine unmatched references rather than guessing their batch association. Retry using stable identifiers and record the reviewer’s resolution. Never let an interface retry silently overwrite a quality decision. These controls address the common failure modes.

Classify changes separately: product-configuration changes prompt constituent and revision review; facility-network changes prompt activity and handoff review; application-information changes prompt applicant and reporting-scope review. Route each to a targeted applicability review before implementation.

Case 1: drug-CGMP-based final manufacture

Assume a prefilled injector with an established single-entity drug-device combination-product classification, a non-medical-gas drug constituent, no biological constituent and a drug-CGMP-based operating system. The unit of analysis is one product configuration at one final-manufacturing facility. Classification is an assumption of this exercise, not an inference from the injector format.

Apply the previously explained § 4.4(b)(1) route(1)). Build a configuration-specific decision record:

1. Document the assumed classification and identify the configuration it covers.
2. Identify the drug and device constituents, including the non-medical-gas status and absence of a biological constituent.
3. Record the drug-CGMP operating-system basis and the facility activities within scope.
4. Carry each specified addition from the earlier route map into a requirement-to-evidence register. Link each applicability decision to its rationale, responsible owner, controlled procedure and execution evidence.

For each mapped addition, distinguish a procedure describing the control from records demonstrating its execution. Track missing records as unresolved exceptions; use change control to reassess the map when the configuration or manufacturing responsibilities change.

Case 2: QMSR-based final packaging

Assume a co-packaged drug-device kit containing exactly one non-medical-gas drug unit and one device unit, with separate upstream constituent manufacturing and a QMSR-based final-packaging operation. Apply the § 4.4(b)(2) route(2)) at final packaging and use the facility boundary described above under § 4.4(c)). Keep upstream manufacturing responsibilities distinct in the evidence map.

Numerical assumptions: receive 1,000 drug units and 1,000 device units; place 12 device units on hold before packaging; assemble 980 kits with no assembly losses. Each kit consumes exactly one unit of each constituent.

The arithmetic establishes physical accounting under these assumptions. “Available” means outside the stated hold quantity, not a suitability decision. Balanced totals neither establish material suitability nor replace review of holds and deviations. Connect receiving lots, hold records, packaging consumption and remaining inventory through the constituent mapping and evidence relationships.

Case 1 tests route-specific requirement coverage. Case 2 adds facility-boundary and lot-reconciliation evidence: which operation owns each record, which lots entered the kits and where every remaining unit resides.

Start with the reporting object. Under 21 CFR 4.102(a), constituent part applicants apply their reporting requirements to their constituent part; combination product applicants apply theirs to the combination product as a whole.

For both applicant roles, 21 CFR 4.102(b) establishes the application-based reporting route:

Combination product applicants also evaluate constituent-based categories under 21 CFR 4.102(c), as applicable:

• Device constituent: five-day, malfunction, and correction or removal reports.
• Drug constituent: field alert reports and fifteen-day reports described in § 314.80.
• Biological product constituent: biological product deviation reports and fifteen-day reports described in § 600.80.

Turn the category map into an event assessment

This map identifies reporting categories, not whether an individual event meets their trigger criteria. As an operational practice, record applicant role, application type, constituent types, event information, relevant dates, decision owner and submission references in the adverse event reporting assessment.

Connect intake to the operational evidence workflow: link the affected lot or unit to relevant manufacturing records, deviations and test results. Keep the safety decision identifiable separately from the manufacturing investigation, so reviewers can trace both the event assessment and its supporting evidence.

When does the 30-calendar-day exception apply?

For a combination product authorized under a device application, the specified drug and biological fifteen-day reports must instead be submitted within 30 calendar days under 21 CFR 4.102(c)(2)(ii) and (c)(3)(ii). This exception is not a general deadline for every report category.

Can one report satisfy both routes?

Not automatically. Under 21 CFR 4.102(b), a combination product applicant’s report already submitted under paragraph (c) can satisfy paragraph (b) for the same event only if it includes the required information, is required to be submitted in the same manner under § 4.104, and meets the applicable deadlines.

What must be shared with other applicants?

Separately from submissions to FDA, 21 CFR 4.103(a) requires an applicant that receives information about an event involving a death or serious injury as described in § 803.3, or an adverse experience as described in § 314.80(a) or § 600.80(a), associated with use of the combination product, to provide it to the other constituent part applicant or applicants no later than 5 calendar days after receipt. Section 4.103(b) requires records of a copy of the information provided, the date it was received, the date it was provided, and the name and address of each recipient applicant.

Which retention rule applies?

Under 21 CFR 4.105, constituent part applicants follow the applicable § 4.102(b) recordkeeping requirements under paragraph (a)(1). Their § 4.103(b) information-exchange records follow the longest applicable postmarketing retention period under paragraph (a)(2). Combination product applicants retain records for the longest period required by the regulations applicable under § 4.102, as directed by paragraph (b).

These practical controls address evidence failures, not additional legal requirements. For upstream facility boundaries or reporting-route decisions, refer back to the scope and postmarketing sections.

Clearing an interface error is not recovery completion. Close the recovery only when the affected records, chosen correction and reviewer’s assessment are documented. Use the inspection-review checklist to test resolution; keep unresolved discrepancies assigned, visible and subject to follow-up.

Use the opening definition and boundaries for scope. The terms below distinguish legal requirements, an establishment’s operating arrangements and the records used to explain decisions.

Under 21 CFR 4.2, Part 4 uses QMSR to refer to Part 820 requirements. Read FDA QMSR as that regulatory reference, not as a synonym for the internal matrix or batch record.

As an implementation practice, use the constituent table for the United States assessment. For each additional market, maintain a separate assessment of product classification, manufacturing obligations and safety-reporting responsibilities. Do not extrapolate a United States conclusion into another jurisdiction.

Keep binding provisions, official explanatory guidance and practical implementation choices separately identified. A matrix should distinguish a legal obligation from an explanatory interpretation or a locally chosen control.

Use this practice-based checklist to test demonstrable evidence and decision quality—not as a statement of universal inspection expectations. Record findings, owners and follow-up actions.

• Configuration: Is the product configuration documented at an identifiable revision, with constituent identities and manufacturing facility boundaries?
• Applicability: Are references current and the selected cGMP operating-system basis recorded? Does each applicability decision have an owner, rationale, revision and evidence reference?
• Execution: Are mapped procedures connected to the records that demonstrate their use? Do constituent lot identities and quantities reconcile through manufacturing?
• Exceptions: Are unresolved deviations visible with review status and ownership? Is interface exception closure supported by reconciliation evidence rather than a successful retransmission alone?
• Responsibilities: Are applicant identities, reporting responsibilities and handoffs documented, including ownership of open complaint or safety assessments?
• Changes: Does change control connect configuration, procedure and system revisions to assessed impacts and implementation status?

Vertically review one actual lot or batch. Start with its configuration revision; follow both constituent histories into execution evidence; inspect deviations and review status; then locate related complaint or safety assessments, if any exist. For products with additional constituents, extend the review to each history. Can the reviewer explain why each record is relevant, rather than merely retrieve it?

Treat missing links, conflicting versions and open assessments as review findings to resolve through the organization’s controlled process—not proof of a particular regulatory violation. See batch-record support only for the assembled manufacturing evidence component.