21 CFR Part 4: CGMP Rules, PMSR, and 2026 Changes

21 CFR Part 4 sets the CGMP requirements for combination products, and its core mechanism is a shortcut: rather than run two full quality systems side by side, you build one system around your product’s primary mode of action and then layer in a defined list of provisions from the other framework. As of February 2, 2026, the device-side references in Part 4 point to ISO 13485:2016 clauses through the FDA’s new Quality Management System Regulation instead of the old Quality System Regulation subparts.

Which Products Part 4 Applies To

Part 4’s streamlined CGMP approach covers single-entity and co-packaged combination products: products that physically combine drug, device, or biological components into one finished item, or that package separately finished components together as one unit. A drug-eluting stent, a prefilled syringe containing a biologic, and a scalpel packaged with an antibiotic ointment all fit.

Cross-labeled products, where separately packaged items are labeled for use with one specific approved product, are treated differently and do not use the same streamlined structure for CGMP compliance.

Without Part 4, a product containing both drug and device components would be subject to the full drug CGMP rules in 21 CFR Parts 210 and 211 and the full device quality system rules in 21 CFR Part 820 at the same time.¹ Part 4 keeps both obligations intact but lets you satisfy them through a single, integrated quality system.

How the Streamlined Approach Works

The lead center for your product determines which base system you build. If your product’s primary mode of action is driven by the drug component, CDER leads and you base your quality system on 21 CFR Parts 210 and 211. If the device component drives the therapeutic effect, CDRH leads and you base your system on the QMSR at 21 CFR Part 820. If a biologic is the primary driver, CBER leads.

Whichever base you choose, you then have to demonstrate compliance with a specific set of provisions from the other framework for the corresponding constituent part.² Once you meet those provisions on top of your base, no additional showing of compliance with the other framework is required.

Drug-Led Products: Six Device-Side Provisions to Add

If your product is drug-led, you run a drug CGMP quality system and add six categories of QMSR/ISO 13485 provisions covering the device constituent part.²

Management responsibility and general requirements, including organizational structure, quality policy, and resource management (ISO 13485 Clauses 4.1, 5, and 6.1)
Design and development, including design controls for planning, inputs, outputs, verification, validation, and documented risk management (ISO 13485 Clause 7.3)
Purchasing, including supplier evaluation and control of purchased materials and components (ISO 13485 Clause 7.4)
Data analysis, improvement, and complaint handling, covering feedback monitoring, trend analysis, and customer complaint processing (ISO 13485 Clauses 8.2.2, 8.4, and 8.5)
Installation activities, where applicable (ISO 13485 Clause 7.5.3)
Servicing activities, covering maintenance and repair controls (ISO 13485 Clause 7.5.4)

Device-Led Products: Eight Drug CGMP Provisions to Add

If your product is device-led, you run a QMSR quality system and add eight specific drug CGMP provisions covering the drug constituent part.²

Testing and approval or rejection of drug product containers, closures, and raw materials (21 CFR 211.84)
Calculation of yield, tracking actual against expected production output (21 CFR 211.103)
Tamper-evident packaging for OTC drug products (21 CFR 211.132)
Expiration dating for the drug constituent (21 CFR 211.137)
Laboratory testing and release before the drug constituent is distributed (21 CFR 211.165)
Stability testing confirming the drug maintains its quality over the product’s shelf life (21 CFR 211.166)
Special testing requirements for sterile products, controlled-release forms, and other special dosage types (21 CFR 211.167)
Reserve samples retained for future testing or investigation (21 CFR 211.170)

The device-led list is longer than the drug-led list. Pharmaceutical manufacturing has testing and release obligations, including yield calculations, expiration dating, and reserve samples, that have no direct parallel in the device framework, and skipping them can produce a drug component that degrades before the device component fails.

What Changed on February 2, 2026

On February 2, 2026, the FDA replaced the device Quality System Regulation with the Quality Management System Regulation, incorporating ISO 13485:2016 by reference into 21 CFR Part 820.³ Part 4 was amended in parallel: references to the old QSR were replaced with QMSR terminology, and the device-side provisions listed above now point to specific ISO 13485 clauses instead of the former Part 820 subparts.⁴

If your quality system was built around the pre-2026 QSR structure, confirm that your documentation, procedures, and internal audits match the ISO 13485 framework. The FDA also retired its Quality System Inspection Technique (QSIT) on the same date and moved to a new inspection process aligned with the QMSR standard, so inspectors are now evaluating compliance against the ISO clauses.³

Postmarketing Safety Reporting on Top of CGMP

Subpart B of Part 4 sets a unified postmarketing safety reporting framework so that adverse events don’t slip between the drug and device reporting systems.⁵ Your baseline reporting obligation follows the application type your product was authorized under: device applications follow 21 CFR Parts 803 and 806, NDAs and ANDAs follow Part 314, and BLAs follow Parts 600 and 606.⁶

On top of that baseline, you pick up additional obligations for each constituent part type in your product. A device constituent triggers five-day reports for events requiring remedial action, malfunction reports, and correction or removal reports. A drug constituent triggers field alert reports and 15-day reports, though products authorized under a device application get 30 calendar days instead of 15 for those drug-side reports. The same 30-day extension applies to biologic-side 15-day reports when the combination product was authorized as a device.⁶

Mandatory reports go on FDA Form 3500A (MedWatch), which has dedicated sections for both drug information (name, strength, dose, expiration date) and device information (brand name, model number, lot number, Unique Device Identifier).⁷ When separate applicants hold marketing authorizations for different constituent parts of the same combination product, each applicant must share safety information with the others.

What Non-Compliance Costs

The FDA inspects combination product manufacturing facilities against the CGMP and QMSR requirements described above. When inspectors find violations, the typical escalation starts with a Form 483 listing observations, followed by a warning letter if the corrective response is inadequate. Recent warning letters have cited combination product issues under headings including “CGMP/QSR/Medical Devices/Adulterated” and “CGMP/Finished Pharmaceuticals/Adulterated.”⁸

If warning letter findings are not addressed, the FDA can pursue judicial enforcement, including seizures, injunctions barring further manufacturing or distribution, and consent decrees that impose court-supervised compliance programs. Products manufactured in violation of CGMP are considered adulterated under the Federal Food, Drug, and Cosmetic Act regardless of whether anyone was actually harmed. For combination products, the exposure is compounded by the dual-system structure: a quality system that satisfies drug CGMP but ignores the required QMSR provisions for the device constituent part is non-compliant.

1
eCFR. 21 CFR 4.3 – What Current Good Manufacturing Practice Requirements Apply to My Combination Product
2
eCFR. 21 CFR 4.4 – How Can I Comply With These Current Good Manufacturing Practice Requirements for a Co-Packaged or Single-Entity Combination Product
3
U.S. Food and Drug Administration. Quality Management System Regulation (QMSR)
4
eCFR. 21 CFR Part 4 – Regulation of Combination Products
5
eCFR. 21 CFR Part 4 Subpart B – Postmarketing Safety Reporting for Combination Products
6
eCFR. 21 CFR 4.102 – Postmarketing Safety Reporting for Combination Products
7
Food and Drug Administration. General Instructions – For Form FDA 3500A MedWatch
8
Food and Drug Administration. Warning Letters