FDA Postmarketing Safety Reporting for Combination Products Under 21 CFR Part 4 Subpart B

Postmarketing safety reporting for combination products: 21 CFR Part 4 Subpart B in regulation, guidance and enforcement

FDA's combination product postmarketing safety reporting (PMSR) rule sits in 21 CFR Part 4, Subpart B (§§ 4.100 to 4.105). Subpart A of the same part covers current good manufacturing practice (CGMP). FDA treats the two as separate postmarket requirements under one part, not as alternatives ⁹⁹¹⁰⁰. FDA issued the CGMP final rule on January 22, 2013, and the PMSR final rule on December 20, 2016 ¹⁰¹¹⁰².

The rule's logic is simple to state. Every applicant reports according to the type of marketing application it holds. An applicant that holds the application(s) for the whole combination product also picks up selected reporting duties that come from the product's other constituent parts. Applicants that each hold an application for a separate constituent part must share safety information with each other.

Scope and key definitions

Subpart B applies to combination product applicants and constituent part applicants. It does not apply to investigational or unauthorized combination products, or to persons other than these applicants. It supplements, and does not replace, other applicable reporting regulations unless it expressly says otherwise ⁶⁵.

FDA's 2019 guidance illustrates the distinction. If one entity holds the NDA for a light-activated drug and a different entity holds the PMA for the laser used with it, both are constituent part applicants. If one company holds both applications, it is the combination product applicant, and the product has no constituent part applicants. An entity is a constituent part applicant only if its application markets its product as a constituent part of the combination product ¹⁹¹.

How § 4.102 allocates reporting duties

Layer 1: application type-based reporting

Both combination product applicants and constituent part applicants follow the reporting rules tied to their marketing authorization ⁶⁷:

• Device application (510(k), De Novo, PMA, HDE): 21 CFR Parts 803 and 806
• NDA or ANDA: 21 CFR Part 314
• BLA: 21 CFR Parts 600 and 606, as applicable

These requirements apply to a constituent part applicant's constituent part, or to a combination product applicant's combination product as a whole ⁶⁶.

Layer 2: constituent part-based reporting (combination product applicants only)

A combination product applicant also has reporting requirements based on the constituent parts in its product ⁶⁸⁶⁹⁷⁰. These constituent part-based duties apply only to combination product applicants, not to constituent part applicants ²⁵.

In practice, a drug-led or biologic-led product (NDA, ANDA, BLA) reports serious, unexpected adverse experiences in fifteen-day reports. If it contains a device part, the applicant also has to assess whether five-day, malfunction, and correction or removal reporting applies ²⁷²⁸²⁹. A device-led product reports deaths, serious injuries, malfunctions, five-day events, and corrections and removals. A drug or biological constituent part adds the relevant fifteen-day reporting plus FAR or BPDR duties ³⁰³¹.

Principal reporting timelines

One report can satisfy several requirements

The rule lets one report for an event satisfy both an application type-based requirement and a constituent part-based requirement when the report contains the specified information, uses the required submission manner, and meets the shortest applicable deadline ⁷¹⁷². FDA's guidance gives the example of a combined fifteen-day and malfunction report submitted within 15 days ³⁷. For a device application product, one submission can serve as both a fifteen-day report and a device death or serious-injury report if it is identified as both and filed within 30 days ¹³⁸. A correction or removal can also be folded into an applicable serious-injury, fifteen-day, malfunction, or five-day report. A PMA device-biologic applicant that needs both a five-day report and a correction or removal report can file one report with all the required content within the five-day deadline ²⁷⁰.

FDA has also stated a narrow flexibility. When an applicant identifies a malfunction after it has already filed a fifteen-day report, FDA does not intend to object if the applicant submits the malfunction report as a follow-up to the fifteen-day report within 30 calendar days of awareness, rather than 15 ⁴³.

Periodic reports and FDA requests for information

For NDA-, ANDA-, or BLA-authorized products that contain a device, periodic safety reports must summarize and analyze the five-day and malfunction reports submitted during the reporting interval ⁷³¹⁶⁷. The guidance recommends the following ^168169170171:

• In a PADER or PAER, address initial and follow-up five-day and malfunction reports alongside fifteen-day reports in the section that summarizes reports submitted during the interval.
• Where a waiver allows an ICH E2C-format PSUR or PBRER, include five-day and malfunction report information in the report body or an appendix.
• Present five-day and malfunction reports separately from fifteen-day reports. Give separate tabulations with device problem codes, any adverse event terms, and counts, whether or not an adverse event occurred. Also count any associated adverse event in the adverse event tabulations.

Device-led combination products are outside the Part 4 periodic safety report requirements ³¹, although PMA annual reports under 21 CFR 814.84 still apply. FDA may, however, require additional safety information for a device application product by written notice. The notice states the information requested, the reason, the due date, and the related event ⁷³.

Information sharing between constituent part applicants (§ 4.103)

When different companies hold the applications for the constituent parts (for example, cross-labeled products), § 4.103 requires a constituent part applicant that receives information about a death, serious injury, or adverse experience associated with use of the combination product to give that information to the other constituent part applicant(s) within 5 calendar days of receipt ⁷⁴. The guidance clarifies the following points ^192193194:

• Sharing is required whether the event is expected or unexpected, and even if the receiving applicant believes the event involves only its own part.
• Forwarding the initial information is enough. The applicant does not have to prepare an analysis or share follow-up information, although FDA recommends continued coordination.
• Events that involve no death, serious injury, or adverse experience do not have to be shared under this rule.

FDA's examples make the boundary concrete. A drug applicant that learns of a severe skin burn during use of a cross-labeled drug-device product must forward the initial report to the device applicant. Each applicant then reports to FDA as its own regulations require. A device malfunction with no associated death, serious injury, or adverse experience does not have to be shared, but the device applicant must still report it under Part 803 as appropriate ¹⁹⁵. FDA also encourages companies that co-market products intended for use together to share adverse event information even when § 4.103 does not require it ¹⁹⁶.

The sharing applicant must keep a copy of what it shared, the dates of receipt and sharing, and the name and address of each recipient ⁷⁴. In the guidance example, an NDA holder ("PharmaCo") that shares an adverse experience report with a PMA holder ("MedCo") must keep the sharing records for 10 years from receipt. MedCo keeps its event records under the device rules, which for a malfunction, serious injury, or death report means the longer of 2 years from the event or the device's expected life ¹⁶³.

Submission routes and recordkeeping (§§ 4.104 to 4.105)

Constituent part applicants submit reports under the regulations that apply to their own application type ⁷⁵. Combination product applicants generally use the manner specified for each report type, with three cross-overs ⁷⁵:

• Five-day and malfunction reports for NDA/ANDA products are submitted under § 314.80(g).
• Five-day and malfunction reports for BLA products are submitted under § 600.80(h).
• Fifteen-day reports for device application products are submitted under § 803.12(a).

In effect, individual case safety reports (ICSRs) follow the lead Center's system for the application type. FDA points device application filers to CDRH eMDR specifications and drug and biologic filers to FAERS and CBER/CDER electronic ICSR specifications ¹⁴⁹¹⁵⁰. Reports that are not ICSRs (FARs, BPDRs, and correction or removal reports) follow the procedures for their own report type ¹⁹³⁶. The technical documents referenced include Specifications for Preparing and Submitting Electronic ICSRs and ICSR Attachments ¹⁵¹¹⁵² and the August 2024 FDA Regional Implementation Guide for E2B(R3) Electronic Transmission of Individual Case Safety Reports for Drug and Biological Products, which states that it is incorporated by reference into the combination product PMSR guidance ¹⁵⁴¹⁵⁵. Where constituent parts are marketed under separate applications held by the same combination product applicant, that applicant reports separately for each constituent part under the applicable process ²⁷⁸.

For recordkeeping, constituent part applicants keep records under their own application type rules and retain § 4.103 sharing records for the longest applicable period. Combination product applicants use the longest record retention period that applies to their product under § 4.102 ⁷⁶.

FDA's guidance framework

Postmarketing Safety Reporting for Combination Products (final, July 2019)

The core guidance is Postmarketing Safety Reporting for Combination Products, a final guidance dated July 22, 2019 ²⁴. Beyond restating the rule, its main value is its worked examples. In each example below, the obligation follows from the combination product as a whole rather than from the drug or device alone:

• Co-packaged syringe, sterile barrier compromised (NDA product). A malfunction report may be required even when the syringe was discarded before use and no adverse event occurred ⁴¹¹³⁵.
• Auto-injector needle that deploys early. This can require a malfunction report if a recurrence would likely cause death or serious injury, even when no one was injured in the reported event ¹³⁵.
• Drug and infusion set that over-infuses (NDA product). After filing a fifteen-day report, the applicant learns that the infusion set may have failed its specifications and must also file a malfunction report ¹³⁵.
• Prefilled rescue inhaler with an actuator design flaw (NDA product). Once the applicant decides that market removal is necessary, a five-day report is due within five work days. The removal must also be reported, potentially in the same submission ⁴²¹³⁷.
• Drug-eluting stent (PMA product). A life-threatening, unexpectedly severe infection requires a fifteen-day report within 30 calendar days plus a serious-injury report. If investigation later finds contamination of the drug coating during manufacture, a FAR is due within three working days of that discovery ^140141142143.
• Bone graft containing recombinant bone morphogenetic protein (PMA product). A manufacturing deviation that could affect the purity of a distributed product triggers a BPDR ²⁷⁷.

The guidance defines a malfunction broadly: a failure of the device part or of the product as a whole to meet specifications or perform as intended ¹³⁴.

Compliance Policy for Combination Product Postmarketing Safety Reporting (April 2019)

The rule took effect in stages. January 19, 2017 was the compliance date for application type-based reporting under § 4.102(a) and (b), and for constituent part applicants' submission and recordkeeping duties under §§ 4.104(a) and 4.105(a)(1). FDA described these as largely reflecting requirements applicants were already expected to follow ²⁵⁶²⁵⁷. The rule set July 19, 2018 as the compliance date for § 4.103 information sharing, constituent part-based reporting under § 4.102(c) and (d), § 4.104(b), and § 4.105(a)(2) and (b) ²⁵⁶.

In the April 2019 immediately-in-effect compliance policy, FDA said it did not intend to enforce §§ 4.102(c) and (d), 4.104(b)(1) and (b)(2), and 4.105(b) against combination product applicants before these dates ^248249250:

FDA's stated reason was to give applicants time to update reporting and recordkeeping procedures and IT systems, and to take account of forthcoming guidance and technical specifications. During this period FDA intended to focus on educating applicants ²⁵⁴. All other Subpart B provisions remained subject to FDA's usual enforcement policies ¹²⁵²⁵⁵. Section 4.103 information sharing and § 4.105(a)(2) were not on the non-enforcement list ²⁵⁶. Those enforcement discretion windows have now closed, so constituent part-based reporting is fully enforceable.

Certain Ophthalmic Products: Policy Regarding Compliance With 21 CFR Part 4 (March 2022)

FDA has also used targeted transition policies when a product class is newly treated as a combination product. After the Genus decision, FDA concluded that eye cups, eye droppers, and similar dispensers packaged with ophthalmic drugs meet the device definition. That made these products drug-led combination products, including some approved products and OTC monograph drugs ³⁰⁶³⁰⁹. For 12 months after publication, FDA said it did not intend to act on noncompliance with Subpart B by applicants whose ophthalmic products had not previously been regulated as combination products because of now-obsolete language in 21 CFR 200.50 ³¹⁰. This was a product-specific policy, not a general extension of the 2019 compliance policy ²⁵⁸.

How FDA inspects for Subpart B compliance

CPGM 7353.001. FDA's compliance program Postmarketing Adverse Drug Experience (PADE) Reporting Inspections (October 18, 2022 version) explicitly covers combination products for which CDER is the lead Center ^222297298. Investigators are instructed to verify the following ^{299300301302303226}:

• Each combination product and constituent part applicant meets the reporting requirements for its authorization type, and all applicants comply with §§ 4.102 to 4.105.
• Combination product applicants submit the additional constituent part-based reports.
• Constituent part applicants share qualifying information with other constituent part applicants within five days and keep records of who received it and when.
• Safety records are retained for the longest applicable period.

Written procedures for receiving, evaluating, and reporting adverse experiences, and procedures for accepting and correcting electronic submissions, are also within inspectional scope ²²⁴²²⁵.

Adjacent programs. CPGM 7356.000, Inspections of CDER-led or CDRH-led Combination Products, focuses on Part 4 CGMP rather than Subpart B reporting ²²⁸²²⁹. CDER MAPP 4121.3 identifies which office leads a newly identified safety signal for a drug-device combination product, including signals about the device portion ²²⁷.

Enforcement record and inspectional observations (as of October 2026)

The public enforcement record that cites Subpart B by section number is thin. Searches of FDA warning letters did not identify a letter that cites §§ 4.102, 4.103, 4.104, or 4.105 by number ^{287288289290291}. Where FDA has acted on combination product reporting failures, it has framed them as failures to file the underlying device reports under Part 803. The two examples below differ: the first is a device-led product with its own Part 803 duties, while the second tracks the malfunction-reporting duty § 4.102(c) imports into drug-led and biologic-led products.

• Biosensors Interventional Technologies Pte Ltd (warning letter, July 21, 2023). The letter concerned the BioFreedom drug-coated coronary stent system, a PMA device-led combination product, and is Part 803 enforcement that does not cite §§ 4.102 to 4.105 ¹⁰⁷¹¹⁵. FDA cited inadequate MDR procedures under 21 CFR 803.17 because they mixed other authorities' requirements with Part 803 in a way that could lead to missed reports. FDA also cited failure to submit 30-day MDRs under § 803.50(a)(1) for a serious injury involving acute stent thrombosis and under § 803.50(a)(2) for a stent dislodgement malfunction ^108109110.
• Baxalta US Inc. (Form 483, September 18, 2025; an inspectional observation, not an enforcement action). The observation concerned Vonvendi, a biologic-led combination product with a Mix2Vial reconstitution device constituent part ²⁸⁴²⁸⁵. Observation 1 stated that the firm had not submitted MDRs within 30 days for apparent Mix2Vial malfunctions, including complaints of "Incomplete Diluent Transfer" and a "Defective Device" complaint ²⁸⁶²⁹⁴. The 483 does not cite a regulation by number ²⁷⁹. The finding still tracks the § 4.102(c) duty: a BLA holder whose product contains a device part must file malfunction reports ⁶⁸. This is the obligation many drug-led and biologic-led sponsors have been slowest to put into their pharmacovigilance systems.

Practical takeaways for sponsors

1. Map every product to its applicant role first. Whether you are a combination product applicant or a constituent part applicant decides whether constituent part-based reporting under § 4.102(c) and (d) applies, or only § 4.103 sharing ²⁵¹⁹¹.
2. Drug-led and biologic-led products need device-style complaint triage. NDA and BLA holders whose products include syringes, auto-injectors, inhalers, infusion sets, or reconstitution devices must assess complaints for malfunction reportability even when no patient was harmed ¹³⁴¹³⁵. The Baxalta 483 shows investigators checking this directly ²⁸⁶.
3. Watch the shifted clocks. Fifteen-day reports become 30-day reports for device-led products. Five-day, FAR, correction or removal, and BPDR timelines all apply on top of the application type deadlines ^{3233139267275}.
4. Use combined reports deliberately. One report can satisfy several requirements only if it carries all the required content, goes through the correct submission route, and meets the shortest applicable deadline ⁷¹³⁷.
5. Update periodic reports. PADERs, PAERs, PSURs, and PBRERs for drug-led and biologic-led products with device parts need separate five-day and malfunction report tabulations with device problem codes ¹⁷¹.
6. Document § 4.103 sharing. Cross-labeled partners need a contractual and procedural mechanism to forward initial information within 5 calendar days, plus records that meet the longest applicable retention period. CPGM 7353.001 makes these records inspectable ^74302303.
7. Watch for reclassification events. As the ophthalmic dispenser policy shows, a change in how FDA characterizes a product can bring it under Subpart B, sometimes with only a limited transition period ³⁰⁹³¹⁰.