One Event, Several Obligations: Postmarket Safety for Combination Products

When one event touches both parts of a combination product, the legal reporting duties come from 21 CFR Part 4 and the regulations behind each constituent part. Standards and guidance such as ISO 14971, ICH Q9(R1) and ICH E2E shape how teams manage risk and safety around those duties. The practical goal is one event identity, connected assessments, and a decision record an inspector can follow in minutes.

Prefilled syringes, autoinjectors, inhalers and drug-eluting stents all combine a drug or biologic with a device. Their safety information often sits across device-quality and pharmacovigilance systems run by different teams.

This guide separates what the regulations require from what good practice recommends. It then gives five questions to test your own setup, with the evidence an inspector would expect to see.

What sets the rules: law, guidance and practice

Three layers apply, and they carry different weight. Mixing them up is the most common source of confusion in combination product programs.

The two risk frameworks are not mirror images. ISO 14971 covers device risk management across the life cycle: hazards, risk controls, residual risk and post-production feedback. ICH Q9(R1) addresses quality risk management for pharmaceutical manufacturing, and ICH E2E is the more direct guide for planning pharmacovigilance.

Since February 2, 2026, FDA's Quality Management System Regulation has incorporated ISO 13485:2016 and strengthened how risk management ties into the device quality system. That still does not turn every ISO 14971 detail into an FDA reporting requirement.

One event, several obligations

Take an autoinjector that delivers only part of a dose. That one event can involve device performance, drug quality, how the user handled the device, and the patient's clinical outcome. Often nobody can tell which applies until the investigation is done.

FDA's combination product guidance uses a close example: an autoinjector needle that deploys early and delivers no dose or a partial dose. That can require a malfunction report when a recurrence would be likely to cause or contribute to death or serious injury, even if this event injured nobody.

The application type does not remove the other constituent's duties. Under 21 CFR 4.102, postmarketing reporting starts with the requirements tied to the application type, and combination product applicants can have additional reporting duties based on the constituent parts.

Two 5-day clocks that are easy to confuse

Combination product teams work with two different 5-day requirements. One counts calendar days and one counts work days, and each is triggered by different things.

Reportability may not be clear on the day an event arrives. Under 21 CFR 803.50, manufacturers must report what is reasonably known to them, seek missing information, and investigate each event.

In practice, that means intake should:

• Record the awareness date the moment the event is received
• Start every clock that could apply, not only the most likely one
• Document what is known, what is missing, and who is chasing it
• Reassess reportability as the investigation develops

Two requirements can still mean one submission

An event can meet both a device-type and a drug-type reporting requirement. That does not always mean two separate filings.

Under 21 CFR 4.102, one report can satisfy more than one requirement for the same event, as long as it contains all the required information, is submitted in the required manner, and meets every applicable deadline.

Where the report goes depends on the application. Under 21 CFR 4.104, certain device-type reports for products approved under an NDA or ANDA go through the drug-application route. Certain drug-type reports for products approved under a device application go through the device route.

Five questions to test your setup

Each question below comes with the answer a well-run program would give, and the evidence an inspector would ask to see.

1. When one event affects both constituents, does it live on one record or two?

It lives under one event ID, with linked device-quality and pharmacovigilance records where specialist systems require them. The master record holds the original source, product and lot identifiers, awareness dates, the narrative, coding, reportability decisions, submissions, and links to risk files and CAPA.

There should never be two unconnected versions of the event. If separate databases stay in place, controlled reconciliation keeps both sides in step. MDR event files can reference supporting information held elsewhere, so a linked design is a valid choice.

Evidence to show: the data model, the common-ID rule, reconciliation reports, the duplicate-handling procedure, interface validation, and one worked case.

2. Who decides the reporting route, and where is the reasoning recorded?

Trained intake staff do the first triage, and a cross-functional safety assessment owns final or escalated decisions. Pharmacovigilance assesses drug and biologic reporting. Device vigilance or regulatory affairs assesses death, serious injury, malfunction, 5-day and correction or removal requirements.

Quality and engineering supply the investigation evidence, and a named safety or regulatory owner resolves conflicts. The reasoning sits in a version-controlled decision log linked to the event ID.

The log records the application type, the regulatory tests applied, known and missing facts, the awareness date, the clock calculation, the decision, approvers, the submission route and any later changes. Where an event meets several requirements, it also records whether one streamlined submission is allowed.

Evidence to show: the SOP, the responsibility matrix, training records, the decision tree, clock controls, the audit trail, medical review records, and submission acknowledgements.

3. How quickly can a trend across device and drug data be seen?

New events reach a shared analysis layer daily. High-severity or recurrence-sensitive patterns raise an alert the same day or within one business day.

Formal cross-functional signal review follows a risk-based cadence: for example, weekly for active signals or newly launched products, and monthly for stable ones. The annual review then confirms the cumulative picture instead of being the first place a signal appears.The right cadence depends on product risk, volume, data delays and severity. Useful measures include time from intake to coding, alert-to-triage time, overdue reconciliations, and time from a validated signal to action.

Evidence to show: data-refresh logs, dashboard latency, threshold specifications, signal meeting minutes, alert tickets, and past examples showing detection time.

4. Are risk assessments updated as data arrives, or only once a year?

The stronger model is event-driven plus periodic. Every incoming case is screened against predefined triggers, but not every case forces a rewrite of every risk document.

Triggers include a new hazard or failure mode, a material shift in frequency or severity, an unexpected clinical outcome, a recurring reportable malfunction, a control that is not working, a new use-error pattern, a manufacturing or supplier issue, or regulatory action.

When a trigger is met, the relevant ISO 14971 records, pharmaceutical quality risk assessment, pharmacovigilance plan and benefit-risk evaluation are reassessed through change control. Periodic reviews stay in place to catch low-frequency patterns and confirm nothing was missed.

Evidence to show: the trigger matrix, change-control records, post-production review outputs, risk-management file links, signal assessments, and the periodic-review schedule.

5. Can an inspector see the full path within minutes?

They should be able to. Using the event ID, an authorized user retrieves the source record, timestamps, coding history, device and drug assessments, investigation evidence, reportability decisions, submissions and acknowledgements, risk changes, CAPA or field action links, and closure approval.

This does not require one database. It requires attributable evidence, in time order, protected, retained and quick to retrieve, and where 21 CFR Part 11 applies, audit trails that preserve earlier entries.

A practical test: pick a serious event, a malfunction-only case and a non-reportable case. Reconstruct each chain within a set target, such as five minutes, with no broken links.

Evidence to show: the inspection view, access controls, audit-trail reviews, retention settings, an archive retrieval test, system validation, and periodic traceability test results.

Reporting rates are not incidence

Trending across both constituents raises a denominator problem. Device exposure is often counted in units shipped, while drug exposure is counted in doses administered or patient-time, and the wrong choice misstates the rate.

FDA also cautions that passive MDR data can be incomplete, unverified or biased. On its own, it generally cannot establish incidence, causality or comparative event rates, because of under-reporting and missing exposure data.

Before any cross-constituent calculation, define the unit of analysis: shipped devices, actuations, dispensed doses, administered doses, patient starts or patient-time. Then state the limits of both the numerator and the denominator alongside the result.

What else the system needs

The five questions cover the core. A complete combination product safety process also defines the following.

Some organizations rely too heavily on periodic reviews to catch what these controls should surface day to day. An annual review works best as a cumulative check, not as the first point of detection.

How Smarteeva supports combination product teams

Smarteeva runs post-market work for the device side of a combination product, and keeps it connected to the rest of the event record.

• One record for the event and its decisions. The complaint, the reportability decision with the questions answered and the path followed, and the resulting MDR sit on the same record.
• Required information is validated before submission. The workflow checks that the information FDA needs is present before a report can move forward.
• Device reports go straight to FDA. Approved MDRs are submitted through the ESG NextGen API from the complaint record, and each acknowledgement is recorded against the same MDR.
• Technical failures stay separate from regulatory decisions. A failed transmission does not reopen a reportability decision that was already made and signed.
• AI prepares, people approve. AI agents do the assembly work, and a regulatory user reviews each report and applies their eSignature.
• Risk sits in the same suite. Complaints, MDRs, PSURs, recalls and risk management run in one Salesforce-native suite.

Where pharmacovigilance runs in a separate safety database, the linked-record approach in question 1 applies: one event identity, with controlled reconciliation between the two systems.

FAQs

What is a combination product?

A combination product combines two or more regulated parts, such as a drug or biologic with a device. Prefilled syringes, autoinjectors, inhalers and drug-eluting stents are common examples.

Which regulation sets postmarketing safety reporting for combination products?

21 CFR Part 4 Subpart B, together with the reporting regulations behind each constituent part, such as 21 CFR Parts 314, 600, 803 and 806.

Does an event that affects both constituents need two reports?

Not always. Under 21 CFR 4.102, one report can satisfy more than one requirement for the same event, if it contains all the required information, is submitted in the required manner, and meets every applicable deadline.

What is the difference between the two 5-day requirements?

Under 21 CFR 4.103, constituent part applicants share specified event information with the other applicant within 5 calendar days. Under 21 CFR 803.53, a 5-day MDR is due within 5 work days when remedial action is needed or FDA requests it in writing.

How long must combination product applicants keep records?

For the longest period required by the reporting regulations that apply to the product, under 21 CFR 4.105.

‍