The new Quality Management System Regulation (QMSR) that became effective on February 2, 2026, includes significant changes in the regulatory framework for combination drug-device and biologic-device products, especially those overseen through approved applications by the Center for Drug Evaluation and Research (CDER) or the Center for Biologics Evaluation and Research (CBER).
On February 2, 2024, FDA issued a Final Rule amending the medical device Quality System Regulation to harmonize with ISO 13485. The intent of the new QMSR is to establish a globally consistent approach to quality management for medical devices while preserving assurance that firms can “consistently manufacture devices that are safe and effective.”
Although the QMSR Final Rule expressly states that it does not “impact the CGMP requirements for combination products,” manufacturers of combination products should be aware that the QMSR's harmonization with ISO 13485 introduces certain changes that will affect how they approach compliance with current good manufacturing practice requirements (CGMP). This is especially true for combination product manufacturers with device constituent parts regulated by CDER or CBER.
The QMSR's incorporation of ISO 13485 reshapes how FDA will interpret and assess compliance—particularly for device-related areas that now carry more explicit, risk‑based expectations.
As described below, these changes include an increased emphasis on complaint handling, risk management principles, and (at least for the applicable QMSR requirements) a new approach to FDA inspection of reports and records relating to management reviews, quality audits, and supplier audits.
Combination products
FDA defines a “combination product” as either (a) a single entity that physically, chemically, or otherwise combines two or more regulated components—such as a drug and device or biologic and device—into one product (e.g., a prefilled syringe or auto-injector), or (b) two or more separate products packaged together as a unit that includes both drug and device or device and biological products (e.g., a kit combining a drug and its delivery device), as specified in 21 CFR 3.2(e)(1) and (2). These are known as “single-entity” and “co-packaged” drug-device combination products, respectively.
When the primary mode of action of a combination product is that of a therapeutic drug or biological product (excluding vaccines), CDER is assigned as the primary regulatory Center, per 21 CFR 3.4(a)(3). These are often called “drug-led” combinations, as the drug constituent part mainly drives the product's therapeutic effect. For example, a therapeutic drug-device in a prefilled syringe would be regulated by CDER under a new drug application. From a quality perspective, the manufacturer of the product would be subject to both drug CGMPs and the medical device QMSR, but FDA has established a streamlined approach to avoid the redundancy that would occur from the application of both drug CGMP and QMSR requirements.
Drug CGMP and QMSR requirements
The CGMP requirements for combination products are outlined in 21 CFR Part 4. This regulation establishes a streamlined framework for both single-entity and co-packaged combination products to reduce redundant compliance with both drug CGMP (21 CFR Parts 210 and 211) and device quality management system requirements (21 CFR Part 820). For biological products, additional requirements under 21 CFR Parts 600–680 may also apply.
To provide clarity and assist combination product manufacturers in their efforts to comply with dual quality system requirements, FDA issued guidance in January 2017 entitled Current Good Manufacturing Practice Requirements for Combination Products. The guidance provides a framework for manufacturers to ensure that both the drug and device constituents of a combination product meet applicable regulatory standards. Due to the overlap between drug CGMPs and device quality system regulations, manufacturers can demonstrate compliance by establishing a quality management system that encompasses one full set of requirements (either drug or device) and only the additional subset of the other component or product that is not already covered by the primary system. For example, per 21 CFR 4.4(b)(1), manufacturers of drug-device combination products regulated by CDER can establish a quality management system that meets applicable drug CGMP requirements and an abbreviated set of device quality system requirements. Under this approach, as revised by the new QMSR, the manufacturer would be subject to the following device QMSR areas, as applicable:
- General requirements and management responsibility. Clause 4.1, Clause 5 and its subclauses, Clause 6.1 of ISO 13485, and 21 CFR 820.10.
- Design and development. Clause 7.3 and its subclauses of ISO 13485. This includes documentation of one or more processes for risk management in product realization as well as records of risk management activities.
- Purchasing. Clause 7.4 and its subclauses of ISO 13485.
- Analysis of data, improvement, and complaint handling. Clause 8.2.2 and 21 CFR 820.35(a), Clause 8.4, and Clause 8.5 and its subclauses of ISO 13485.
- Installation activities. Clause 7.5.3 of ISO 13485.
- Servicing activities. Clause 7.5.4 of ISO 13485 and 21 CFR 820.35(b).
Changes for complaint handling requirements and risk management requirements
Notably, the QMSR incorporates complaint handling by explicitly integrating it as a defined area applicable to the abbreviated quality management system requirements, reflecting FDA's strengthened emphasis on postmarket vigilance and responsiveness to device-related issues within combination products.
Another key change is that required elements also explicitly include risk management. As a result, combination product manufacturers will need to provide records demonstrating how risk management is utilized throughout all applicable processes within the quality system. This includes, among other things, hazard identification, risk estimation, risk evaluation, risk control, and postmarket risk monitoring. Manufacturers must proactively identify, evaluate, and address risks related to the device constituent parts throughout the product life cycle, ensuring risk-based decision-making is consistently applied and documented. For example, a best practice in complaint handling and CAPA is to conduct an appropriate investigation proportionate to the risk and complexity of the complaint (as not every complaint requires a full root cause analysis), assess how the root cause will impact the combination product as a whole (including the drug or biologic constituent part), prioritize corrective actions based on risk severity and probability consistent with ISO 14971 principles, and document risk-based preventive measures to mitigate recurrence.
Expansion of records subject to FDA inspection
In addition, the QMSR Final Rule rescinded 21 CFR 820.180(c), which had previously exempted from disclosure to FDA during a medical device inspection certain records and reports relating to management review, internal quality audits, and supplier audits. Instead, the QMSR now allows FDA investigators to review these internal records and reports. This enhanced transparency will provide FDA with insight into quality activities that were previously outside the scope of FDA inspection. This change effectively eliminates the long‑standing “audit shield” and will require companies to ensure that management reviews, internal audits, and supplier audits are written with the expectation that FDA may now read them. As a result, combination product manufacturers should be mindful of the content and level of detail included within these quality records. For example, management reviews should include trend analysis, resource allocation, and documented decisions—not just summaries or a checklist. A determination that a quality management system is adequate must be supported with the data or analysis to prove it.
Whether the expanded scope will extend to drug CGMP requirements for combination products remains to be seen. If FDA chooses to expand this policy, the agency will need to revoke or substantially amend the compliance policy guide entitled Sec. 130.300 FDA Access to Results of Quality Assurance Program Audits and Inspections, which states that “FDA will not review or copy reports and records that result from audits and inspections of the written quality assurance program.”
To align with the new QMSR, on February 2, 2026, FDA issued the updated compliance program manual entitled Inspection of Medical Device Manufacturers (CP 7382.850), which replaces the longstanding Quality System Inspection Technique (QSIT) and establishes the agency's inspectional playbook under QMSR, as we wrote about here. The updated program formalizes FDA's shift to ISO 13485‑aligned inspection techniques, expands the records investigators may access, and clarifies expectations for evaluating risk‑based processes, supplier oversight, complaint handling, and management responsibility. This is now the operative framework for all device inspections going forward and will impact how FDA conducts combination product inspections.
Why this matters
For combination product manufacturers—particularly those regulated by CDER and CBER—the QMSR transition is not merely a terminology update. It requires a recalibration of quality documentation, a heightened emphasis on traceable risk‑based decisions, and a cultural shift toward inspection readiness in areas that were previously shielded from FDA review.
While the QMSR is designed to harmonize device quality system requirements with global standards, combination product manufacturers should recognize that important differences remain. Even when leveraging the streamlined, abbreviated device quality management system pathway, manufacturers must employ rigorous risk-based procedures, maintain comprehensive and detailed documentation, and routinely pressure test their system to confirm inspection readiness. These steps are essential to not only meet FDA expectations but also to ensure robust quality oversight and ongoing patient safety in an evolving regulatory environment. As FDA continues rolling out QMSR‑aligned inspection tools and training, combination product manufacturers should anticipate further refinements—particularly around risk documentation, data integrity, and supplier qualification—throughout 2026.
[View source.]
