Device & Combination Product Regulations: A Global Playbook for Pathways, Quality, and Clinical Evidence

Published on 15/11/2025

Designing, Investigating, and Registering Devices & Drug–Device Combinations Across Major Regulators

The Global Device Rulebook: How Pathways and PMOA Drive Your Plan

Medical devices and drug–device combinations live in a different regulatory universe than pure pharmaceuticals, but the strategic goal is the same: credible evidence, proportionate controls, and inspection-ready files. Across regions, three pillars repeat: (1) classification and pathway, (2) quality system and risk management, and (3) clinical investigation & post-market surveillance. Understanding these pillars—and how they shift with a product’s primary mode of action (PMOA)—lets Regulatory Affairs,

QA, Clinical Operations, and Sponsors chart a defensible route from concept to market.

Pathway overview. In the United States, the FDA offers 510(k) (substantial equivalence), De Novo (novel, low–moderate risk), and PMA (highest-risk) routes for devices, plus an Investigational Device Exemption (IDE) framework for clinical use. For products that combine drug, device, and/or biologic constituents, FDA’s Office of Combination Products (OCP) assigns a lead center based on PMOA, and 21 CFR Part 4 aligns cGMP expectations across device (QSR/QMS) and drug (21 CFR 210/211) worlds. In the EU/EEA, the Medical Devices Regulation (MDR, 2017/745) and In Vitro Diagnostic Regulation (IVDR, 2017/746) drive conformity assessment with Notified Bodies, CE marking, and post-market vigilance under the EMA network’s broader ecosystem. Japan’s PMDA applies the PMD Act with device classifications and QMS requirements, and Australia’s TGA uses ARTG inclusion after conformity assessment. Although ICH guidelines mainly target drugs/biologics, their quality-by-design mindset complements device standards; public-health ethics from the WHO reinforce participant protection across clinical investigations.

Quality and risk—your constant. Devices depend on design controls, risk management, and usability from day one. ISO 13485 (QMS) and ISO 14971 (risk management) are the backbone for planning, design, verification/validation, and production controls. Human factors/usability engineering demonstrates that real users can operate the product safely and effectively; when a drug is part of the system (e.g., prefilled syringe/auto-injector), usability becomes a critical-to-quality (CtQ) factor that ties directly to labeling, IFU, and training.

Clinical evidence—fit for purpose. Unlike drug trials that often default to randomized, blinded designs, many device investigations appropriately use performance goals, single-arm designs, or non-inferiority frameworks—provided clinical outcome measures are clinically meaningful and free from bias. ISO 14155 provides the global GCP-equivalent for device investigations; regulators expect principled sampling, pre-specified success criteria, and robust handling of intercurrent events (e.g., re-interventions) consistent with estimand thinking from ICH E9. After placement on the market, post-market surveillance (PMS) and, where applicable, post-market clinical follow-up (PMCF) keep the evidence current.

Combination logic. Clarify whether your product is an integral drug–device combination (e.g., a prefilled pen) or a co-pack/co-labeled set. The designation drives regulatory leadership and manufacturing controls. A common pitfall is assuming “drug rules only” because the therapeutic effect is pharmacologic; in fact, the device constituent still carries design, usability, and quality obligations—and in the EU, may require a Notified Body’s opinion even when authorized as a medicinal product.

Bottom line: decide pathway and lead regulator early via PMOA; build a risk-based device QMS aligned to ISO 13485/14971; design clinical evidence per ISO 14155; and ensure the device constituent’s controls are visible in the submission, even when the primary label is drug-led.

United States Deep Dive: 510(k)/De Novo/PMA, IDEs, and Combination GMPs

Classification & routes. U.S. devices fall into Class I–III. Most Class II devices proceed via 510(k) by showing substantial equivalence to a predicate; truly novel, low–moderate-risk technologies may pursue De Novo; highest-risk technologies require a PMA with valid scientific evidence. Across routes, pre-submission (Q-Sub) meetings with FDA are invaluable for de-risking clinical endpoints, bench testing, software validation, cybersecurity, and human factors plans.

Clinical use under IDE. A Significant Risk (SR) device needs FDA IDE approval and IRB approval before first use; Non-Significant Risk (NSR) studies typically require IRB approval with abbreviated IDE obligations. Align your Clinical Investigation Plan (CIP) to ISO 14155 while mapping U.S. specifics (e.g., reporting, labeling of investigational devices). Preserve ALCOA(+) with validated eSource/EDC and role-based access.

Combination products—mechanics that matter. Under 21 CFR Part 3, the OCP assigns a lead center based on PMOA (CDRH for devices, CDER for drugs, CBER for biologics). 21 CFR Part 4 then sets CGMP for combination products, requiring either: (a) full compliance with both device QSR/QMS and drug cGMP, or (b) a streamlined approach where one regime is primary but specified provisions of the other are added. For prefilled systems (syringes, pens, autoinjectors), expect to show: design controls; extractables/leachables where materials contact drug; container-closure integrity; dose accuracy; and human factors validation simulating real-use errors.

Human factors & labeling. FDA scrutinizes usability for user-facing systems—e.g., home-use injectors or wearable pumps. Conduct formative studies to iterate UI/IFU, then a summative (validation) study under realistic conditions using representative users. Tie mitigation of use-related risks back to ISO 14971 and your design history file (DHF). Draft labeling that reflects residual risks without undermining clarity.

Digital and data. For software in or as a device (SaMD/SiMD), produce a cybersecurity bill of materials, threat modeling, and update strategy; align verification/validation depth to risk, and ensure clinical evaluation is commensurate with claims. For connected combinations (e.g., injector + app), document data flows, privacy safeguards, and alarm fatigue mitigations; ensure consistency with drug labeling and REMS where applicable.

UDI, complaints, and vigilance. Assign Unique Device Identification (UDI) and register in GUDID as applicable. Establish complaint handling, Medical Device Reporting (MDR), and field action procedures; for combinations, harmonize with drug pharmacovigilance so there is one safety story.

Practical tip: keep a crosswalk that maps each device claim to supporting bench/biocompatibility/software/human factors/clinical evidence and to each CGMP requirement applied under Part 4. This “glue” document shortens review cycles and anchors inspection interviews.

EU–UK–Japan–Australia: CE/UKCA, Article 117, and ISO 14155-Ready Investigations

European Union—MDR/IVDR in practice. Under MDR, classification (I, IIa, IIb, III) drives conformity assessment routes with Notified Bodies (NBs). Technical documentation must show state-of-the-art benefit–risk, clinical evaluation (MEDDEV/MDR expectations), and PMS/PMCF plans. For integral drug–device combinations authorized as medicinal products, Article 117 requires NB involvement: either a CE certificate for the device part or an NB opinion confirming compliance with relevant General Safety and Performance Requirements (GSPRs). The medicinal product dossier (through the EMA or national agencies) must include the NB evidence; inconsistent statements between SmPC, IFU, and device documentation are a common cause of questions.

Clinical investigations in the EU. ISO 14155 governs planning and conduct; MDR Annex XV specifies application content and ethics interfaces. Determine whether existing clinical data suffice or a new investigation is required; if so, align endpoints with clinical practice, ensure monitoring protects consent, eligibility, and endpoint integrity, and predefine crossovers/rescues in the analysis plan. Post-market clinical follow-up (PMCF) closes residual evidence gaps over time, feeding the Periodic Safety Update/Periodic Safety Review cycle.

United Kingdom. The UK requires UKCA marking under MHRA oversight, with transitional arrangements that recognize CE-marked devices. For drug–device combinations authorized as medicines, the UK expects evidence analogous to Article 117 (third-party confirmation for the device constituent). Keep IRAS/REC ethics processes in step with device investigation rules and ensure privacy notices align to UK-GDPR.

Japan. PMDA’s device pathways include certification (Ninsho) via Registered Certification Bodies for many lower-risk classes and approval (Shonin) by PMDA/MHLW for higher-risk/novel devices. Japanese QMS expectations mirror ISO 13485 with local specifics; clinical investigations follow ISO 14155 principles with attention to intrinsic/extrinsic factors that can influence outcomes. For combinations, engage PMDA early to confirm the lead pathway and evidence needed for both constituents.

Australia. The TGA requires inclusion in the Australian Register of Therapeutic Goods (ARTG) after conformity assessment (direct TGA assessment or recognition routes where available). Clinical investigations follow ISO 14155 and local HREC ethics processes; for drug-led combinations, align device constituent evidence with the medicinal evaluation so labeling and instructions are coherent. Vigilance reporting and corrective action obligations mirror global good practice and should be integrated with your pharmacovigilance system.

Across all four regions, harmonize to international standards (ISO 13485, 14971, 10993 biocompatibility, 62366 usability, 14155 clinical) and keep decision memos that cite primary sources—FDA, EMA, ICH, WHO, PMDA, TGA—so auditors can trace how requirements shaped design and monitoring.

From Concept to Clearance: A Hands-On Toolkit and Audit-Proof Checklist

Documents that actually move the program.

Regulatory strategy & PMOA memo mapping classification, intended use/indications, predicates or reference devices, and global route selection (FDA 510(k)/De Novo/PMA; EU MDR class & NB; PMDA/TGA pathways). Include a combination decision tree and OCP/Article 117 engagement plan.
Design & risk pack: user needs, design inputs/outputs, verification/validation matrices; ISO 14971 risk file linking hazards to controls; usability/human factors plan through summative validation; software/SaMD clinical evaluation and cybersecurity plan.
Clinical suite: Clinical Evaluation Report (CER) or Performance Evaluation (IVD), benefit–risk report, Clinical Investigation Plan (ISO 14155) with monitoring and data-review plans focused on consent timing, eligibility, endpoint protection, and device accountability.
Quality & manufacturing: QMS procedures (change control, supplier management, process validation), combination CGMP crosswalk (21 CFR Part 4), biocompatibility/extractables–leachables strategy, sterilization/pack integrity evidence, UDI plan.
Post-market plan: PMS/PMCF strategy, complaint/MDR/FSCA procedures, signal detection, and a single “one-safety-story” narrative that reconciles device vigilance with drug pharmacovigilance where relevant.

Operating cadence. Run fortnightly design reviews (requirements drift, verification gaps, usability insights), monthly regulatory boards (questions for FDA/Notified Body/PMDA/TGA; Article 117 timing), and quarterly quality councils (CAPA effectiveness, supplier health, data integrity). Keep minutes succinct and file contemporaneously in both the device Design History File (DHF) and the study Trial Master File (TMF). Where a medicinal dossier leads, maintain a DHF↔TMF map so inspectors can navigate seamlessly.

Human factors essentials. Identify critical tasks, simulate real-world contexts (lighting, dexterity limits, language), and recruit representative users (patients, caregivers, professionals). Trace residual use-related risks to labeling and training; demonstrate that IFU mitigations are feasible and that UI changes actually reduce error likelihood.

Data integrity and systems. Validate eCOA/EDC/UDI and device logs proportionate to risk; protect audit trails; reconcile EDC↔safety↔device telemetry↔manufacturing lot data on cadence; and verify that privacy/security controls align with your clinical endpoints and monitoring strategy. For connected combinations, test over-the-air update processes and document rollback plans.

Global readiness checklist (actionable excerpt).

PMOA and pathway decided; OCP (U.S.) or Article 117 (EU) engagement planned; regulator advice minutes filed.
ISO 13485 QMS implemented; ISO 14971 risk file current; usability plan through validation complete; biocompatibility and sterilization strategies documented.
Clinical Investigation Plan (ISO 14155) approved; monitoring focuses on consent, eligibility, endpoint integrity, and device accountability; data-alignment with ICH-style estimands where relevant.
U.S. route set (510(k)/De Novo/PMA) with pre-sub Q&A; IDE status (SR/NSR) resolved with IRB/FDA; UDI/GUDID plan ready.
EU MDR class and NB selected; CER/PMCF strategy aligned; Article 117 NB opinion/CE evidence integrated in medicinal dossiers as applicable.
Japan PMDA pathway (Ninsho/Shonin) defined; QMS and clinical expectations localized; Australia ARTG route selected and HREC/ethics timelines mapped.
Combination CGMP crosswalk (21 CFR Part 4) shows which device/drug provisions apply; supplier and component controls verified.
One safety story: device vigilance, MDR/FSCA, and drug PV/DSUR signals reconciled and trend-reviewed.
DHF↔TMF crosswalk complete; inspector’s index links FDA/EMA/ICH/WHO/PMDA/TGA sources to design, labeling, and clinical evidence.
Public-health alignment visible with outbound links to
FDA,

EMA,

ICH,

WHO,

PMDA,

TGA.

Takeaway. Treat device and combination programs as integrated systems: pick the right pathway via PMOA, embed ISO-based quality and risk from day one, generate ISO 14155-ready clinical evidence, and keep your device constituent visible inside drug-led dossiers. When your DHF, TMF, and global submissions tell the same story—grounded in primary sources from FDA, EMA, ICH, WHO, PMDA, and TGA—reviews accelerate and inspections go from stressful to straightforward.