Step 1: Pre-Evaluation

Defining the Right Regulatory Path: Classifying Your Drug-Device Combination Product

The first and most crucial step in the regulatory pathway is determining the correct classification of your product—whether it qualifies as an integral drug-device combination (iDDC), a co-packaged product, or both. Ideally, this decision should be made early in development and double-checked again for accuracy, as it defines the applicable regulatory route: either the EU Medical Device Regulation (MDR 2017/745) or Directive 2001/83/EC for medicinal products.

In the section that follows, we’ll explore key aspects of this classification, including:

• Differentiating between iDDCs and co-packaged products
• Verifying the need for a CE mark
• Understanding the role of Notified Bodies (NBs) in the approval process

These foundational elements are essential for a smooth and compliant development pathway.

CE Mark and Notified Body Involvement: Key Steps in the Regulatory Assessment

Once the classification of your combination product is determined, the next step is verifying the regulatory status of the medical device component—particularly its CE marking and the involvement of a Notified Body (NB).

CE Mark Verification

Start by evaluating whether the device component already holds a valid CE mark under the Medical Device Regulation (MDR). It’s essential to ensure that its intended purpose aligns with the therapeutic or medical function of the combination product.

• CE-marked and compatible: If alignment is confirmed, proceed confidently to the next step in the regulatory pathway.
• No CE mark or not compatible:
  - For co-packaged products, identify a suitable alternative that meets MDR requirements.
  - For iDDCs, classify the device component per MDR Annex VIII rules as it would be a standalone medical device.

Notified Body (NB) Involvement

The need for NB involvement depends on the device classification, which is determined based on factors such as the intended use, invasiveness, duration of contact, and the potential risk to users or patients—defined in detail in MDR Annex VIII.

• Class I devices (e.g., non-sterile syringes without measurement markings) typically do not require NB review.
• Higher-risk classes (Is, Im, IIa, IIb, III)—including sterile prefilled syringes or syringes with graduation—do require the involvement of a Notified Body seeking for Notified Body opinion (NBOp).

Understanding and fulfilling these requirements early in development ensures smoother regulatory progress and helps avoid costly delays.

Step 2: Data Creation & Documentation

From top to bottom the tasks of step 2 and the substeps 2.1 and 2.2 are evaluated separately for the following products:
1. iDDC with and without NB
2. iDDC with CE-marked device component
3. Co-packed/ referenced

iDDC with and without NB

Step 2.1
Objective: For the iDDCs with and without a NB compliance to the applicable GSPRs, Annex I, MDR is to be demonstrated.

The GSPRs – the General Safety & Performance requirements are a set of requirements covering the whole range of medical devices. From a simple tongue plaster to MRT. For placing of a medical device on the EU market, compliance to the applicable GSPRs is to be demonstrated.

Annex I is divided into three main chapters: (details see below table)

• Chapter I general requirements
• Chapter II requirements regarding design and manufacture
• Chapter III requirements regarding the information supplied with the device

Covering requirements that ensure that device is:

• Safe for patients, users, and others
• Perform as intended
• Manufactured and designed to minimize risk

Each chapter does include several requirements, as outlined in the table below. Each of those requirements includes a subset of requirements resulting in total of approximately 200 requirements.

Table 1 GSPR overview

CHAPTER I GENERAL REQUIREMENTS	CHAPTER II REQUIREMENTS REGARDING DESIGN AND MANUFACTURE	CHAPTER III REQUIREMENTS REGARDING THE INFORMATION SUPPLIED WITH THE DEVICE
1 Safe; perform as intended	10 Chemical, physical and biological properties	23 Label and instructions for use
2 Risk reduction, risk-benefit ratio	11 Infection and microbial contamination
3 Risk Management System	12 Devices incorporating a substance considered to be a medicinal product
4 Risk control measures	13 Devices incorporating materials of biological origin
5 Eliminating & reducing risks related to use error	14 Construction of devices and interaction with their environment
6 Lifetime	15 Devices with a diagnostic or measuring function
7 Transport & Storage	16 Protection against radiation
8 Minimising foreseeable risks, and any undesirable side-effects	17 Electronic programmable systems
9 Devices without a medical purpose	18 Active devices and devices connected to them
	19 Particular requirements for active implantable devices
	20 Protection against mechanical and thermal risks
	21 Protection against the risks posed to the patient or user by devices supplying energy or substances
	22 Protection against the risks posed by medical devices intended by the manufacturer for use by lay persons

Documenting the tasks in a tabulated for this results in the so-called GSPR Checklist (see annex II MDR, 4), see example below.

Step 2.2
While Annex I defines the WHAT (safety and performance requirements), Annex II specifies the HOW (documentation structure and data organization), detailing the technical documentation requirements necessary to demonstrate compliance to the applicable GSPRs.

That’s what some NBs expect being provided (and recommended as the review is facilitated by a familiar structure of the data).

Although not explicitly required by Article 117, Annex II not only provides a structure but also offers guidance regarding the content requirements for fulfilling Annex I.

Table 2 Summary of Annex II MDR

CH.	Description	Main Content	Key Points/Examples
1	Device description and specification, including variants and accessories	- General description of the device - Intended purpose and users - Risk class and justification - Principles of operation - Novel features - Accessories and variants - Reference to previous and similar generations	- General description of the device - Intended purpose and users - Risk class and justification - Principles of operation - Novel features - Accessories and variants - Reference to previous and similar generations
2	Information supplied by the manufacturer	- Labels - Instructions for Use (IFU) - Other information provided with the device	- All labeling and IFU as supplied to users
3	Design and manufacturing information	- Description of design and manufacturing processes - Manufacturing environment controls - Suppliers and subcontractors	- Design drawings - Design Specifications - Manufacturing process details - List of critical suppliers
4	General safety and performance requirements	- Evidence of conformity with GSPRs (Annex I) - Declaration of conformity - List of applicable standards and guidelines	- How the device meets safety/performance requirements - Applied harmonized standards
5	Risk management	- Benefit-risk analysis - Risk management process and results - Compliance with ISO 14971	Risk Management file Including Plan, report, analysis
6	Product verification and validation	- Pre-clinical and clinical data - Biocompatibility, electrical safety, software validation - Sterilization, stability, packaging - Additional info for specific cases (e.g., medicinal products, animal tissues, measuring function)	Test reports/ test summaries, e.g. Design verification studies Biocompatibility plan & report, clinical evaluation, transport, packaging, sterilization…

Why is that information about Annex II, I helpful?
Let us first take a closer look at the expectations regarding the data and information related to the medical device component within the dossier. These expectations are outlined in the EMA Guideline.

Some examples:

Module 3.2.

P.2 Pharmaceutical Development
This section of the dossier should summarise the information relevant to development of the specific medical device (part) integrated into the medicinal product, including the rationale for its selection in the specific sections of 3.2.P.2. A risk assessment summary for the medicinal product, aligned with relevant risk management principles in ICH Q9, should be presented.

P.3.5 Process validation and/or evaluation
Process validation for the integral medicinal product manufacturing process should be performed, as appropriate, in line with relevant European guidelines, including the assembly and sterilisation of the device (part) (if applicable) and any filling steps.

P.8 Stability
Stability studies for the integral medicinal product (or variant, where justified) should include the following tests/studies:
4. Functionality tests determined as stability-indicating CQAs for the medicinal product (refer to P.2.4).

The requirements defined by the EMA Guideline, the Annex II & I do correlate quite well, as shown with the examples below:

Table 3 Correlation between Annex II, I, & EMA guideline (excerpt)

Annex II MDR sections	Annex I MDR	Dossier / CTD
3 Summary of development 3a) information to allow the design stages applied to the device to be understood;	1 “… devices shall be designed & manufactured…” See also, e.g. 7, 10	3.2.P.2 This section of the dossier should summarise the information relevant to development of the specific medical device (part) integrated into the medicinal product,
3 Process verification & validation („ 3b (…) complete information and specifications, including the manufacturing processes and their validation“)	e.g. 1, 7, 10	3.2.P.3.5
6 Stability testing („ detailed information regarding test design, complete test or study protocols (…) for stability, including shelf life; “	6, 11.3, 11.4	3.2.P.8

Thus, this correlation might serve for various purposes, e.g.
- Guidance where to find data for the device component in the dossier (ideally) suitable demonstrating compliance to Annex I / II
- Guidance where to allocate device component data in the dossier
- Guidance where to allocate device component data in the TD

Even if it is considered as a single integral product, it will be unavoidable to divide the data in principle into three buckets, as these are used for different purposes.

• Part 1 and 2 for the Notified Body Opinion (NBOp) or the MAHs declaration of conformity.
• The MAHs declaration of conformity or NBOp plus bucket 3 and 2 for approval by the authorities.

Redundancies cannot be avoided, but can be reduced through a clever structure, which ultimately can also simplify data maintenance.

Explanation of the Structure:
Buckets 1 & 2: Focus on documentation for the Notified Body Opinion (NBOp) and MAHs declaration of conformity (e.g., GSPR checklist, risk management, technical specifications).

Parts 3 & 2: Combine the NBOp/ MAHs declaration of conformity with additional data (e.g., clinical, stability, or drug-specific information) for regulatory approval by authorities (e.g., EMA or national agencies).

Redundancy Management: Use cross-references and modular documentation to avoid duplication while ensuring all requirements for both the NBOp and marketing authorization are met. The correlation table between Annex II, I and the CTD might serve as a pointing document.

Data Maintenance: A well-organized structure ensures easier updates and compliance tracking over the product lifecycle.

iDDC with CE-marked device component

Step 2.1
Objective: Demonstrate compatibility and reconfirm the suitability of the device for use with the drug.

Data Assessment/Creation Steps:

1. Reconfirm the scope of the CE-marked device for the combination product, including its intended use (indications, limitations), manufacturing processes, assembly requirements, and other relevant parameters.
2. Evaluate existing data to determine its adequacy in addressing the requirements outlined in the EMA Guideline.
3. Address potential gaps: While the CE mark provides a presumption of conformity with relevant requirements, additional data may still be necessary to fully demonstrate compliance with the General Safety and Performance Requirements (GSPRs) for the particular combination.

Step 2.2
Objective: Drug-device compatibility data

Documentation Compilation:

1. Include a valid CE certificate or Declaration of Conformity (DoC) for the device to demonstrate compliance with applicable General Safety and Performance Requirements (GSPRs).
2. Embed evidence documentation (e.g., supplier data, internal test reports, risk assessments) in the dossier to confirm compatibility between the device and medicinal product. This should address interaction risks, usability, and performance throughout the product’s lifecycle.
3. Structure the data in line with CTD requirements provided in the EMA guideline

Key Considerations:

• Supplier Data: If relying on supplier-provided evidence (e.g., biocompatibility, sterilization validation), ensure it is traceable and referenced in the dossier.
• Own Data: Include in-house compatibility studies (e.g., leachables/extractables, dose accuracy) to address gaps not covered by the CE mark or supplier documentation.
• Risk Assessment: Align with ICH Q9/ISO 14971 principles to justify compatibility and mitigate interaction risks.

Co-packed/referenced

Step 2.1
Target: Demonstration of compatibility of the device with the drug.

Data Assessment/Creation:

• Request and assess device supplier data, including the CE certificate, scope of certification, and additional documentation such as the Instructions for Use (IFU) and any other relevant technical or regulatory documents.
  
  Avoid assuming device manufacturer obligations under MDR Article 16 by ensuring:
  - The device’s intended use remains unchanged.
  - No modifications are made to the device that could void its CE mark
• Follow EMA Guideline requirements to ensure alignment with regulatory expectations for a co packed/ referenced product

Step 2.2
Target: Drug-device compatibility data.

Documentation Compilation:

• Include a valid CE certificate or Declaration of Conformity (DoC) for the device to confirm compliance with applicable regulations.
• Embed evidence documentation (e.g., supplier-provided data, internal test reports, risk assessments) within the dossier to substantiate compatibility and safety of the device-drug combination. Ensure all data is traceable and cross-referenced in alignment with CTD structure (e.g., Module 3.2.P.7 for container closure system details).

Key Considerations

1. Regulatory Compliance and CE Marking

• CE Mark Validity: Ensure the co-packaged device has a valid CE mark under MDR (or MDD during transition periods). Verify the device’s intended use aligns with its original certification when paired with the medicinal product
• MDR Transition Challenges: If the device is transitioning from MDD to MDR, confirm the manufacturer’s compliance timeline to avoid market disruptions
• Unique Device Identification (UDI): Include the device’s UDI in documentation (if applicable) and ensure traceability

2. Documentation and Dossier Integration

• EMA Guidelines: Follow EMA’s quality documentation requirements for co-packaged products, focusing on:
  - Container Closure System (Module 3.2.P.7): Detail device specifications, sterility, and compatibility with the drug
  - Pharmaceutical Development (Module 3.2.P.2): Describe how the device impacts drug safety, efficacy, and usability (e.g., dosing accuracy)
  - Stability Data: Provide in-use stability data if the device affects drug integrity (e.g., sterility maintenance)
• Supplier Agreements: Secure contracts ensuring the device manufacturer remains responsible for MDR compliance (e.g., post-market surveillance)

Summary
Depending of the product, the following should be available:

	iDDC with NB	iDDC without NB	iDDC with CE marked device	Co-packed/ referenced
Deliverable	GSPR Checklist Technical documentation acc. Annex II CTD	GSPR Checklist Technical documentation acc. Annex II MAH’s statement of compliance with the relevant GSPRs of the MDR Annex I CTD	GSPR Checklist (part of CE certificate/ Declaration of conformity for the device component, in a best case scenario) Suitability & compatibility data for the device component CE certificate/ Declaration of conformity for the device component CTD	Suitability & compatibility data for the device component CE certificate/ Declaration of conformity for the device component CTD
Next step	NBOp	Authority approval

Step 3: NBOp Process and Approval

NBOp Process

For the iDDC requiring an Notified Body, Art 117 MDR mandates that manufacturer of the drug product (Marketing Authorization holder – MAH) must obtain a Notified Body Opinion (NBOp) on the device component before submitting their Marketing Authorization Application (MAA) to the competent authority, such as the European Medicines Agency (EMA). The NBOp process is not a certification or CE marking procedure; rather, the Notified Body conducts an independent assessment of the provided data demonstrating compliance to the applicable GSPRs using processes similar to those in a CE mark/conformity assessment. After this review, the Notified Body issues an Notified Body Opinion report, which must be included in the MAA.

The NBOp process under Article 117 does not assign ongoing surveillance responsibilities to the Notified Body for the device component. Therefore, the Notified Body involved in the initial NBOp may be different from the one involved in a subsequent NBOp, for example, if changes to the device require a new assessment.

The steps leading up to the submission may include the following:

a) Identifying a suitable Notified Body;
b) Submitting an application to the selected Notified Body;
c) Receiving and approving a quotation;
d) Planning the submission process.

Identification of a NB (if not done yet)

The identification and selection of the Notified Body is the responsibility of the Marketing Authorization Holder (MAH). You can find a complete and regularly updated list of all Notified Bodies in the EU on the NANDO (New Approach Notified and Designated Organisations) website maintained by the European Commission. When choosing a Notified Body, factors such as the scope of designation, language, and other relevant criteria should be considered. Art 117 is not in scope of each notified body – early engagement is highly advisable.

It is possible scheduling structured dialogs with the preferred NBs prior to the application. Those discussions might be useful aligning on expectations, provide details on the product, etc. Per MDR, the NBs are not allowed to provide consultation, only discussions.

NBOp Application

Each Notified Body does have are more or less similar application process – completion of forms by the MAH or representative (either available on the website or upon request) followed by an offer related to the requested services.

Once having signed-off that quotation, the details relating to the submission can be discussed and scheduled.

Prior proceeding with the next step, it is highly recommended engaging with your NB early and align on expectations, if not yet done, like submission format, timelines, etc.

Submission & Evaluation

The specific details on what data to provide and how to structure it are outlined in Step 2 ("Data Creation & Documentation").

The Notified Body (NB) conducts its review and may issue questions or requests for clarification. The applicant is required to respond to these queries and provide any additional evidence as necessary. If, after three rounds of questions, unresolved gaps remain, the procedure is concluded with a negative outcome, and a negative NBOp report is issued.

Conversely, if all questions are satisfactorily addressed, the NB issues a positive NBOp report to the applicant.

Some notified bodies offer accelerated or dedicated review services, which can positively impact project timelines by expediting the assessment process. However, it is important to note that these services typically incur higher costs compared to the standard review procedure.

Timelines (might vary due due complexity/ ressources etc.):

- From identification to submission: 1-3m
- Submission to NBOp report: 3-6m

From a timesaving point of view, it seems logical to initiate the NBOp process with the submission to the authority. But, it poses a certain risk either not having completed the NBOp process in time or having a negative outcome.

For the other combination product types:

• iDDC without need for a NBOp
• iDDC with an already CE marked device
• Co-packed/ referenced (presuming the device is already CE marked)

There’s no need for a an additional review by a Notified body (presuming the device is and remains CE marked). The data relevant to the device component is to be provided with the submission to the authorities, see step 2 for further details about that data.

When and Why?

The requirements defined in Art. 117 and the EMA Guideline applies/ will apply to any drug-device combination product on the EU market considering the following timelines:

• Products approved prior to the date of application (DoA) of the MDR (26th of May 2021) when there is either a substantial change to the device part or when adding or replacing a new device (so called ‘legacy devices’).
• New marketing authorizations after the DoA need to comply to Art. 117 at the time of submission. (see MDR, EMA Guideline & FAQ).

The fact that this approach is already being implemented is evident in the relevant sections of both the variation application form and the marketing authorisation application form. For example, in the variation application form (current version refer to https://esubmission.ema.europa.eu/eaf/index.html), applicants are required not only to indicate whether the submission concerns a change or a new device, but also to provide details regarding the type of combination product. In some cases, authorities already request the corresponding evidence as part of the submission process, while in other cases this is not yet required. This may be due to the current lack of a comprehensive legal framework. In step 4 of our series, we will further examine this topic, taking into account new and anticipated guidance, such as the Variation Categorisation Guideline.

Approval New Drug-device Combination Product

Legal basis of an EU MAA
Marketing Authorisation Applications (MAA) in the European Union (EU)/European Economic Area (EEA) are submitted in accordance with the relevant legal basis specified in Directive 2001/83/EC, as amended. The legal basis defines the regulatory requirements and documentation required as follows:

• Article 8.3 – “full” application supported by full clinical, non-clinical and quality documentation;
• Article 10(a) – “well established use” application supported by substantial published literature showing safe and efficacious use of the product for more than 10 years;
• Article 10(b) – “fixed combination” application whereby documentation usually expected to be linked to existing applications for the single active substances that are combined to achieve a therapeutic benefit;
• Article 10(c) – “informed consent” application whereby a MAH may grant another company full access to all pharmaceutical, clinical and non-clinical documentation for the purposes of applying for their own MAA for the same product;
• Article 10.1 – “generic” application whereby a MAH claims equivalence to the innovator product and reference to the innovator´s pharmaceutical, clinical and non-clinical documentation;
• Article 10.3 – “hybrid” application for products which do not fall into the definition of a generic medicinal product; supported by own data plus reference to the innovator’s pharmaceutical, clinical and non-clinical documentation;
• Article 10.4 – “biosimilar” application for biological medicines whereby a MAH claims equivalence to the innovator biological product and reference to the innovator’s documentation, as far as possible.

For a new drug-device combination product most likely Article 8.3, 10.3 or 10.4 becomes applicable. This should be evaluated in a product-specific regulatory strategy evaluation.

Regulatory Procedures
In general, within the EU/EEA there are four regulatory procedures for MAA, these are:

• Centralised Procedure (CP), whereby a single marketing authorisation granted in all EU/EAA countries at the same time - depending on the type of product the CP can be mandatory or optional;
• Mutual-Recognition Procedure (MRP), whereby a marketing authorisation granted in one EU/EEA Member State can be recognised in other EU countries;
• Decentralised Procedure (DP), whereby a medicine that has not yet been authorised in the EU can be simultaneously authorised in several EU/EEA Member States;
• National Procedure (NP), whereby a marketing authorisation granted in one EU/EEA Member State.

If the medicine is outside the mandatory scope of the centralised procedure and the medicine has not been authorised within the EU previously, the applicant/company can choose depending on their marketing approach which procedure to use.

Centralised Procedure (CP)
The Centralised procedure is a European Union/European Economic Area (EEA)-wide procedure for the authorisation of medicines, where there is a single application, a single evaluation and a single authorisation throughout the European Union. Only certain medicines such as products containing a new active substance to treat for example cancer, viral diseases or diabetes are eligible for the centralised procedure, details are available here.

EMA is responsible for evaluating the quality, safety and efficacy of marketing authorisation applications assessed through the Centralised Procedure, including the safety and performance of a medical device in relation to its use with a medicinal product.

Mutual-Recognition Procedure (MRP)/ Decentralised Procedure (DCP)
Both, the MRP and the DCP, are European procedure to apply for a marketing authorisation in the EU/EEA in more than one Member State. They are open for all applications which are outside the scope of the CP. The MRP must be chosen in case a marketing authorisation for the same medicinal product has already been granted by a Member State of the EU/EEA. Whereas the DCP is applicable if no marketing authorisation exists.

Both types of procedure are lead by the Reference Member State (RMS), who is responsible for preparing an Assessment Report (AR) which summarises the dossier presented by the applicant as well as characterises and critically evaluates the medicines quality, safety and efficacy. The RMS can either be chosen by the applicant (DCP) or is the MS of the already existing MA. All other countries are Concerned Member States (CMS), who review and evaluate the AR by the RMS. Each involved MS will issue a marketing authorisation based on the final outcome of the procedure.

In case consensus on the approvability of the MAA (or post approval variation) cannot be reached among the MS, the Coordination Group for Mutual-Recognition and Decentralised Procedure (CMDh) examines questions relating to these applications, facilitates the dialogue and helps finding an agreement.

Details information on the procedures and best practices guides are available on their website.

National Procedure (NP)
The national authorisation procedure is defined in the respective national law of each Member state. Information about the procedure and requirements can normally be found on the webpages of the national competent authorities. The list of CA can be found here.

The regulatory pathway for a Marketing Authorisation Application (MAA) for combination products requires early strategic planning to address complex compliance requirements and ensure timely approval. The process is shaped by the product’s classification, constituent components, and intended indication, necessitating a tailored approach from the outset.

Key Determinants of the Regulatory Roadmap

- Combination product classification (see step 1)
- Drug Substance or Indication

Orphan or pediatric indications require early engagement with the EMA’s Committee for Orphan Medicinal Products (COMP) or Pediatric Committee (PDCO). Orphan designation applications should precede MAA submission to leverage incentives, while Pediatric Investigation Plans (PIPs) must be agreed upon during development.

For novel indications or rare diseases, conditional MA or approvals under exceptional circumstances may apply, requiring post-authorization studies to confirm benefit-risk profiles.

Early Development Considerations and Strategic Elements

• Scientific Advice & Structured Dialogue: Proactive consultation with the authorities and/ or notified body is critical to align on non-clinical, clinical, and manufacturing requirements. This is particularly vital for innovative products deviating from standard guidelines
• Regulatory marketing planning: early considerations for market access strategies
• Exclusivity & patent research

Early definition of the regulatory roadmap, supported by multidisciplinary dialogue and adherence to evolving guidelines, is indispensable for navigating the complexity of combination product approvals

Further Links

• Authorisation of medicines | European Medicines Agency (EMA) (europa.eu)
• Obtaining an EU marketing authorisation, step-by-step | European Medicines Agency (EMA) (europa.eu)
• National competent authorities (human) | European Medicines Agency (EMA) (europa.eu)
• Medical devices | European Medicines Agency (EMA) (europa.eu)
• Quality documentation for medicinal products when used with a medical device - Scientific guideline | European Medicines Agency (EMA) (europa.eu)
• Heads of Medicines Agencies: Application for MA (hma.eu)
• Extensions of marketing authorisations: questions and answers | European Medicines Agency (EMA) (europa.eu)