MDR Article 117: Notified Body Opinion for Drug-Device Combination Products
Drug-device combination products: how to manage MDR Article 117 without discovering the gaps during review
The breaking point: when the device is “not just an accessory”
If you are managing a pre-filled syringe, a pen, or an autoinjector, you have probably already experienced the friction: in many pharma companies, the device is treated like “advanced packaging.”
During audits, the most frequent weakness I see is this: the team has a solid medicinal product dossier, but there is no equivalent level of rigor for device risk management, usability, and requirements traceability (GSPR). Until a formal request arrives, or a Notified Body becomes involved, nobody “sees” the gap.
The outdated myth to dismantle: “CE marking is enough”
Common myth: “If the component already has CE marking or the supplier is qualified, we are covered.”
Why this is inefficient and risky: for combination products, authorities and assessment bodies want to understand:
- how the device contributes to safe use (use-related risk),
- how you manage changes and suppliers (design control),
- how you demonstrate conformity with the applicable GSPRs.
Bottom line: “CE” does not replace your integrated technical dossier.
MDR Article 117: what it means operationally for Pharma RA
When a medicinal product includes an integral device, such as a pre-filled syringe, there is a need to manage evidence of conformity for the device component and, where applicable, a Notified Body Opinion.
From an RA perspective, Article 117 is not “one more document.” It is a process that affects:
- timeline planning (NB lead time),
- the structure of the technical package,
- change control, because the device changes “more often” than teams usually admit.
The deliverable that separates mature teams from reactive teams: GSPR Mapping
The core element is the GSPR checklist/mapping (General Safety and Performance Requirements):
- which requirements apply to your device,
- which evidence covers them,
- where that evidence sits (reports, testing, risk file, usability, IFU).
“30-second table”: the evidence reviewers ask for, and where it really comes from
| Evidence area | “Expected” document | Function that actually owns it | Typical weak point |
|---|---|---|---|
| Risk management | ISO 14971 Risk Management File | Engineering / device QA | Incomplete hazard analysis for use errors |
| Usability | IEC 62366-1 (Human Factors) | Engineering + Clinical + RA | “Simulated” studies without realistic scenarios |
| Biocompatibility | ISO 10993 | Supplier / Engineering | Gaps on contact materials and rationale |
| E&L | Extractables & Leachables | Lab / CMC | Not linked to shelf life and real materials |
| Packaging integrity | CCI (Container Closure Integrity) | CMC / QA | Tests not representative of the lifecycle |
| QMS | ISO 13485 (if applicable) | Quality | Processes not integrated with the pharma PQS |
Notified Body Opinion: how to avoid the “surprise effect”
From a project perspective, the NB Opinion should be managed like a mini-review:
- a clean technical package, with no redundant appendices,
- traceability: requirement → evidence → conclusion,
- a gap log: what is not available today and what mitigation is in place.
A typical mistake I see is sending a bundle of disconnected reports, without a steering document explaining: “this is the complete device story.”
Risk Management: ISO 14971 and ICH Q9 are not the same thing, but they must speak to each other
This is where internal confusion often starts:
- in pharma, you reason through Quality Risk Management under ICH Q9,
- in devices, you reason through ISO 14971, focused on hazards, use scenarios, and use-related risks.
An effective approach:
- keep the two “languages” distinct,
- but build a bridge: device hazard → patient impact → controls (technical + informational + training).
During an audit, the killer question is:
“Show me how you reduced the use-related risk to an acceptable level, and how you monitor it post-market.”
Usability / Human Factors: the regulatory risk you do not “see” in the lab
Many problems do not emerge in quality testing. They emerge when a real operator uses the device in real conditions.
LSI terms and concepts that make the difference here:
- use-related risk
- critical task analysis
- formative vs summative evaluation
- label comprehension
- IFU (Instructions for Use) as a risk control, not as an appendix
From a manufacturing perspective, the main challenge is that every micro-change, whether in material, activation force, or tolerances, can change the user experience and may therefore require reassessment.
UDI / EUDAMED: real impact on artwork and supply chain, not theory
Once UDI management and registrations come into play, including Basic UDI-DI, UDI carrier, and EUDAMED, they change:
- the artwork approval workflow,
- data governance, because master data must remain aligned,
- release timelines.
A useful contrarian insight: treating UDI as “something for device RA only” is a shortcut that backfires. If you do not involve packaging and supply chain, implementation will become the problem.
Post-market: PMS, FSCA, and the interface with safety
In combination products, post-market is not just “drug PV”:
- there is a device PMS plan,
- there may be FSCAs (Field Safety Corrective Actions) and Field Safety Notices,
- complaint trending becomes part of compliance.
In audits, what triggers attention is usually non-integrated complaint handling, for example when use-related events are classified as “customer service” instead of being treated as risk signals.
Box “Remember this”
If your product is drug-led, the device is still a source of clinical risk.
The winning strategy is to integrate the risk file, usability, and supply chain before the review asks for them.
Operational checklist: “Article 117 readiness” for Pharma RA
- You have an updated, version-controlled GSPR mapping.
- There is a complete ISO 14971 Risk Management File including mitigations and residual risk.
- Usability: you have both formative evidence (iterative) and summative evidence (final).
- Materials: ISO 10993 biocompatibility and rationale for contact/use are available.
- E&L: linked to real materials and shelf life, not treated as a paper exercise.
- CCI: tests are representative of the lifecycle, including transport, temperature, and aging.
- Change control: every device change enters a regulatory impact assessment.
- UDI / EUDAMED: master data, artwork, and supply chain are aligned.
- Complaint handling: integrated workflow across PV + QA + device RA.
- NB plan: timeline, content, owner, and a single story document.
Operational conclusion
Article 117, and more broadly the management of combination products, does not reward the teams that “fill in the most PDFs.” It rewards the teams that build a system where requirements, evidence, and changes are governed as a true lifecycle.
What feels today like “just one more project” can tomorrow become the launch bottleneck, or the supply continuity bottleneck.