ISO 10993Biological evaluation of medical devices

ISO 10993 is the international, multi-part standard that governs the biological evaluation of medical devices. It defines how manufacturers should identify relevant biological risks and demonstrate biological safety for the intended use of a device. The core principle is risk management: testing is not a rote checklist but a science-based justification, grounded in device materials, patient-contact type, and contact duration.

Regulators worldwide expect biological safety evidence consistent with ISO 10993. In the European Union, Regulation (EU) 2017/745 (MDR) Annex I, General Safety and Performance Requirement (GSPR) 10 requires demonstration of biological safety using state-of-the-art methods, for which ISO 10993 is the prevailing reference. The U.S. FDA recognizes ISO 10993-1 and sets expectations in its biocompatibility guidance for 510(k), De Novo, and PMA submissions. Comparable expectations are applied by Health Canada, Japan’s PMDA, Australia’s TGA, and the UK’s MHRA.

Practically, ISO 10993 links a device’s clinical exposure to relevant biological endpoints such as cytotoxicity, sensitization, irritation, acute and subchronic systemic toxicity, genotoxicity, hemocompatibility, implantation, and, where appropriate, chronic toxicity, carcinogenicity, and reproductive or developmental toxicity. It also emphasizes chemical characterization and toxicological risk assessment, ensuring that any biological testing addresses genuine residual risk.

Because the standard is applied within a larger risk framework, manufacturers should harmonize their biological evaluation plan with overall device risk management and clinical strategy. Regional regulatory pathways translate this standard into dossier expectations, including justification of endpoint selection, study design, and conclusions supported by the totality of evidence.

For regional context and submission mechanics, see the related readiness guides for the EU and U.S. markets, which map how ISO 10993 evidence fits into technical documentation and premarket files.

Links: EU Medical Device Regulatory Readiness, USA Medical Device Regulatory Readiness

ISO 10993 applies to finished medical devices and componentry that have direct or indirect patient contact during intended use. This includes transient surface contact devices, externally communicating devices that contact mucosal tissue or breached surfaces, blood-contacting devices and circuits, and implants that remain in situ for prolonged or permanent durations. The standard also covers resorbable materials, coatings, adhesives, additives, colorants, and manufacturing residues that can plausibly reach the body from the clinical route of exposure.

Determining applicability begins with an unambiguous use description, mapping clinical exposure pathways and duration. ISO 10993-1 organizes this into contact categories and durations: limited (less than 24 hours), prolonged (24 hours to 30 days), and permanent (more than 30 days). The patient-contact map for the intended use configuration, including sterilization states and reprocessing, frames which biological endpoints are relevant.

Devices without patient contact, such as standalone software or non-clinical manufacturing equipment, generally fall outside ISO 10993. In vitro diagnostic instruments that do not contact the patient similarly may be out of scope. However, accessories like lancets, swabs, and sampling kits with patient contact are in scope and must be evaluated according to their specific exposure conditions. For combination products and borderline cases, precedence goes to the clinical route of exposure, conservative worst-case selection, and robust justification.

Biological evaluation supports both market authorization and clinical study readiness. For first-in-human and pivotal clinical investigations, the biological evaluation should be complete, consistent with final materials, and inclusive of worst-case sterilization and aging states. Harmonizing the biological evaluation with clinical development plans helps avoid late-stage rework and submission delays.

Related: planning clinical evidence alongside biocompatibility is addressed in the clinical investigation framework.

Link: ISO 14155 Clinical Investigation

In ISO 10993, the biological evaluation is a structured risk process rather than a fixed panel of tests. It starts by understanding the device’s materials, processing, and clinical exposure, then proceeds through characterization and toxicological risk assessment. Only unresolved or uncertain risks should drive biological testing. Historical data, literature, and device family evidence are used wherever valid to avoid unnecessary new studies.

Execution centers on two controlling documents: the Biological Evaluation Plan (BEP), which sets scope and rationale, and the Biological Evaluation Report (BER), which synthesizes results and conclusions. The BEP should specify intended use, contact category and duration, materials of construction, prior use history, chemical characterization strategy, assumptions, acceptance criteria, and triggers for testing. The BER should distill conclusions by endpoint and clearly state residual risks and mitigations.

Risk tools should be used to make rationale visible and scalable across variants. Exposure-driven risk scoring and transparent acceptance criteria help reviewers trace logic from materials to endpoints to testing, and support change impact analysis throughout the lifecycle.

1. Define intended use, patient-contact mapping, and worst-case configuration.
2. Inventory materials and processing, including sterilization and reprocessing.
3. Conduct chemical characterization and materials literature review.
4. Perform toxicological risk assessment against health-based thresholds.
5. Identify gaps and design targeted biological tests only where needed.
6. Compile the BER, align residual risks with overall device risk management.

For risk visibility and traceability, align your biological evaluation with your cross-functional risk tools and registers so that toxicological assumptions and endpoints are managed as living data rather than static appendices.

Links: Risk Matrix, Quality Risk Register

ISO 10993-1 aligns biological endpoints with the device’s clinical contact category and exposure duration. This mapping is principle-based: endpoints are selected when plausible exposure and toxicological risk remain after characterization and literature evaluation. The standard’s annexes provide guidance tables indicating which endpoints are typically relevant for specific category and duration combinations.

Commonly considered endpoints include cytotoxicity, sensitization, irritation or intracutaneous reactivity, acute and subchronic systemic toxicity, genotoxicity, hemocompatibility for blood-contacting applications, implantation for local tissue response, and for long-term or resorbable exposures, chronic toxicity, carcinogenicity, and reproductive or developmental toxicity. Pyrogenicity may also be relevant for certain parenteral or blood-contact paths. The objective is to test only what is necessary to close residual risk.

The table below summarizes frequent pairings of contact categories and durations with typical endpoints. It is indicative and not prescriptive; your BEP should justify additions or omissions based on chemical characterization, toxicological thresholds, materials history, and clinical exposure specifics.

Modern biocompatibility hinges on robust chemical characterization and quantitative toxicological risk assessment (TRA). ISO 10993-18 covers chemical characterization of materials and devices, while ISO 10993-17 describes how to derive allowable limits and evaluate patient exposure. This work often reduces or replaces in vivo testing by resolving risk based on the identity and quantity of extractables and potential leachables.

Characterization should consider clinically relevant worst-case articles, final manufacturing and sterilization, and, where applicable, simulated aging. Extraction design is guided by solubility, polarity, surface area-to-volume ratios, temperature, and time, anchored in plausible clinical exposure. Analytical methods should deliver appropriate identification confidence, low limits of quantitation, and mass balance to support defensible toxicological conclusions.

The TRA links measured or bounded patient exposure to health-based thresholds, such as tolerable intake or threshold of toxicological concern, accounting for route of exposure and duration. For metals and inorganic species, toxicological guidance frameworks may be informative for limit-setting. Where identification is incomplete, conservative surrogate values and uncertainty factors must be clearly justified in the BEP and BER.

Effective programs tie analytical data control to quality processes, ensuring that method validation, sample chain-of-custody, and data integrity are auditable. Cohesive management of laboratory results and their toxicological interpretation streamlines dossier preparation and future change assessments.

Link: Lab QC

When biological testing is necessary, ISO 10993 expects studies to be scientifically justified, well-controlled, and aligned to the clinical exposure scenario. Test articles should represent the worst-case configuration, including final sterilization, processing, and where applicable, end-of-life aging. Negative and positive controls must be appropriate, and extraction conditions must reflect clinically plausible solubilization.

Good Laboratory Practice (GLP) increases regulator confidence, especially for systemic toxicity and implantation studies. While not always legally mandated in every jurisdiction, GLP or GLP-like rigor in protocol design, data recording, and quality assurance is commonly expected by agencies reviewing market authorizations. Select laboratories with demonstrated competence in ISO 10993 methods, relevant accreditations, and traceable data integrity.

The standard encourages replacement, reduction, and refinement of animal use where validated alternatives exist. For irritation, ISO 10993-23 provides in vitro methods that can obviate traditional in vivo tests. For sensitization, non-animal assays and weight-of-evidence approaches can support decisions when mechanistic and exposure data suffice. Hemocompatibility testing should be tailored to device function and clinical use, combining physicochemical characterization with targeted in vitro and ex vivo methods.

Plan study sequences to avoid duplicative testing and to leverage chemical characterization outcomes. Early toxicological screening can rule out the need for certain in vivo endpoints, allowing resources to focus on the few studies that are truly risk-relevant. Clear pre-specification of acceptance criteria and decision rules helps reviewers see how results will drive conclusions and mitigations.

The Biological Evaluation Plan (BEP) is the contract between your scientific rationale and your submission. It should define use conditions, contact mapping, materials of construction, prior use and literature data, chemical characterization plan, toxicological thresholds and acceptance criteria, and the logic for any biological testing. The Biological Evaluation Report (BER) synthesizes the totality of evidence across endpoints and must conclude on biological safety for the intended use.

Robust documentation requires traceability from device bills of materials and processing parameters to analytical data and study results. Justifications for test omissions must be explicit, including citations, material specifications, and exposure estimates. Where testing is performed, protocols, raw data, deviations, and statistical analyses must be archived in a form suitable for audit and regulatory review.

Change control is critical. Any change in materials, additives, suppliers, sterilization, processing, or shelf-life assumptions can alter exposure and trigger partial re-evaluation. Establish rules that classify changes by potential to affect biological safety and define clear rework actions, such as updated extractables testing, revised toxicological calculations, or targeted biocompatibility studies.

Integrate the BEP and BER into your quality management system so they are version-controlled, reviewed on a defined cadence, and cross-referenced in risk files and clinical evidence. This ensures that biocompatibility is maintained as a living system rather than a one-time premarket exercise.

Links: QMS, Document Control

Overtesting and undertesting are both common errors. Testing without a risk basis may produce non-informative results and ethical concerns, while failing to test where residual risk remains will delay approvals. Agencies scrutinize whether chemical characterization and toxicological rationale were performed early and whether selected endpoints flow logically from clinical exposure, materials, and duration.

Another frequent weakness is inadequate extraction design and documentation. Extraction vehicles, surface area normalization, temperature, and time must be justified by clinical relevance. Sterilization residues, post-processing cleansers, colorants, adhesives, and 3D-printed photopolymers are often overlooked sources of leachables. For implants and resorbables, degradation products and particulates must be considered alongside parent materials.

Regulators also examine test article representativeness. If studies are run on subassemblies, prototype materials, or different sterilization lots, equivalence must be demonstrated. Non-GLP studies can be acceptable if methods are robust and data integrity is demonstrated, but GLP significantly reduces questions for systemic endpoints. Lastly, omissions must be explicit, specific, and justified with data, not merely by citing device family similarity.

Set acceptance criteria before testing and link them to health-based thresholds, not solely to historical comparators. Ensure that failures trigger root-cause investigation, corrective actions, and, where necessary, design or process changes that genuinely reduce exposure or hazard.

Link: Audits and CAPA Auto-Routing

ISO 10993 operates inside a broader ecosystem of medical device standards and regulatory requirements. It is tightly coupled to ISO 14971 risk management, where biological hazards and harms are identified, estimated, and controlled. Biological safety conclusions in the BER should be cross-referenced in the device risk file so that toxicological assumptions and residual risks are visible within the overall benefit–risk narrative.

Quality management under ISO 13485 ensures that materials, suppliers, manufacturing processes, and sterilization are controlled. This is essential for preserving biocompatibility over time, since even minor changes in additives, adhesives, or cleaning agents may alter extractables profiles. Under the EU MDR, biological safety supports compliance with GSPR 10 in the technical documentation. For U.S. submissions, ISO 10993 evidence is summarized in the biocompatibility section of 510(k), De Novo, or PMA files.

Clinical evidence frameworks, such as ISO 14155 for clinical investigations, are downstream consumers of biocompatibility conclusions. A credible biological evaluation provides a foundation for first-in-human access and supports risk mitigation in clinical protocols. Postmarket surveillance should also monitor signals indicating potential biological safety issues, such as unexpected inflammatory responses or material degradation in situ, feeding back into risk management and, if needed, new characterization.

Software-only products without patient contact generally fall under software lifecycle and cybersecurity frameworks rather than biological evaluation. Combination products and drug–device interfaces require careful alignment so that biological evaluation is consistent with both device and medicinal product toxicological expectations in the applicable jurisdiction.

Biological evaluation succeeds when rationale, data, and changes move together. V5 Ultimate centralizes your BEP and BER alongside materials inventories, sterilization parameters, and analytical datasets, so toxicological assumptions and acceptance criteria are traceable and review-ready. Targeted workflows route protocols and reports for scientific review, lock revisions, and link results to device configurations and lots.

Chemistry results and toxicological calculations are captured as structured data, enabling rapid gap analysis when suppliers, sterilization cycles, or shelf-life claims change. Test article representativeness is documented with clear lineage to final manufacturing states, helping you defend worst-case selections. Integrated dashboards show endpoint status by device and market, while submission exports assemble regulator-specific summaries on demand.

Teams can coordinate study readiness with checklists for GLP expectations, extraction rationales, and identification thresholds. When a study outcome falls short, deviation workflows guide root-cause, corrective action, and retest decisions with full traceability. For audits and submissions, reviewers can follow the thread from risk identification to characterization data, study evidence, and final conclusions without leaving the platform.