Table of Contents
- Aligning Biological Evaluation with ISO 14971: Foundations and Frameworks
- Integrating Foreseeable Misuse into Biological Risk Assessment
- Determining Contact Duration and Exposure Scenarios in Biological Evaluation
- Breaking Down Table A.1: Understanding the Four New Device Categories
- Evolution of Device Categories: Key Changes in ISO 10993-1:2025
- Material-Mediated Pyrogenicity: Status and Considerations in ISO 10993-1:2025
- Integrating Physical and Chemical Data into Biological Risk Assessment
- Establishing Biological Equivalence: A New Standard
- Redefining Systemic Toxicity in Medical Devices
- Genotoxicity Assessment for Prolonged Exposure Devices
1. Aligning Biological Evaluation with ISO 14971: Foundations and Frameworks
Whether it is definitions or just overall wording, concepts of ISO 14971 are more imbedded in the standard. If you are not an avid user of ISO 14971, it will take some time to get used to it. And there is not yet an equivalent of ISO 24971 for the ISO 10993-1:2025 to guide you on the use of the new standard.
The concept of incorporating an assessment of risk into the biological evaluation of a medical device was not specifically mentioned as a part of ISO 10993-1 until 2009, 17 years after the standard was first released in 1992. This concept was emphasized further in the 2018 version, but the 2025 version takes it to the next level.
- Biological evaluation is now presented as a portion of the overall risk management process, including the identification of biological hazard(s), defining biologically hazardous situation(s) and then establishing biological harm(s). The use of the term “biological” before these concepts establishes that ISO 10993-1:2025 is focused specifically on the biological aspects and thereby narrows its scope as compared to ISO 14971.
- Working within the ISO 14971 paradigm, once the biological harms associated with a device are identified, biological risk estimation is performed based on the severity and probability of harm. Again, this concept of estimating the risk either qualitatively or quantitatively is a nod to the process described in ISO 14971 and then elaborated on in ISO 29471.
- ISO 10993-1:2025 introduces a structured biological evaluation process that mimics ISO 14971’s lifecycle approach, ensuring that biological safety is assessed from design through post-market surveillance. It also reinforces the importance of competent personnel, documentation, and justification at each stage, consistent with ISO 14971’s emphasis on traceability and accountability.
- The inclusion of biological risk estimation and evaluation clauses (6.9 and 7) reflects ISO 14971’s methodology for assessing severity and probability of harm, while Clause 8 on biological risk control mirrors ISO 14971’s structured approach to mitigating unacceptable risks. The biological evaluation report (Clause 9) is required to document conformity with the evaluation plan and provide a rationale for decisions, aligning with ISO 14971’s requirements for risk management documentation. Finally, Clause 10 ensures that biological safety is continuously monitored and updated based on production and post-market data, reinforcing ISO 14971’s principle of ongoing risk management.
Overall, ISO 10993-1:2025 now functions as a biologically focused extension of ISO 14971 with a tighter connection now established between those two standards. The somewhat loose connection that started in 2009 is no longer present as one cannot read ISO 10993-1:2025 and not think of the similar concepts presented in ISO 14971.
As we all become more experienced in using this new standard, there will certainly be challenges. It will take time to develop confidence and consistency in the process of applying concepts like risk estimation that came directly from ISO 14971 in biological evaluation plans and reports. This is especially true with only a few short paragraphs to guide us through this concept that is new to biological safety. What is considered severe and probable biological risk by one assessor may differ from what another assessor may conclude. Although we do not have companion documents like ISO 24971, the development of technical reports for greater clarification on points like risk estimation will certainly be helpful. Release of such technical reports is being discussed, but until then, we will all forge ahead using our current skills and knowledge.
2. Integrating Foreseeable Misuse into Biological Risk Assessment
Continuing with concepts from ISO 14971 that have now made their way into ISO 10993-1:2025, reasonably foreseeable misuse must be factored into the biological evaluation. The primary focus in prior versions of ISO 10993-1 was on the risks associated with the intended use of the device under review. The intended use being defined by the instructions for use (IFU) in most cases. For some regulatory submissions, this concept was taken to the extreme by having the IFU explicitly define the duration of use so that regulatory agreement could be reached in terms of the extent of biocompatibility evaluation that was needed. This approach looked past the potential for the use of the device to extend beyond that defined by the IFU even if it was totally feasible for that to occur. In these situations, the IFU and its description of use essentially became a “risk control” measure. Now, determining foreseeable misuse has to be considered as part of the categorization process and it would seem that the situation as described in relation to the IFU will no longer be sufficient.
ISO 10993-1:2025 now lists an example of foreseeable misuse as “the use for longer than the period intended by the manufacturer, resulting in a longer duration of exposure”. For some, this concept of misuse is not new as it has been part of ISO 14971 and can be found in the Medical Device Regulation (MDR) as part of the General Safety and Performance Requirements and Post-Market Clinical Follow-Up.
For the biocompatibility evaluation, reasonably foreseeable misuse is to be considered “when there is information available to suggest that the device can be used outside of its intended use and this misuse is identified as being systematic.” Post-market surveillance data and clinical literature are provided as examples that would support the device being used outside of the intended use. When this aspect is compared to the definition from ISO 14971 (shown below) there can be some confusion between a situation where there is evidence supporting known misuse versus more of a hypothetical situation which predicts what could occur.
Adopting the definition from ISO 14971 seems to imply that a greater level of misuse needs to be considered as compared to the systematic misuse described in ISO 10993-1. The confusion between the definitions and the actual intent for evaluating misuse in the context of biological safety can benefit from further elaboration within a technical report, similar to that mentioned for risk estimation.
- Reasonably foreseeable misuse defined by ISO 14971: “use of a product or system in a way not intended by the manufacturer, but which can result from readily predictable human behaviour.
- Note 1 to entry: Readily predictable human behaviour includes the behaviour of all types of users, e.g. lay and professional users.
- Note 2 to entry: Reasonably foreseeable misuse can be intentional or unintentional.”
Items like this which can have a significant impact on the extent of a biocompatibility evaluation will likely take biological evaluation plan authors some time to gain confidence in the approach that is taken. A review of a Clinical Evaluation Report (CER) and ISO 14971 assessment, when available, can help define aspects like reasonably foreseeable misuse. For now, it is important to realize that the intended use is not the only exposure scenario in the scope of the standard as reasonably foreseeable misuse also must be considered in your biological evaluation plans.
3. Determining Contact Duration and Exposure Scenarios in Biological Evaluation
In addition to the evaluation of reasonably foreseeable misuse, other aspects of patient exposure must be considered to determine the duration of exposure as part of the categorization process. The length of time for limited (< 24 hours), prolonged (> 24 hours to 30 days) and long-term (>30 days) remain the same, but the process to determine the duration has some additional items to consider. If the device has only one exposure to the patient and no possibility for reuse or an additional exposure from either the same device or a new device based on the IFU and reasonably foreseeable misuse, then the duration can be simply knowing how long the single exposure lasts. If there is the possibility for multiple exposures, then the total exposure period must be determined. At this point it becomes a matter of understanding definitions and how they relate to one another.
- Total exposure period: Number of contact days between the first and last use of a medical device.
- Contact day: Day in which a medical device or component thereof comes into contact with tissues, including circulating blood, irrespective of the length of time of that contact within the day.
- Daily contact: When a medical device contacts the body every day for any portion of a day. For these medical devices, the total exposure period is the number of calendar days from the first to the last use of the medical device or a replacement of the same medical device on a single patient.
- Intermittent contact: Use of the device where there is a period of at least 24 hours between consecutive tissue contacts. The total exposure period is calculated by adding the number of contact days from the first to the last use of the medical device on a single patient. This is regardless of how long a single device is used for on a particular day.
As you become familiar with these definitions and consider them in relation to one another and the intended use and reasonably foreseeable misuse, it becomes very apparent that justifying/defining the exposure scenario as part of the biological evaluation plan will be a key factor. Again, experience with this approach will take some time and hopefully reveal that the duration of limited is not simply a concept of the past, once you consider all the potential, complicating factors.
It is important to also note that the word “transitory” is no longer used in the standard. “Very brief contact” remains though and with it the concept that an exposure of less than a minute is likely to have negligible biological harm.
One additional factor to consider is bioaccumulation. The standard does not provide much guidance but essentially indicates that if it is known that a chemical is present in the device where exposure is possible and that chemical is known to bioaccumulate then the contact duration is long-term unless otherwise justified. Knowledge and risk assessment down to a chemical level become pertinent here to identify the hazard and establish the risk. As the standard indicates, it must be known that bioaccumulation is expected. As with the entire biological evaluation process, knowledge is key to assessing this parameter and there is the potential for your knowledge to change as you evaluate the device in question. If information is gained (e.g. chemical characterization in the form of extractables), the evaluation of this information will include the risk for bioaccumulation. If that risk is identified the device becomes long-term. In theory, a limited or prolonged device may be categorized as long-term after the biological evaluation plan is conducted. Ideally this is rare–but it is a possibility the standard indicates should be considered. This is even more of a reason to select materials and processes wisely as part of the development process. Determining the contact duration of your medical device continues to be a key component of the biological evaluation plan. With ISO 10993-1:2025, it becomes a bit more complicated with several items to consider, especially with reasonably foreseeable misuse and multiple exposures. Gone are the days of adding together the seconds of multiple exposure to get your total exposure period. Any exposure is a day at a minimum and two of those exposures can put you in a prolonged duration. If done incorrectly, this categorization process could easily present an evaluation plan that either over-evaluates a simple exposure or under-evaluates a complex scenario.
4. Breaking Down Table A.1: Understanding the Four New Device Categories
Table(s) presenting device categories and corresponding biological effects/endpoints have been part of the biocompatibility evaluation process going back to the 1970s. These tables(s) have been modified over the years in varying ways and ISO 10993-1:2025 has introduced a new approach as well. What was a single large table in ISO 10993-1:2018 has now been split into four separate tables. These new tables reflect other changes that have been incorporated in the standard as well but the most notable change to some is to device categories. Tables 1, 2, 3, and 4 now take the place of what used to be Table A.1. These tables reflect the four types of general body contact that are used to categorize devices:
- Medical devices in contact with intact skin
- Medical devices in contact with intact mucosal membranes
- Medical Devices in contact with either breached or compromised surfaces (skin or mucosal membranes) or internal tissues other than circulating blood
- Medical devices in contact with circulating blood
For these categories, the concept of direct or indirect contact remains – that is, the device or particulates released from the device either physically contacts tissue including circulating blood or indirectly makes contact (medical device or component having no physical contact with tissue through which a fluid, semi-solid or solid passes prior to contacting tissue). The point of including particulates in this evaluation is mentioned now throughout the standard. Once the exposure scenario is defined, the device is placed into the correct category and the tables then help guide the assessor to which biological effects need to be evaluated. The tables are all supplemented with additional guidance in the form of footnotes. Sections titled Biological Effects for Evaluation, Other Biological Effects, and Other Factors to be Considered provide further guidance and assist in the use of the tables.
As guides, the tables are not meant to be checklists – a theme that extends from prior versions of the standard. Other effects may need to be considered other than those marked with an “E” in a given table or effects that are not part of the tables. Again, these concepts are not new, just presented a bit differently. There are other footnotes specific to a table, but as you read through these, the concepts of what is presented is not novel. The basic concepts and methods should not be too concerning when it comes to the tables.
You will have new categories and words to become familiar with, but the process continues to support the same intent:
- Define exposure
- Assign a category
- Use the correct table as a guide
- Identify biological risks in addition to biological effects
- Use testing where needed to address the remaining risks/effects to support that you have a plan to determine if a device is biocompatible
It will take time to get used to the terminology and update your documents, but in the end, the process is largely similar to past guidances.
5. Evolution of Device Categories: Key Changes in ISO 10993-1:2025
As mentioned above, new categories have been created. Externally communicating as a category is now a thing of the past when it comes to ISO 10993-1. Devices that were in that category in the past are now covered in either medical devices in contact with either breached/compromised surfaces (skin or mucosal membranes) or internal tissues other than circulating blood or medical devices in contact with circulating blood. Looking at the new categories described above, you will notice that the overall category of “implant” is not part of the names. Implants now are covered by the same two categories mentioned when discussing the removal of externally communicating devices. In your biological evaluation plan, you will now need to decide under what circumstances you should address the effects that occur locally in tissue after a device comes into contact with it—what was previously referred to as “implantation effects.” Remember, local effects after tissue contact does not only apply to devices with direct tissue contact. ISO 10993-1:2025 provides guidance indicating that potential exposure to particulates can necessitate addressing local effects after tissue contact, even for devices that only have indirect contact with tissue.
6. Material-Mediated Pyrogenicity: Status and Considerations in ISO 10993-1:2025
If you are looking for material-mediated pyrogenicity in a table in ISO 10993-1:2025, you won’t find it–but that doesn’t mean that it is gone just yet. While experts continue to work on providing information to debunk this as a biological effect for medical devices, it remains in the standard and is discussed in the context of “other biological effects”. Aside from novel materials, documenting that materials and processes used do not present a significant risk of material-mediated pyrogenicity seems to be a common approach that will be used going forward.
7. Integrating Physical and Chemical Data into Biological Risk Assessment
Physical/chemical information is not in a table. It is still part of the biological evaluation process, but used as a means to identify biological hazards, biological hazardous situations, and biological harms. Annex A supports the concept at a material level.
In ISO 10993-1:2018 the addition of physical and/or chemical information to Table A.1 caused quite a bit of excitement. Some viewed it as a testing requirement, others as a paper-based literature review, and others as a combination of both. Any number of other interpretations could also be found as well. Tables 1-4 do not have that column but that does not mean that you get to ignore this concept.
The definition of chemical characterization remains as the process of obtaining chemical information, accomplished either by information gathering or by information generation, for example, by literature review or chemical testing. So as the definition indicates, testing may or may not be necessary, depending on the situation and what is known. Using physical and chemical information as part of the biological risk analysis process remains a key aspect to assist one in identifying biological hazards and biologically hazardous situations. Having chemical characterization data in the form of analytical test results can help with biological risk estimation.
This concept brings in other standards like ISO 10993-17 and ISO 21726. The need to perform analytical testing as part of this process will be dependent on the information that is available. If biological risk estimation can be accomplished then there may not be a need for chemistry test data. The need for analytical test data is expanded on in Annex A of ISO 10993-1:2025. While there still may be some “gray” areas in terms of when testing is actually needed, the goal of taking some emphasis off of physical/chemical information as a testing only scenario was accomplished by the simple removal of it from Tables 1-4. Do not let that removal lead you astray where you delete it from your biological evaluation plans. Chemical characterization does remain as an important tool to use in identifying biological hazards, biologically hazardous situations, and biological risks associated with a final finished device, its materials, and manufacturing processes.
8. Establishing Biological Equivalence: A New Standard
A more detailed framework for supporting biological equivalence has now found its proper home: ISO 10993-1:2025. While the concept itself is not new, it was briefly touched on in Figure 1 of the 2018 version of Part 1 and included in ISO 10993-18:2020. The revised standard gives it a clearer definition and more structured approach.
Previously, if a manufacturer could show that a marketed device used the same material, manufacturing process, physical properties, body contact, and clinical use, they could complete a toxicological risk assessment and consider the biological evaluation done. The focus was mostly on input data – figuring out whether the devices were the same.
Now, the updated standard shifts that focus to outputs, specifically, the biological risks to a patient. Biological equivalence is defined as showing that a device or material is sufficiently similar to a comparator (with relevant existing data including chemical, physical, material, and contact) such that no new or increased biological risks are introduced.
As part of the biological evaluation plan, manufacturers are expected to conduct a gap analysis to determine whether sufficient information exists to support biological equivalence. The roadmap for this process is largely drawn from Annex C of ISO 10993-18:2020. While the helpful examples from Annex C did not make their way into 10993-1:2025, an emphasis is still placed on scientific justification and risk estimation, which is a welcomed change compared to the current version of Part 1.
If a manufacturer can demonstrate that there are no new or increased biological risks, additional testing should not be necessary. In fact, the new version of Part 1 explicitly states that in vivo testing shall not be carried out where biological equivalence has been established.
It is still unclear how regulatory bodies will respond to these justifications, but the updated standard definitely opens the door for manufacturers to make a stronger case for biological equivalence as compared to the current version of ISO 10993-1.
9. Redefining Systemic Toxicity in Medical Devices
Systemic toxicity is now one effect, and the contact duration of the device defines what level of systemic evaluation is needed.
Gone are the separate listings of acute, subacute, subchronic, and chronic systemic toxicity endpoints. Systemic toxicity is now presented as a single biological effect in each device categorization table. With that said, we still need to consider the traditional systemic toxicity durations: acute, subacute, subchronic, and chronic, when planning studies.
The key factor now is how long the device is in contact with the body, which should guide the length of any systemic toxicity study. This is clearly noted in the footnotes under each biological effects table. ISO 10993-11 (Tests for systemic toxicity) is a valuable resource for determining appropriate study durations.
Devices are still categorized by contact duration (short-term, prolonged, long-term), but it is important to determine the actual number of contact days when deciding how long a systemic toxicity study should be, especially if in vivo testing is required. Just because two devices fall into the same contact category does not mean their study durations should be identical.
For example:
- A device with 2 days of contact and a device with 28 days of contact are both categorized as prolonged contacting devices, but the subacute systemic toxicity study duration might look very different.
- Likewise, a device with 60 days of contact should not be evaluated with the same chronic systemic toxicity study duration as a device that has 10 years of contact.
Of course, chemical characterization and the principles of ISO 10993-17 can still be used to rationalize performing systemic toxicity endpoints when necessary.
10. Genotoxicity Assessment for Prolonged Exposure Devices
Genotoxicity is now a required endpoint of consideration for devices with prolonged or long-term contact duration with all tissues, except for intact skin. This means devices that are categorized as prolonged contact with mucosal membrane or breached or compromised surfaces have an additional biological effect to consider. This broadened scope for genotoxicity now connects genotoxicity with systemic toxicity in a more consistent manner, i.e. any medical device requiring a systemic toxicity evaluation due to prolonged contact, now also requires a genotoxicity assessment. Many manufacturers might see this as an unwelcome change for devices that have either switched contact duration (e.g. went from limited to prolonged contact) or have historically not needed to evaluate this endpoint. The requirement for genotoxicity assessment for a wider range of devices will likely have a greater impact on legacy devices, as manufacturers may face challenges and increased costs of re-evaluating their products to meet the increased regulatory expectations.
Although the standard indicates that the updates contained within it do not mandate retesting of medical devices that are already marketed and have established and acceptable safety profiles, this might very well end up being the case for many legacy devices. As a common theme of the revision of Part 1, a risk-based approach should be used to mitigate the potential risks associated with genotoxicity. Before retesting your device, a gap assessment should be performed to estimate the genotoxicity risk by evaluating material information, reviewing previous data generated (including chemical characterization testing, if performed), and clinical use data and presenting a weight of evidence approach on how the risk is mitigated. One challenge is that genotoxicity data may not exist (either via genotoxicity assays or chemical characterization testing), resulting in an increased chance of retesting of legacy devices. If a genotoxic constituent is identified in the information gathering step, a genotoxic carcinogenicity evaluation is necessary. It is also noteworthy that carcinogenicity is now an endpoint of consideration for all devices in long-term contact with the body, except for intact skin.
For those legacy devices where a genotoxic risk is identified, the additional assessment appears appropriate. However, for the many devices where genotoxic risk is not identified through a gap analysis, but data is not sufficiently robust to fully assess an endpoint previously deemed unnecessary, retesting may feel like a check box exercise to meet regulatory expectations – the very activity recent iterations of the standard have been trying to avoid.
