A material can be safe in one device and harmful in another. What matters is the finished device, in the place where it is used, for the time it is used. ISO 10993-1 is the standard that frames this. Its scope, as ISO describes it, is requirements and general principles for the biological evaluation of a medical device inside a risk management process under ISO 14971. It covers devices that touch the patient's body, directly or indirectly, and devices that protect other users, such as gloves.
An evaluation, not a test list
The US FDA guidance on ISO 10993-1 describes the order of work. Start by assessing the device: its materials, how it is made, its clinical use, the place on or in the body, and how often and for how long it is exposed. Next, identify the biological risks. Then list what information you already have, and find the gaps. Last, plan to close each gap with testing or with another kind of evaluation. The result is read in a benefit-risk context.
One point surprises many teams. The FDA guidance says the risk assessment should look at the final finished device, because the agency decides on the device as supplied, not on its separate materials. So the assessment covers the processing, the manufacturing methods including sterilisation, and any residue from manufacturing aids, as well as the material itself. The 2025 edition of ISO 10993-1 (edition 6, replacing the 2018 edition) also looks across the life of the device, from design to decommissioning.
Contact type and contact duration
The FDA guidance builds on the ISO 10993-1:2018 clauses that group devices by the nature of body contact and by the duration of contact. Its matrix gives three duration bands.
| Band | Contact duration |
|---|---|
| A, limited | Under 24 hours |
| B, prolonged | Over 24 hours, up to 30 days |
| C, long term | More than 30 days |
The nature of contact comes first. The matrix lists, for example, surface devices (intact skin or mucosal membrane), and the guidance also discusses devices that contact breached or compromised surfaces, externally communicating devices and implants. A device with more than one kind of exposure must address each kind. The FDA gives a pacemaker as an example: the generator and the leads sit in different tissue, so the device counts as both a tissue contact and a blood contact device.
These two inputs set the list of endpoints to consider. The FDA guidance names the general set: cytotoxicity, acute, subchronic and chronic toxicity, irritation, sensitisation, haemocompatibility, implantation, genotoxicity, carcinogenicity, and effects on reproduction. It also says the matrix is a framework, not a checklist, and not every endpoint will need a test.
Existing information and chemistry first
The FDA guidance asks sponsors to consider all relevant information before testing, partly to avoid unnecessary animal testing. Useful sources include:
- your own experience with the same material in a similar place on the body;
- information from the material supplier, such as a master file;
- chemical or surface analysis of the final device;
- the published literature;
- in some cases, post-market experience.
Chemical analysis plays a large part. The guidance says it can show that earlier test data still apply, and it can help assess the toxic risk of chemicals that come out of the device. It also warns that chemistry alone usually cannot find every risk, because it does not see surface finish or geometry, which can change the biological response. Results also depend on the test set-up, so the choice of extraction solvent needs care.
A conclusion of "no new testing" needs evidence. The FDA guidance expects the contact type and duration, form, formulation, processing, interactions and storage to be the same as for a comparison device, or the comparison device to be shown as worse. Any difference must be explained.
Test what you will ship, and look again when it changes
When testing is needed, the test article should match the final finished device. The guidance says that when the real device cannot be used, a representative article should go through the same manufacturing and sterilisation processes. It also advises testing extracts separately when components have different contact durations, so a short-contact part does not dilute a long-contact one.
The plan is not finished at the first submission. Keep the evaluation as a living record, and update it when the design, the supplier or the process changes. The record should show, for each endpoint, what evidence was used and why it was enough. A reviewer, or an auditor, can then follow the reasoning without asking the team to rebuild it from memory.
The FDA gives two examples. A change in a surface treatment can leave more pyrogenic material on an implant. A change of resin supplier can leave processing solvents in the part, and these can cause toxic effects not seen before. Treat a change of material, process or supplier as a reason to look at the biological evaluation again.
Common mistakes
- Buying a standard test panel. The endpoints follow from contact type, duration and the gaps in your information.
- Evaluating the material, not the device. Processing, sterilisation and residues belong in the assessment.
- Testing a sample that is not the product. A different process or sterilisation gives a different answer.
- Starting late. The FDA advises talking to the review division before starting long-term testing of a new device.
- Forgetting changes. A new supplier or process step can reopen the plan.
Biological evaluation also feeds the wider risk management file, and the sterilisation method is part of the finished device the evaluation covers.
Sources: ISO 10993-1:2025 (edition 6, approved 18 November 2025, replacing ISO 10993-1:2018): title, scope and edition details as listed by the Swedish Institute for Standards (sis.se); US FDA guidance, Use of International Standard ISO 10993-1, Biological evaluation of medical devices (September 2023), sections on scope, risk management, final finished form, endpoint assessment, test article preparation and Attachment A. The FDA guidance cites the 2018 edition of the standard. The standard itself is sold by ISO and is not reproduced here. This article is a general guide, not a regulatory determination for any device.