ISO 10993-1:2025: Risk Management Integration and Exposure Duration
ISO 10993-1:2025 embeds the biological evaluation within ISO 14971’s risk-management framework. The standard explicitly requires identifying biological hazards, estimating their severity and probability, and comparing residual risk to acceptability criteria. As in risk management, hazard identification is the first step. If a known hazardous constituent is present (at any level), a hazardous situation exists and the risk must be estimated against predefined criteria. Conversely, if no biological hazard can be identified in the device materials or chemicals, then biological risk is essentially zero and no further testing is needed. In practice, every BEP (Biological Evaluation Plan) should trace each identified hazard through risk analysis, risk estimation, and risk controls. For example, a BEP might list a device’s constituent chemicals, known toxicology and clinical history, then assess extractables and leachables against ISO 10993‑17 thresholds to estimate risk. Controls could include changing a material, adding protective barriers, or restricting use to ensure any residual risk meets safety criteria.
The revised ISO 10993 Part 1 allows greater reliance on prior knowledge and comprehensive risk assessment in lieu of blanket testing. For instance, if solvent residues from manufacturing are confirmed by appropriate tests to be effectively neutralized or washed away, a documented risk rationale may waive additional toxicology tests. Please note – you can lean more on a documented, knowledge-based comprehensive risk assessment when the supporting data are sufficient and relevant. In practice this means including material safety data, predicate device comparisons, prior test data, and manufacturing history in the BEP. However, the standard cautions that any material or process change reopens the assessment, and we cannot forget about trace substances whose existence is unknown based on literature screening.
Example: A polymer piece previously shown to release negligible monomers might not require new testing if the same supplier and process are used; but if the mold-release agent is changed, the BEP must re-address residue risk.
ISO 10993-1:2025 also formalizes the role of BEPs and BERs (Biological Evaluation Reports) as part of the risk documentation. The BEP is essentially a risk plan under ISO 14971, and the BER documents how risks were addressed. In particular, Clause 9 requires that biological evaluations be “planned, conducted, and reported by competent personnel” and that the evaluation report documents the rationale for all risk decisions. It is advised to include CVs for key authors and performing peer review, since “qualified authorship” is now emphasized. In other words, traceability is expected from the hazard identification through risk analysis and controls, all documented by experts. For example, the BER should explicitly link each device hazard to the tests or analyses performed and to any design or information controls applied, mirroring ISO 14971’s requirement to document risk estimates and controls.
ISO 10993-1:2025 introduces more precise definitions for exposure duration, which directly affect device categorization and risk estimation. The familiar contact-duration categories remain – Limited (single contact day, <24 h), Prolonged (>24 h up to 30 days), and Long-term (>30 days) – but the method of calculating exposure has changed. Key new concepts include:
- Contact day: Any calendar day on which the device (or component) contacts the patient’s tissues or fluids, regardless of exposure time that day. Even a minute of contact counts as one day.
- Total exposure period: The number of contact days from the first use to the last use of the device in a patient. For devices used more than once, you add up contact days, not minutes.
- Daily contact: The device touches the body every day for any duration. The total exposure period is the total calendar days used.
- Intermittent contact: The device is used on some days but not consecutive days (at least 24 h between uses). The total exposure period is still the span from first to last contact, counted in contact days.
These definitions mean that even short exposures accumulate in the count of contact days. For example, a sensor worn 1 hour per day for 10 non-consecutive days has 10 contact days (prolonged use). The rule is – if a device is used every three days, we include the time in between use. If foreseeable misuse could reasonably extend exposure across multiple days, categorize accordingly. In practice, any exposure on a day makes that day count. Example: In past practice, a device worn 5 minutes per day for 30 days (total 150 minutes) might have been considered limited (<24 h). Under the new rules, that scenario spans 30 contact days – classifying the device as long-term (>30 days) use. Long-term classification triggers more extensive evaluation (e.g. chronic systemic toxicity studies).
Bioaccumulation is a related concept that effectively extends exposure. If a known toxicant from the device is expected to bioaccumulate in tissue, the contact duration is treated as long-term by default. For instance, a slowly absorbed drug-eluting implant could keep releasing a compound for weeks after removal – this persistent exposure must be treated as long-term unless convincingly justified otherwise. In summary, ISO 10993-1:2025 requires careful exposure assessment: authors must explicitly justify how “contact days” are counted and how foreseeable reuse/misuse scenarios might change exposure. Because up-classification is now common, evaluators should document worst-case cumulative exposure as part of the BEP.
Qualified expertise (Clause 9) is expected throughout this process. Biological evaluation must be done by a multidisciplinary team (e.g. toxicology, chemistry, clinical, regulatory) whose members are credentialed and experienced. In practice, this means that key personnel should have documented training in risk assessment and ISO 10993 biocompatibility. The BEP and BER should list contributors and their qualifications, as required by Clause 9. Overall, ISO 10993-1:2025 tightens the linkage between biological evaluation and formal risk management: hazards are identified, risks estimated, controls justified, and all steps documented by qualified experts.
References: All the updates align with ISO 14971 principles. Practical guidance can be found in recent Q&A and guidance documents.
About the Author: Dr. Damian Matak
Dr. Damian Matak – an expert in medical device biocompatibility testing, serving as the CEO of ISO 17025-accredited and GLP-certified laboratories, including EBI – European Biomedical Institute and NABI – North American Biomedical Institute. As a member of the Polish Society of Toxicology and the I Local Ethical Committee, Dr. Matak contributes significantly to advancing safety standards in the biomedical field.