ISO 10993 Biocompatibility: Risk-Based Evaluation vs. the Checkbox Report

Why the old biocompatibility report no longer works

For years, many manufacturers treated biocompatibility as a box-ticking exercise: run the standard battery of ISO 10993 tests, compile the results, and submit a report. That approach still shows up in technical files, and it still gets flagged. The shift required under MDR — and formalised in the MDCG 2020-18 guidance series — is toward risk-based biological evaluation, which is a fundamentally different exercise.

The checkbox approach asks: "Have we tested for cytotoxicity, sensitisation, irritation, and the rest of the series?" The risk-based approach asks: "Given what this device is made of, how it contacts the body, and for how long, what biological risks are actually relevant — and what is the most appropriate way to characterise and evaluate each one?" Testing is one tool in that evaluation. It is not the only one, and for many established materials it is not the primary one.

What MDCG 2020-18 actually requires

The MDCG 2020-18 series (covering biological evaluation, chemical characterisation, and toxicological risk assessment) sets out a framework that notified body reviewers now apply. The core logic is this: before deciding whether testing is needed, you have to characterise the materials in contact with the body and assess whether existing data is sufficient.

Chemical characterisation under ISO 10993-18 is often where teams run into trouble first. The standard requires you to identify and quantify substances that could be released from the device and assess whether those quantities present a toxicological risk. This is not a test you run once on a finished device — it requires analytical work on the materials and a toxicological risk assessment that interprets the results against recognised thresholds (AET, TTC, tolerable intake limits). If you are using materials with established biocompatibility history and no change in formulation or processing, you may be able to rely on existing data rather than new testing. But that reliance needs to be documented and justified.

One pattern that keeps appearing in reviewer feedback: biological evaluation reports that cite ISO 10993-1 and list tests completed, but do not contain a toxicological risk assessment. The TRA is not optional — it is a required output of the biological evaluation process under the current framework, and its absence is a gap reviewers are trained to look for.

The materials change problem

A question that comes up more than you would expect: does a change in supplier, processing, or finishing require a new biological evaluation? The answer depends on what changed and how materially it affects the chemistry of the patient-contacting surfaces. Most manufacturers have a change control procedure, but not all of them have explicitly linked that procedure to the biological evaluation update trigger. The result is a device that has undergone undocumented material changes that were never assessed for biological impact.

The biological evaluation should be a living document, reviewed and updated when materials, manufacturing processes, or intended use change. A biological evaluation that was last updated at initial certification and has not been revisited since — despite multiple design changes — is a red flag.

Existing data vs. new testing

This is where the risk-based approach pays off most clearly. If your device uses well-characterised, widely used polymers with an established safety record in equivalent applications, a well-documented literature review and equivalence justification can replace much or all of new animal or in vitro testing. Notified Body reviewers are not looking for more tests — they are looking for rigorous justification of whatever approach you chose.

The justification needs to show: what data exists for the material, how similar the conditions of use are to the conditions under which that data was generated, and what gaps (if any) remain after reviewing existing data. If gaps remain, you address them with targeted testing — not the full battery.

What a biological evaluation file should contain

A biological evaluation under the current framework is typically a set of interconnected documents: a biological evaluation plan, a chemical characterisation report (including extractables/leachables analysis where relevant), a toxicological risk assessment for each identified substance of concern, and a biological evaluation report that synthesises all of this into a risk-based conclusion. The report should address each contact type (surface, implant, blood path indirect) and each biological effect from ISO 10993-1's risk framework, with explicit justification for why each is or is not relevant given the specific device.

Missing any of these elements is common, and each missing element is a separate finding. The biological evaluation plan in particular is often absent — teams produce a report but never documented the plan that preceded it.