Biological and clinical evaluation · Standards explainer

ISO 10993-1:2025: how endpoint selection changes under the sixth edition

The sixth edition reframes biological evaluation as a risk-management activity rather than a test programme. That changes how endpoints are selected, how exposure is counted and what a plan has to say before any sample reaches a laboratory. This article works through the changes with the logic a reviewer will apply.

By Tanish Kamdar · Published · Reviewed · 6 min read

In short

ISO 10993-1:2025, published on 18 November 2025, requires the biological evaluation to be conducted inside the ISO 14971 risk management process, to consider reasonably foreseeable misuse as well as intended use, to categorise devices and count cumulative exposure under revised rules, and to select endpoints from four tables rather than the former single matrix, with each endpoint addressed by existing data, a justified test or a documented rationale. Existing evaluations under the 2018 edition remain usable but must be reviewed and shown to be valid under the new categorisation and exposure requirements.

Who this applies to. Manufacturers of any medical device with direct or indirect body contact, and the regulatory, quality and R&D staff who own its biological evaluation. It is written for the EU and US primarily; the principles apply wherever ISO 10993-1 is the reference, including India.

What the sixth edition is for

The title changed, and the change is the point. The 2018 edition was "Evaluation and testing within a risk management process"; the 2025 edition is "Requirements and general principles for the evaluation of biological safety within a risk management process". Testing has moved out of the title because the standard no longer wants to be read as a test menu. It wants a biological evaluation that is part of the device's risk management under ISO 14971:2019, planned before testing, reasoned endpoint by endpoint, and kept alive through the device's life.

For manufacturers that already evaluated this way, the edition formalises good practice. For those whose evaluation is a stack of passed test reports, it is a change in kind.

Six changes that affect endpoint selection

1. The evaluation sits inside ISO 14971

The standard now aligns its terminology and structure with ISO 14971:2019 and treats biological hazards, hazardous situations and harms as part of the device's risk analysis. Practically, the biological evaluation plan has to show where biological risks appear in the risk management file, how the acceptability criteria from the risk management plan apply to them, and how biological risk estimation combines the identified hazards with patient exposure. An evaluation that does not reference the risk management file by document and section will read as detached.

2. Reasonably foreseeable misuse is in scope

Taken from ISO 14971, the concept requires the evaluation to consider not only the intended use but the readily predictable ways a device is used wrongly: a single-use device reused, a short-contact device left in place, a component contacting tissue it was not designed to contact. Where misuse is reasonably foreseeable, it can change the contact category or the duration, and therefore the endpoints. The plan has to say what misuse was considered and whether it changed anything.

3. Categorisation is revised

The 2018 edition grouped devices as surface, externally communicating or implant, with a contact-site sub-category. The 2025 edition revises how devices are categorised, and many devices will land differently. The familiar mistake — classifying by what the device looks like rather than by what it touches and for how long, under intended use and foreseeable misuse — now has more ways to go wrong. The plan should document the categorisation reasoning explicitly rather than tick a box.

4. Exposure is counted in calendar days, cumulatively

Duration is defined more precisely, with the total exposure period accumulated over multiple uses of the same device or repeated use of devices of the same type. A device used for ten minutes a day over a month is not a limited-contact device. The categorisation drives the endpoint set, so getting the cumulative duration right is where many evaluations will need rework.

5. One matrix becomes four tables

The single evaluation matrix of the 2018 edition's Table A.1 is split into four tables in the 2025 edition, with a new annex explaining the rationale behind changes to the biological effects considered. The endpoint set for a given category may differ from what the old matrix implied, and the tables carry new footnotes that change what "addressed" means for particular endpoints. An evaluation should cite the specific table and row, not "Annex A".

6. Risk-based limitation of in-vivo testing

The edition strengthens the expectation that animal testing is limited to cases where it is strictly necessary and that existing data — chemical characterisation under ISO 10993-18 with toxicological risk assessment under ISO 10993-17, prior testing on equivalent materials, published literature, clinical experience — is used first. This is not permission to skip endpoints; it is a requirement to address each one by the least burdensome valid route and to write the justification down.

How endpoint selection now works in practice

A plan written to the 2025 edition proceeds in an order, and the order matters.

  1. Describe the device, its materials of construction, processing aids, colourants, sterilisation and packaging, with supplier declarations where they exist.
  2. State the intended use and the reasonably foreseeable misuse considered, with the reasoning.
  3. Categorise the device by nature of contact and cumulative duration under the 2025 rules, and record the reasoning.
  4. From the four tables, list the endpoints the category requires, citing table and row.
  5. Identify the biological hazards in the risk management file and confirm the two documents agree.
  6. For each endpoint, determine whether it is addressed by existing data — chemical characterisation plus toxicological risk assessment, prior data on identical or equivalent materials, literature, clinical experience — and write the rationale with the data cited.
  7. For each endpoint not so addressed, decide whether a test is justified, which test, under what conditions and at which laboratory, and record why.
  8. Issue the plan under document control; brief the laboratory from it; review each report against it when it returns.

The outcome, for most devices, is a short test list in which every entry has a reason. That is what a reviewer is now looking for, and it is also cheaper.

The toxicological route

Chemical characterisation under ISO 10993-18:2020+A1:2022 and toxicological risk assessment under ISO 10993-17:2023 address several endpoints — systemic toxicity, genotoxicity, carcinogenicity and reproductive toxicity among them — without animal testing, provided the characterisation is designed well and the assessment is done properly. The 2025 edition leans on this route more heavily than its predecessor. The companion article on toxicological risk assessment under ISO 10993-17:2023 works through the assessment itself.

What to do with an evaluation written under the 2018 edition

Devices already on the market do not automatically need new testing. They do need a documented review showing that the existing evaluation remains valid under the 2025 edition: that the categorisation is unchanged or, if changed, that the endpoints are still addressed; that cumulative exposure was counted correctly; that reasonably foreseeable misuse was considered; and that the evaluation is tied into the risk management file. For many devices the review ends in a short addendum. For some — multi-use devices whose cumulative exposure was undercounted, devices whose misuse changes the contact category — it ends in a revised plan and, occasionally, a test. The review is a defined piece of work and should be scheduled rather than left for the next notified-body audit to prompt.

Harmonisation and recognition

Three facts are often collapsed into one, and should not be. ISO published the sixth edition on 18 November 2025. CEN adopted it as EN ISO 10993-1:2025 and national bodies published it from January 2026; its listing as a harmonised standard under the MDR in the Official Journal is a separate step that confers the presumption of conformity. FDA's recognition of the edition in its recognised consensus standards database is a third step, independent of both. At the review date of this article, manufacturers should check the Official Journal listing and the FDA database before citing the edition as harmonised or recognised, and should cite it as the current state of the art in either case.

Three errors to avoid

  • Treating the four tables as a test list. They are the list of endpoints to address; the method of addressing each is the evaluation's job.
  • Writing the plan after the testing. A plan that justifies tests already run is not a plan, and reviewers recognise one.
  • Keeping the biological evaluation and the risk management file in different hands. The 2025 edition assumes they are one process; if the documents disagree on intended use, hazards or acceptability, the evaluation fails on structure before anyone reads the data.

References

  1. ISO 10993-1:2025, Biological evaluation of medical devices — Part 1, Requirements and general principles for the evaluation of biological safety within a risk management process, International Organization for Standardization, 18 November 2025. https://www.iso.org/obp/ui/#iso:std:iso:10993:-1:ed-6:v1:en Sixth edition, ISO Online Browsing Platform entry.
  2. New revision of important biocompatibility standard published — I.S. EN ISO 10993-1:2025, National Standards Authority of Ireland, 22 January 2026. https://www.nsai.ie/about/news/iso-10993-1-2025-revision-published/
  3. ISO 14971:2019, Medical devices — Application of risk management to medical devices, International Organization for Standardization, 2019. https://www.iso.org/standard/72704.html
  4. ISO 10993-17:2023, Biological evaluation of medical devices — Part 17, Toxicological risk assessment of medical device constituents, International Organization for Standardization, 2023. https://www.iso.org/standard/75323.html
  5. Use of International Standard ISO 10993-1, Biological evaluation of medical devices — Part 1, U.S. Food and Drug Administration, Current guidance; check the recognised consensus standards database for the recognition status of the 2025 edition. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/use-international-standard-iso-10993-1-biological-evaluation-medical-devices-part-1-evaluation-and

Changelog

  • — First publication.

How this connects