Biological and clinical evaluation · Technical method

Toxicological risk assessment under ISO 10993-17:2023: a worked structure

A toxicological risk assessment is where biological evaluations most often succeed quietly or fail loudly. This article sets out the structure of a TRA under the 2023 edition, step by step, with what a reviewer checks at each one and the shortcuts that produce deficiency letters.

By Tanish Kamdar · Published · Reviewed · 6 min read

In short

A TRA under ISO 10993-17:2023 takes each constituent identified by chemical characterisation, establishes a tolerable intake from toxicological data with stated uncertainty factors (or a threshold of toxicological concern where data are absent), estimates the patient's exposure from the extraction or leaching data and the clinical use, and compares the two as a margin of safety, concluding compound by compound whether the risk is acceptable and with what confidence. Its quality depends on the characterisation study it rests on and on the transparency of every assumption.

Who this applies to. Regulatory, quality and R&D staff who commission or review toxicological risk assessments, and toxicologists new to the device context. It assumes a chemical characterisation study exists or is planned.

Where the TRA sits

Under ISO 10993-1:2025, several biological endpoints — systemic toxicity, genotoxicity, carcinogenicity, reproductive and developmental toxicity among them — can be addressed through chemical characterisation of the device under ISO 10993-18 followed by a toxicological risk assessment of what the characterisation found under ISO 10993-17. The TRA is therefore not an optional extra; for most devices it is the main route by which the toxicological endpoints are closed without animal testing. It is also the document reviewers most often return with questions, because it combines analytical chemistry, toxicology and clinical exposure in a way that exposes any weakness in each.

The inputs, and why they decide the outcome

A TRA cannot be better than its characterisation. Three things about the chemical characterisation study determine whether the assessment can be done at all.

The extraction conditions. The study has to represent, or exaggerate, clinical use: the right solvents for the tissue contact, the right ratio of surface or mass to solvent, the right temperature and time, exhaustive or simulated-use as the device demands. A study that under-extracts produces a reassuring compound list and an assessment that proves nothing.

The analytical evaluation threshold. Under ISO 10993-18:2020+A1:2022 the laboratory reports compounds above a threshold derived from the dose-based threshold of toxicological concern, the clinical exposure and the analytical uncertainty. The AET has to be derived for the device and documented; a laboratory default is not a derivation.

Identification. A compound reported as "unknown, m/z 212" cannot be assessed; it can only be treated conservatively. The characterisation report should show the identification confidence for each compound, and the TRA should say what was done with the unidentified ones.

The practical consequence is that the TRA should be planned before the characterisation is commissioned, so that the laboratory brief produces the data the assessment needs. The biological evaluation plan and TRA scope offer exists for exactly that reason.

The structure, step by step

1. Scope and device context

State the device, its categorisation under ISO 10993-1:2025, the nature and cumulative duration of contact, the patient population including any sensitive sub-populations, the clinical exposure scenario — how many devices, how often, for how long — and the characterisation studies the assessment rests on, by report identifier. A reviewer reads this section to decide whether the rest can be trusted.

2. Compound list and triage

List every constituent the characterisation identified above the AET, with its identity, identification confidence, quantity per device and the extraction condition it came from. Triage the list: compounds below the relevant threshold of toxicological concern can be dispositioned at this stage with the reasoning stated; the rest proceed to full assessment. Do not drop compounds silently.

3. Hazard identification and tolerable intake

For each compound, identify the toxicological hazards from the literature and the authoritative databases, and derive a tolerable intake. The derivation starts from a point of departure — a no-observed-adverse-effect level, a benchmark dose or an equivalent — from a study of adequate quality, and applies uncertainty factors for interspecies and intraspecies variation, study duration, route and data quality, each stated and justified. Where a regulatory limit value exists from an authoritative body and fits the exposure scenario, it may be used with its basis cited. Where no adequate data exist, the threshold of toxicological concern applies, with the compound's structural class assigned and the reasoning shown.

The most common failure here is borrowing a value from an unrelated context — an occupational limit, a food additive limit — without adjusting for route, duration and population, or without saying so. The second most common is applying uncertainty factors by habit rather than by the characteristics of the study.

4. Exposure estimation

Estimate the dose the patient receives: the quantity extracted per device, the number of devices and the exposure period from the clinical scenario, and the patient's body weight, with the assumptions stated and conservative where uncertainty is real. For prolonged and long-term contact, exposure is estimated for the relevant durations under the standard's approach, and the TRA says which durations were assessed and why. A single worst-case number with no scenario behind it is not an estimate.

5. Risk characterisation

Compare the exposure with the tolerable intake as a margin of safety, compound by compound and for each relevant duration. State the result and what it means: acceptable, acceptable with conditions, or not acceptable on the data available. Where the margin is thin, say so and say what would change it — a refined exposure estimate, a better study, a design change. Where several compounds share a mode of action, consider combined exposure.

6. Uncertainty and limitations

State what the assessment could not do and why: unidentified compounds treated conservatively, data gaps filled by threshold of toxicological concern, extraction conditions that may not fully represent a particular use. This section is not a weakness; a TRA without it reads as overconfident, and reviewers know what overconfidence usually hides.

Conclude for the device as a whole against the acceptability criteria in the risk management plan, and record the conclusion in the risk management file against the biological hazards it addresses. The TRA is an input to the biological evaluation report and to the risk file; it is not a free-standing certificate.

What a reviewer checks first

Reviewers at notified bodies and at FDA tend to open a TRA at the same four places. The compound list, to see whether anything above the AET is missing or dispositioned without reasoning. The tolerable intake table, to see whether the points of departure are cited to retrievable studies and whether the uncertainty factors are justified. The exposure scenario, to see whether it matches the IFU and the device categorisation. And the conclusion, to see whether it is written against stated criteria or against the author's comfort. A TRA that survives those four readings usually survives the rest.

Six errors that produce deficiency letters

  • Assessing a characterisation study that was never designed for assessment: wrong solvents, no AET derivation, unidentified peaks.
  • Using "not detected" as "absent" without stating the detection limit and the AET.
  • Deriving a tolerable intake from a value found by searching rather than from a study evaluated for quality and relevance.
  • Estimating exposure for one duration when the device's cumulative contact spans two or three.
  • Omitting the uncertainty section, or writing it as boilerplate.
  • Issuing the TRA without document control, so that when a tolerable intake is revised nobody can find which devices it affects.

Keeping the TRA alive

Toxicological knowledge changes; tolerable intakes are revised; materials and suppliers change. A TRA issued under document control, with every source listed and every compound indexed, can be updated in hours when one of these happens. A TRA issued as a PDF with no index is rewritten from scratch, usually under notified-body time pressure. The difference is decided on the day the first version is issued.

References

  1. ISO 10993-17:2023, Biological evaluation of medical devices — Part 17, Toxicological risk assessment of medical device constituents, International Organization for Standardization, 2023. https://www.iso.org/standard/75323.html
  2. ISO 10993-18:2020, Biological evaluation of medical devices — Part 18, Chemical characterization of medical device materials within a risk management process, with Amendment 1:2022, International Organization for Standardization, 2020, amended 2022. https://www.iso.org/standard/64750.html
  3. ISO 10993-1:2025, Biological evaluation of medical devices — Part 1, International Organization for Standardization, 18 November 2025. https://www.iso.org/obp/ui/#iso:std:iso:10993:-1:ed-6:v1:en
  4. ISO 14971:2019, Medical devices — Application of risk management to medical devices, International Organization for Standardization, 2019. https://www.iso.org/standard/72704.html

Changelog

  • — First publication.

How this connects