Biocompatibility Testing for Medical Devices: Complete ISO 10993 Guide
- Beng Ee Lim
- 2 days ago
- 13 min read
Biocompatibility testing evaluates whether a patient-contacting medical device could cause adverse biological responses. ISO 10993-1 provides a risk-management framework: categorize the device by nature of body contact (surface, external communicating, implant) and contact duration (limited ≤24 hours, prolonged >24 hours to 30 days, long-term >30 days), then justify the relevant biological endpoints based on the FDA/ISO tables and your risk assessment. Cytotoxicity, sensitization, and irritation are commonly evaluated for many patient-contacting devices, but there is no universal “one-size-fits-all” test list. Required endpoints vary by contact type and duration, especially for blood-contacting or implanted devices. FDA recognizes the ISO 10993 series and, in practice, often expects a strong chemical characterization and toxicological risk assessment (aligned with ISO 10993-18 concepts) to justify testing, reductions, or omissions. Additional expectations can be device-specific, depending on contact and risk.
This guide covers the ISO 10993-1 decision process, the FDA biocompatibility endpoint tables by contact type and duration, how to scope chemical characterization, and how to build a defensible testing plan.
What Is Biocompatibility Testing?
Biocompatibility testing evaluates whether patient-contacting medical device materials could cause harmful biological responses under the device’s intended conditions of use. In practice, biocompatibility is assessed through a combination of biological endpoint testing, chemical characterization, and a risk-management rationale aligned with ISO 10993-1 and FDA expectations.
Common biological endpoints considered include cytotoxicity, sensitization, irritation or intracutaneous reactivity, systemic toxicity, genotoxicity, carcinogenicity, hemocompatibility (for blood contact), and pyrogen-related risks for certain device categories. Which endpoints apply depends on the device’s contact type and duration, not a one-size-fits-all checklist.
Regulatory Basis
FDA (United States):
FDA’s biocompatibility expectations are laid out in its guidance on using ISO 10993-1 within a risk-management process, supported by FDA’s biocompatibility resource pages and endpoint tables. While design controls require design validation and risk analysis where appropriate, FDA typically expects a biocompatibility assessment for devices with patient contact in many premarket submissions, including 510(k)s.
EU MDR (European Union):
EU MDR Annex I includes requirements on chemical, physical, and biological properties of device materials and substances, with a focus on minimizing risks related to toxicity and interactions with tissues and fluids. Manufacturers commonly use ISO 10993-1 as part of the evidence package to support biological safety, but MDR requirements are framed around meeting the General Safety and Performance Requirements, not “ISO by name.”
Standards note:
If a standard is formally harmonised and its reference is published in the Official Journal, it can support a presumption of conformity for relevant requirements. Harmonisation status can change, so confirm what is currently cited.
Why Biocompatibility Testing Is Required
Medical devices can contact skin, mucosa, blood, tissue, bone, or body fluids. Materials may release chemicals (extractables or leachables), contain manufacturing residues, or create use-related biological risks based on contact location, duration, and patient population. A material used safely in one context may not be appropriate in another, especially if contact duration or tissue exposure changes.
Potential harm from biocompatibility failures can include allergic reactions, local tissue injury, systemic toxicity, thrombosis or hemolysis for blood-contacting devices, and pyrogenic reactions for certain device categories. The goal is to identify and control these risks before clinical use or broad commercial distribution.
Cost of Biocompatibility Failures
Biocompatibility failures are costly because they can trigger field actions (corrections, removals, or recalls), disrupt trials, delay submissions, and increase regulatory and legal exposure. If you include dollar ranges here, label them as internal estimates and explain your methodology, otherwise keep it qualitative to avoid losing credibility.
ISO 10993-1 Framework: How to Build a Biological Evaluation Plan
ISO 10993-1 is the cornerstone framework for evaluating the biological safety of a medical device within a risk management process. FDA’s biocompatibility guidance explains how to apply ISO 10993-1 to FDA submissions, and FDA’s endpoint tables mirror the contact categories and contact duration periods used in ISO 10993-1.
Four-step process
Step 1: Device characterization and material identification
Identify every patient-contacting material in the finished device, including coatings, adhesives, inks, and processing residues. Document material composition, suppliers, and processing history. Chemical characterization and toxicological risk assessment are often a core part of the justification, especially when you want to reduce or avoid animal testing.
Step 2: Device categorization
Categorize the device by:
Nature of body contact: surface device, external communicating device, implant device
Contact duration: limited (≤24 hours), prolonged (>24 hours to 30 days), long-term or permanent (>30 days)
This categorization is what drives which biological endpoints you must evaluate and justify.
Step 3: Identify biological endpoints for consideration
Use ISO 10993-1 and FDA’s endpoint tables to identify the biological endpoints that are relevant for your device category and duration. These are endpoints for consideration, not a universal checklist that every device must test.
Step 4: Choose an evaluation strategy for each endpoint
For each endpoint, you typically justify safety using one or more of:
Existing data, such as literature, supplier data, or prior biocompatibility evidence
Chemical characterization and toxicological risk assessment
Targeted testing, in vitro and in vivo, using the appropriate ISO 10993 methods where needed
Device contact categories
FDA uses the same top-level structure most teams use for ISO 10993-1 planning.
Surface devices
Intact skin
Mucosal membrane
Breached or compromised surface
External communicating devices
Blood path, indirect
Tissue, bone, dentin
Circulating blood
Implant devices
Tissue or bone
Blood
Contact duration categories
Contact duration is defined as the cumulative sum of single, multiple, or repeated contact time.
Limited exposure: ≤24 hours cumulative contact
Prolonged exposure: >24 hours to 30 days cumulative contact
Long-term or permanent exposure: >30 days cumulative contact
If a device is used repeatedly, cumulative use can push it into a longer duration category even if each individual use is short.
Core Biocompatibility Tests
This section explains the most common ISO 10993 tests used in a biological evaluation plan. The right test mix depends on your device’s contact type, contact duration, and a risk-based rationale, and FDA expects you to justify the plan within an ISO 10993-1 risk management process.
Cytotoxicity (ISO 10993-5)
What it measures
Cytotoxicity screens whether device materials or extracts cause cell death or inhibit cell growth. It’s often the first biological endpoint evaluated because it gives a fast signal of basic material toxicity.
Standard: ISO 10993-5, “Tests for in vitro cytotoxicity.”
Common methods labs use
Labs typically run one of three approaches depending on device form and intended contact:
Direct contact: material placed directly onto a cell monolayer
Indirect contact: material separated by an agar or membrane barrier
Extract method: device extracted into a solvent, extract applied to cells
Many labs use mammalian cell lines such as L-929 fibroblasts, and measure viability with assays like MTT or neutral red uptake. The exact cell line and readout can vary by lab SOP and device type.
How results are commonly interpreted
ISO 10993-5 commonly treats cell viability below 70% (relative to the negative control) as indicating cytotoxic potential.
When it’s typically expected
Cytotoxicity is commonly expected for many patient-contacting devices, but it is not literally “required for every device regardless of contact.” The expectation should be tied to your ISO 10993-1 categorization and the FDA endpoint tables.
Common failure modes
Residual processing chemicals or cleaning agents
Uncured polymers or adhesive residuals
Extractables from plasticizers and additives
Sterilization residuals (device and process dependent)
Sensitization (ISO 10993-10)
What it measures
Sensitization evaluates whether device chemicals can trigger allergic contact dermatitis, typically a delayed (Type IV) hypersensitivity response.
Standard: ISO 10993-10 addresses sensitization test approaches.
Common methods
Two common methods you’ll see:
LLNA (Local Lymph Node Assay): measures lymph node cell proliferation in mice, a stimulation index above 3 is commonly treated as a positive signal under LLNA conventions.
GPMT (Guinea Pig Maximization Test): classical sensitization model with induction and challenge exposures, scored via skin reactions.
When it’s typically expected
Sensitization is often considered for skin contact and mucosal contact devices, especially with prolonged or long-term exposure, but whether it’s needed depends on the biological evaluation plan, existing materials data, and chemical characterization.
Common sensitizers in device contexts
Latex proteins, certain metals (device-specific and context-specific), rubber accelerators, residual monomers in adhesives. Keep these as examples, but avoid implying they always cause failure.
Irritation (ISO 10993-23)
What it measures
Irritation evaluates localized inflammatory response at the contact site. Unlike sensitization, irritation does not require prior immune priming and is typically reversible when exposure ends.
Standard: ISO 10993-23 is the modern standard for irritation testing.
Common approaches
Test selection depends on where the device contacts:
Dermal irritation for skin contact
Mucosal irritation for mucous membranes
Intracutaneous reactivity for certain exposure scenarios
Avoid hard-coding universal numeric pass/fail cutoffs because scoring and acceptance criteria depend on method and context.
Common failure modes
Extreme pH, residual detergents/disinfectants, oxidizing residues, particulates that cause mechanical irritation.
Systemic Toxicity (ISO 10993-11)
What it measures
Systemic toxicity evaluates whether chemicals released from the device could produce harmful effects in organs or systems after systemic exposure. Depending on contact duration and risk, evaluations may consider acute, repeated-dose, or longer-term toxicity endpoints.
Standard: ISO 10993-11 covers systemic toxicity testing concepts.
Key point
Do not present one fixed template as universal (route, species, durations, and endpoints vary). Your biological evaluation should justify the approach using ISO 10993-1 logic and chemical characterization where applicable.
Genotoxicity (ISO 10993-3)
What it measures
Genotoxicity evaluates potential DNA damage mechanisms relevant to long-term risk. FDA generally expects a risk-based approach, commonly tiered, where in vitro screening may be followed by in vivo follow-up when needed.
Important fix
Do not state “three tests are always required.” That’s not defensible as a universal rule.
Implantation (ISO 10993-6)
What it measures
Implantation testing evaluates local tissue response to implanted materials, such as inflammation and foreign body response, typically via histopathology at defined timepoints.
Important fix
Avoid micrometer-thickness pass/fail thresholds, use method-specific scoring and comparative controls.
Hemocompatibility (ISO 10993-4)
What it measures
Hemocompatibility evaluates blood interaction risks such as hemolysis, thrombogenicity, complement activation, and coagulation effects for blood-contacting devices. FDA recognizes that test selection depends on the clinical situation and references method standards like ASTM F756 for hemolysis testing.
Important fix
Avoid universal numeric thresholds like “<2% hemolysis,” because acceptance depends on method, contact duration, and clinical context.
Pyrogen-related risks and endotoxin
What it measures
Pyrogen-related risks include endotoxin (bacterial lipopolysaccharide) and other pyrogenic substances that can trigger febrile responses and inflammatory reactions in certain exposure scenarios. FDA’s ISO 10993-1 guidance addresses pyrogenicity considerations where relevant.
Important fix
Do not present universal endotoxin limits like “0.5 EU/mL for devices.” Limits are device- and route-specific and are often calculated as EU/device or EU/kg based on patient exposure.
Device Categorization Determines Testing
ISO 10993-1 and FDA’s biocompatibility tables use device contact category and contact duration to identify biological endpoints for consideration. Your biological evaluation plan should then justify how each relevant endpoint is addressed, through testing, chemical characterization and toxicological risk assessment, existing data, or a combination.
Proper categorization matters because under-scoping can trigger FDA questions or additional information requests, while over-scoping can lead to unnecessary studies and longer timelines.
Surface devices (example and typical endpoints)
Example: Wound dressing that contacts breached or compromised surface for a prolonged duration.
Common endpoints to consider: cytotoxicity, sensitization, irritation or intracutaneous reactivity. Depending on chemistry and duration, systemic toxicity may also be considered for breached-surface exposure.
Key point: Don’t assume “systemic toxicity = no” just because it is “surface.” Breached surface can increase exposure to extractables.
External communicating devices (example and typical endpoints)
Example: Urinary catheter with prolonged mucosal membrane contact.
Common endpoints to consider: cytotoxicity, sensitization, irritation. Additional endpoints depend on contact duration, materials, and whether there is any meaningful systemic exposure from extractables. Hemocompatibility is generally tied to blood-contacting devices, so it is not automatically part of a urinary catheter plan.
Implant devices (example and typical endpoints)
Example: Orthopedic screw (implant, tissue/bone contact, long-term).
Common endpoints to consider: cytotoxicity, sensitization, systemic toxicity considerations, genotoxicity considerations (risk-based), and implantation. The exact endpoint set depends on contact duration, materials, and chemical characterization findings.
Endotoxin/pyrogen note: For many sterile implants, pyrogen-related risks may need to be addressed, but do not present it as automatically universal.
Blood-contacting implants (example and typical endpoints)
Example: Vascular stent (implant with long-term circulating blood contact).
In addition to the endpoints above, blood-contacting devices typically require hemocompatibility endpoints selected based on ISO 10993-4 and the device’s blood-contact profile.
Cost and timeline ranges (how to include them without losing credibility)
If you include cost and timeline ranges, label them clearly as:
“Typical lab quotes, not regulatory requirements. Pricing and timelines vary by lab, region, extraction conditions, and device complexity.”
Then present them as illustrative budgeting examples, not as “the cost of a surface device is $X.”
Additional costs that are commonly missed
Sample preparation: can vary by device geometry and required extracts.
Chemical characterization (extractables/leachables): often expected, especially for long-term exposure and novel materials, and can be used to justify reduced biological testing where appropriate.
Retesting after failures: plan for remediation time and rework.
Multiple configurations: if materials or contact differ, you may need separate justification or testing.
Timeline Planning for ISO 10993 Biocompatibility Testing
Biocompatibility timelines are driven by two things: biological timepoints for in vivo studies and lab scheduling. The fastest teams are not the ones who “rush every test,” they are the ones who lock materials and processing early and run a defensible plan in parallel where it makes sense.
Sequential vs parallel testing
Sequential approach (lower financial risk)
A common conservative workflow is to start with high-signal screening endpoints first, then expand only if those results are acceptable. This reduces wasted spend if an early screen fails, but it increases total calendar time.
Typical pattern:
Start cytotoxicity first
If acceptable, initiate the next endpoint group (such as irritation and sensitization)
Start longer in vivo studies only once early screens support the material choice
Parallel approach (faster completion, higher sunk-cost risk)
A more aggressive workflow is to run multiple endpoints in parallel, especially in vitro tests, while preparing in vivo studies. This can shorten the overall timeline, but increases the risk of sunk cost if an early screen fails and forces redesign.
Hybrid approach (recommended for most teams)
A pragmatic approach is:
Run cytotoxicity early as a gate
In parallel, prepare samples and study plans so downstream tests can start immediately after the gate passes
Start long-duration studies once you have early confidence that the material and process are stable and trending acceptable
Critical path items (what usually drives the calendar)
Implantation studies
Implantation and other longer-duration studies have limited compressibility because tissue response requires defined timepoints. The best way to reduce calendar time is to start them as soon as your test articles represent the final device configuration.
Longer-duration systemic toxicity
Longer contact durations can drive longer systemic toxicity evaluations, but the need, duration, and design of studies must be justified through the ISO 10993-1 risk-management approach and chemical characterization where applicable. Avoid assuming a universal “90-day minimum.”
Sample preparation and configuration control
Sample preparation frequently drives delays because device configuration must match the marketed device. Sterilization, cleaning, packaging, and manufacturing changes can invalidate earlier testing if they alter extractables or surface chemistry.
When to start biocompatibility testing
Do not start biocompatibility testing on a configuration you plan to change. Start once these are stable enough that the test article reflects the final device:
Final material selection (supplier, grade, additives)
Manufacturing process controls that affect materials and residues
Sterilization method and parameters
Cleaning and packaging that can affect residues and extractables
Biocompatibility evidence is commonly used to support design validation and overall device safety for its intended use, so timing should align to when you can reliably represent the finished device.
FDA vs EU Biocompatibility Requirements
Standard recognition differences
FDA (recognized consensus standards): FDA maintains a public database of recognized consensus standards used to support medical device submissions. For the ISO 10993 series, FDA recognition is sometimes partial and version-specific, so you must verify the exact edition and scope in the database.
Examples from FDA’s recognized list include:
ISO 10993-1:2018 (partial recognition)
ISO 10993-5:2009 (recognized)
ISO 10993-10:2021 (partial recognition, focused on skin sensitization)
ISO 10993-11:2017 (recognized)
ISO 10993-23:2021 (partial recognition)
EU MDR (harmonised standards): Under EU MDR, a standard supports presumption of conformity only if it is harmonised and published in the Official Journal. Not all ISO 10993 parts are harmonised under MDR. The published harmonised list includes some parts (for example EN ISO 10993-23 and EN ISO 10993-18), and does not necessarily include others (for example EN ISO 10993-1 in the cited Decision text).
Practical takeaway: recognition and harmonisation both change over time. Always verify FDA recognition status and EU MDR harmonisation status before you lock your biocompatibility strategy.
FDA emphasis on chemical characterization and toxicological risk assessment
FDA’s ISO 10993-1 guidance (updated September 2023) explains how to use ISO 10993-1 within a risk management process and often expects a strong justification using chemical characterization and toxicological risk assessment, especially for novel materials, coatings, or long-term contact devices.
Practical implication: if your strategy relies on “we tested biocompatibility endpoints and it passed,” FDA reviewers may still ask for deeper chemistry and tox rationale when extractables or material changes could create risk.
Endotoxin and pyrogen expectations
Endotoxin and pyrogen expectations are device- and route-specific, not a simple “US requires, EU doesn’t” rule. FDA’s current Pyrogen and Endotoxins Testing Q&A guidance covers devices and references USP chapters used in practice (including USP <85> and USP <161>).
Practical takeaway: for sterile and/or invasive devices, plan to justify your endotoxin approach clearly, including method, interference controls, and acceptance criteria tied to intended use.
Hemocompatibility testing (blood contact)
For blood-contacting devices, both FDA and EU rely on a risk-based approach aligned with ISO 10993-4. In practice, FDA reviewers may ask for additional endpoints or stronger justification depending on whether contact is indirect, direct, circulating, and the duration of exposure.
The Fastest Path to Market
FAQ
Which biocompatibility tests are required for a Class II medical device?
FDA expectations depend on patient contact type and contact duration, not the device class. Use ISO 10993-1 and FDA’s endpoint tables to identify the biological endpoints for consideration, then justify how each endpoint is addressed.
How much does biocompatibility testing cost?
It varies widely based on materials, contact category, duration, coatings, sterilization, and whether chemical characterization is needed. The most accurate way to budget is to define your endpoint plan first, then quote labs based on your final device configuration.
Can I use supplier biocompatibility data instead of new testing?
Sometimes. Supplier data can support your plan if you can justify equivalence to your finished device, including grade, additives, processing, and sterilization, and show the evidence matches your contact type and duration.
How long does biocompatibility testing take?
There is no universal timeline. In vivo studies with fixed timepoints, like implantation or longer systemic endpoints, often drive the critical path, and lab scheduling can add weeks.
What’s the difference between FDA and EU biocompatibility expectations?
Both use ISO 10993-1 concepts, but you should verify which ISO versions are FDA-recognized and which are EU MDR harmonised at the time of submission. Expectations for chemical characterization and justification can also vary by reviewer and device risk.
Do I need to retest if I change sterilization?
Often you need at least a biocompatibility reassessment, because sterilization can change residues and surface chemistry. Whether you retest, and which endpoints, depends on the change and your risk rationale.
Can I run biocompatibility testing in parallel with performance testing?
Yes, as long as materials, processing, packaging, and sterilization are stable enough that test articles represent the marketed device. If those inputs change, you may need to repeat parts of the evaluation.
Can I use predicate biocompatibility evidence in a 510(k)?
Sometimes, but you must justify equivalence of materials, manufacturing, sterilization, and finished-device exposure. Predicate evidence can support the rationale, but FDA may still ask for device-specific evidence depending on risk.
Are there alternatives to animal testing?
Some endpoints have strong in vitro options, and ISO 10993 encourages minimizing animal use through risk assessment and chemical characterization. Some implantation and systemic endpoints may still require in vivo studies depending on risk and exposure.