ISO 10993 Series Audit-Readiness Rubric — Biological Evaluation of Medical Devices

What this is: ISO 10993-1, Biological evaluation of medical devices — Part 1: Evaluation and testing within a risk management process, is the master/umbrella document of the ISO 10993 series. It doesn't itself specify pass/fail test results — it defines the risk-management-based process a manufacturer must follow to decide which biological endpoints need evaluating for a given device, and it hands off to ~20 sub-parts (10993-3, -4, -5, -6, -7, -10, -11, -12, -17, -18, -23, etc.) for the actual test/assessment methods. Relevant to Regscribe wherever a customer manufactures or develops a medical device, combination product, or device with patient-contacting materials — this sits alongside the existing ISO 13485 (QMS) rubric as the biocompatibility/biological-safety dimension of a device submission, distinct from the QMS-process dimension ISO 13485 covers.

Sourcing note: ISO 10993-1's full clause text is copyrighted and sold by ISO (iso.org). No verbatim clause text is used below. This document is structure and paraphrase built from secondary sources — certification/testing-lab explainer pages (NAMSA, Labcorp, Measurlabs, Nelson Labs, Intertek, Eurofins, MED Institute, Johner Institute, StarFish Medical, MEDIcept, Sobel, ChemSafe, Complizen, MedDeviceGuide, jltox), the FDA Law Blog, MedTech Dive, and Federal Register — cross-checked across multiple independent sources where possible. A verbatim/full-text copy of ISO 10993-1:2018 surfaced in search results this session (a hosted PDF at a third-party domain, mdcpp.com) — it was deliberately NOT fetched or used, since drawing from a pirated/unlicensed full-text copy would defeat the purpose of the copyright caveat above, even for paraphrase. Clause-level citations below are therefore coarser than the ISO 13485 rubric's (which had clean multi-source clause-number confirmation) — where a specific clause number couldn't be corroborated across ≥2 independent secondary sources, the citation says "general framework" instead of a specific clause number, and this is flagged explicitly rather than guessed.

Two direct fetches failed this session and are flagged rather than silently worked around: FDA's own guidance page (fda.gov/regulatory-information/.../use-international-standard-iso-10993-1...) returned HTTP 404, and NAMSA's biocompatibility test-matrix PDF returned HTTP 403. Both sections below drawing on those sources rely on search-result snippets and one AI-summarized fetch of a secondary consultancy page, not a direct primary-source read — weaker sourcing, flagged at point of use.

A new edition, ISO 10993-1:2025, was published in November 2025 and restructures the contact-categorization scheme (moving from surface/external-communicating/implant + limited/prolonged/permanent to a contact-site-based model: intact skin, intact mucosal membrane, breached/compromised surface, blood). Search results indicate FDA officially recognized ISO 10993-1:2025 on 25 May 2026 (per NAMSA's blog), which — if accurate — makes it live under this document's production date (29 July 2026) and means this rubric may already be scoring against a superseded framework. This is flagged as the single most important open item in this document (see Gaps/follow-ups #1) rather than silently building the rubric against 2025 without being able to verify the new edition's clause numbering from a primary or well-corroborated secondary source this session. The rubric below is built primarily against ISO 10993-1:2018, the edition every other source (FDA's still-current guidance, testing-lab pages, the categorization tables) was written against, with 2025 changes flagged inline where known.

Rubric legend

Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern

Failure patterns are drawn from consultancy explainer write-ups and one AI-summarized secondary-source page describing FDA Additional Information (AI) request patterns during 510(k)/PMA review — not a verified primary FDA database (see Gaps/follow-ups #3). Treat failure-pattern language as directionally reliable, not statistically sourced.

Part A — ISO 10993-1: the framework (master document)

A.1 Device characterization and categorization

#	Requirement (plain language)	Citation	Evidence of compliance	Common failure pattern
1	The device (and its materials, manufacturing process, and any coatings/additives) must be characterized before biological evaluation begins — composition, manufacturing residuals, and physical/chemical properties relevant to biological risk.	ISO 10993-1:2018, general framework (cross-referenced to ISO 10993-18 for the chemical side)	Device/material characterization dossier: formulation, supplier certificates of composition, process aids/residuals, any changes from a previously-cleared predicate	Characterization based on "typical" or nominal formulation rather than the actual production material; supplier-side formulation changes not flowed through to the characterization record
2	The device must be categorized by nature of body contact — surface-contacting (skin, mucosal membrane, breached/compromised surface), externally communicating (blood path indirect, tissue/bone/dentin, circulating blood), or implant (tissue/bone, blood) — using the worst-case contacting material/component where a device has multiple contact types.	ISO 10993-1:2018, Clause 6 (categorization); Annex A table	Documented categorization rationale identifying every patient-contacting material/component and its contact classification, with worst-case component driving the overall categorization	Categorizing the device as a whole by its "primary" function rather than by every individual patient-contacting material — missing a secondary component (e.g. an adhesive, a coating, a lubricant) that has a more severe contact classification than the main body
3	The device must also be categorized by contact duration: limited (≤24 hours single/cumulative), prolonged (>24 hours to 30 days), long-term/permanent (>30 days) — with cumulative exposure across repeated uses driving the classification, not a single-use assumption.	ISO 10993-1:2018, Clause 6; Annex A	Duration-classification rationale that explicitly addresses cumulative/repeat-use exposure (e.g. a device reused weekly over months is long-term even if each individual contact is brief)	Duration classified based on a single procedure's contact time, ignoring that the device is reused or that the clinical use pattern makes cumulative exposure materially longer
4	Where a device is a combination product (drug-device, biologic-device) or has patient-contacting components made of different material classes, each component's biological risk must be separately evaluated and reconciled into an overall device-level conclusion.	ISO 10993-1:2018, general framework	Component-level biological risk assessment rolled up into a device-level Biological Evaluation Report conclusion	Combination-product evaluation treating the device shell/delivery component's biocompatibility as sufficient without separately addressing drug/device interface effects

A.2 Endpoint selection and gap analysis

#	Requirement	Citation	Evidence	Common failure pattern
5	Based on the contact-type/duration categorization, the applicable biological endpoints (cytotoxicity, sensitization, irritation/intracutaneous reactivity, acute/subacute/subchronic/chronic systemic toxicity, genotoxicity, implantation, hemocompatibility, material-mediated pyrogenicity, carcinogenicity, reproductive/developmental toxicity, degradation) must be identified using the ISO Annex A endpoint-selection table (or, for FDA submissions, the FDA-modified matrix — see Part C).	ISO 10993-1:2018, Annex A (informative)	Endpoint selection table/matrix completed for the device's specific categorization, with each endpoint marked required/not-required and a rationale for exclusions	Endpoints excluded from the evaluation with no documented rationale, or the matrix applied to the device's nominal category rather than its actual worst-case categorization
6	Existing data (prior test reports on the same/materially-equivalent material and manufacturing process, published literature, clinical history, chemical characterization data) must be systematically reviewed before deciding what new testing is needed — testing is a fallback, not a default.	ISO 10993-1:2018, Clause 7 (evaluation of existing data) — clause number cross-checked against 1 source only, flagged	Literature/data review record per endpoint, citing specific prior reports/publications and explaining applicability (same material, same manufacturing, same contact profile)	Equivalence to a predicate device asserted narratively without analytical proof the materials/manufacturing/geometry are actually equivalent (a specifically-named recurring AI-request pattern)
7	A documented gap analysis must identify, per endpoint, whether existing data is sufficient, insufficient (new testing needed), or the endpoint is not applicable — informing the test plan.	ISO 10993-1:2018, Clause 7	Endpoint-by-endpoint gap analysis table showing data source used (existing/new), justification, and residual gaps	Gap analysis missing entirely, or present but not linked back to the specific endpoint matrix from step 5 — i.e. it doesn't visibly "close the loop" for every required endpoint

A.3 Testing hierarchy and 3Rs (reduce/refine/replace animal testing)

#	Requirement	Citation	Evidence	Common failure pattern
8	Where new evaluation is needed, a testing hierarchy should be followed: existing data/literature first, then chemical characterization + toxicological risk assessment (ISO 10993-18 / -17), then in vitro testing, then in vivo (animal) testing only where no other approach can resolve the endpoint — consistent with 3Rs (replace/reduce/refine) principles increasingly expected by both ISO and FDA.	ISO 10993-1:2018, general framework; explicit 3Rs emphasis strengthened in the 2018 edition per multiple sources	Documented rationale per endpoint showing why a non-animal method was (or wasn't) sufficient before an in vivo test was selected	Defaulting straight to legacy animal test protocols (e.g. a full implantation study) without documenting why chemical characterization/toxicological risk assessment couldn't resolve the endpoint first
9	Chemical characterization (extractables/leachables analysis per ISO 10993-18) should be performed for prolonged/permanent-contact devices, feeding into a toxicological risk assessment (ISO 10993-17) that calculates margins of safety against identified/estimated extractable compounds — this combination is now the most mature and widely accepted route to closing systemic-effect endpoints (systemic toxicity, genotoxicity, carcinogenicity, reproductive/developmental toxicity) without animal testing.	ISO 10993-18:2020; ISO 10993-17 (reissued 2023)	Extractables/leachables study report (extraction conditions, analytical methods, compound identification/quantification) + toxicological risk assessment report with margin-of-safety calculations per identified compound, signed by a qualified toxicologist	Extraction performed under a single solvent/condition rather than a scientifically justified set covering polar/non-polar/aqueous extremes per ISO 10993-12; toxicological risk assessment not actually reconciled back to the specific endpoints it's meant to close
10	Where a device is sterilized with ethylene oxide, EtO and ECH (ethylene chlorohydrin) residuals must be evaluated against defined limits, since EtO residuals are a systemic-toxicity/genotoxicity concern independent of the base material's biocompatibility.	ISO 10993-7	EtO residual test reports per applicable limits (device-category-dependent allowable limits)	EtO residual testing addressed at initial validation but not re-confirmed after a sterilization-cycle or packaging change

A.4 Documentation and lifecycle maintenance

#	Requirement	Citation	Evidence	Common failure pattern
11	A Biological Evaluation Plan (BEP) must be produced before testing begins — identifying the device's intended use/target population, categorization, endpoints, existing-data assessment, and the specific test/assessment strategy for any gaps, including target market and worst-case cumulative exposure.	ISO 10993-1:2018, Annex B.2.2 (guidance)	BEP document dated prior to test execution, covering device description, categorization, endpoint matrix, existing-data review, and planned test/assessment methods per open endpoint	BEP written retrospectively to match tests already run, rather than driving the test plan — a pattern several sources flag as something Notified Bodies specifically probe for via dated document metadata
12	A Biological Evaluation Report (BER) must consolidate all evaluation activity (existing data, chemical characterization, toxicological risk assessment, and any new biological test results) into an overall biological-safety conclusion per endpoint, addressing any anomalous/adverse findings with documented rationale rather than omission.	ISO 10993-1:2018, Annex B.4 (guidance)	Final BER, signed/reviewed by a qualified assessor (board-certified toxicologist or equivalent expertise), systematically confirming every endpoint from the BEP's matrix was addressed (tested, assessed, or explicitly excluded with rationale)	BER that summarizes favorable results but omits or under-addresses adverse/unexpected findings; BER not signed by anyone with demonstrable toxicology qualification; matrix endpoints silently dropped between the BEP and the BER with no explanation
13	The biological evaluation must be maintained as a living assessment — re-triggered by material changes, supplier/process changes, sterilization-method changes, or new post-market safety signals — not treated as a one-time, pre-launch deliverable.	ISO 10993-1:2018, general framework (risk-management-process framing, consistent with ISO 14971's lifecycle approach)	Change-control procedure that explicitly triggers biological-evaluation review on defined change categories (material, supplier, process, sterilization, indication/contact profile)	Biological Evaluation File not revisited after a supplier or manufacturing-process change, discovered only retrospectively during an audit or a field issue investigation

Part B — Sub-part scope notes (most commonly referenced)

Brief, high-level scope only — not deep clause detail, consistent with the task's intent. Each sub-part specifies how to test/assess an endpoint identified via the Part A matrix; it doesn't independently decide whether that endpoint applies.

Sub-part	Title/scope	What it tests	Notes
ISO 10993-5	Tests for in vitro cytotoxicity	Cell-culture-based assays (e.g. MEM elution, agar diffusion, direct contact) assessing whether device extracts/materials are cytotoxic to cultured mammalian cells	One of the "big three" screening tests (with sensitization and irritation) applied to essentially all device categories/durations as a baseline
ISO 10993-10 (2010 edition; irritation content split out to -23 from later editions)	Tests for irritation and skin sensitization	Sensitization: traditionally guinea pig maximization/Buehler assays, increasingly supplemented/replaced by validated in vitro alternatives (DPRA, KeratinoSens, h-CLAT). Irritation: traditionally rabbit-based, with in vitro reconstructed-tissue alternatives increasingly accepted	Note: newer editions of the series split irritation into its own ISO 10993-23 and narrowed -10 to sensitization only — check which edition a given source/report references before assuming -10 covers both
ISO 10993-6	Tests for local effects after implantation	Tissue response (inflammation, encapsulation, degradation) to a material implanted in animal tissue — subcutaneous, intramuscular, or bone, matched to the device's actual implant site	Applies to prolonged/permanent-contact implant-category devices; site of implantation in the test should match (or conservatively bracket) clinical implantation site
ISO 10993-11	Tests for systemic toxicity	Acute, subacute/subchronic, and chronic systemic toxicity from device extracts, historically via animal dosing; increasingly addressed via chemical characterization + toxicological risk assessment (10993-18/-17) rather than de novo animal studies	The endpoint most directly targeted by the 3Rs chemical-characterization pathway (Part A.3, item 9)
ISO 10993-7	Ethylene oxide sterilization residuals	EtO and ECH residual levels against device-category-dependent allowable limits	Applies specifically to EtO-sterilized devices; independent of the base-material biocompatibility evaluation
ISO 10993-4 (referenced for context, not separately requested but load-bearing for implant/blood-contact devices)	Tests for interactions with blood	Hemocompatibility (hemolysis, thrombosis, coagulation, complement activation, hematology)	Applies to any device with direct or indirect blood contact, regardless of duration
ISO 10993-18	Chemical characterization of medical device materials	Extractables/leachables identification and quantification via extraction studies + analytical chemistry (GC-MS, LC-MS, ICP-MS, etc.)	Feeds ISO 10993-17; FDA issued draft guidance in 2024 specifically on chemical-characterization/extractables methodology, citing lab-to-lab variability in current practice as a driver (see Part C)
ISO 10993-17	Toxicological risk assessment of medical device constituents	Converts chemical characterization data into margin-of-safety/tolerable-intake calculations per identified/estimated compound	Reissued 2023; central to the non-animal testing pathway

Part C — FDA's ISO 10993-1 guidance (US-specific overlay)

Confirmed, multi-source: FDA maintains its own guidance document, "Use of International Standard ISO 10993-1, 'Biological evaluation of medical devices – Part 1: Evaluation and testing within a risk management process'", which supplements (rather than replaces) the ISO framework for devices going through US premarket submissions (510(k), PMA, De Novo, IDE). A revised/updated final version was published, and the guidance provides an FDA-modified matrix that manufacturers use alongside (not instead of) the ISO Annex A table to determine required biocompatibility endpoints for a US submission.

What the FDA guidance adds on top of ISO 10993-1 (confirmed via convergent secondary sources, not a direct fetch — flagged):

The FDA-modified matrix — endpoint requirements are, per multiple sources, somewhat more extensive than the ISO Annex A baseline for certain categories (e.g. explicitly calling out material-mediated pyrogenicity, genotoxicity, and carcinogenicity earlier/more broadly for blood-contacting and implant devices than the ISO table alone might suggest).
Explicit expectations around use of the testing hierarchy / risk-assessment-first approach, chemical characterization, and reliance on existing/prior data (including FDA's own experience with previously-reviewed, materially similar devices) as legitimate substitutes for de novo testing where justified.
Submission-content expectations: a clear risk-assessment summary, explicit rationale connecting identified risks to the mitigating information provided, and (per the 2024 draft chemical-characterization guidance layered on top) more prescriptive expectations for extraction conditions and analytical-chemistry methodology, specifically because FDA identified lab-to-lab variability in extractables/leachables methodology as a recurring cause of inconsistent, deficient submissions.
FDA officially recognized ISO 10993-1:2025 as a consensus standard on 25 May 2026 per one secondary source (NAMSA) — this is a single-source claim, not independently corroborated this session, and given its direct relevance to which edition Regscribe should score against, it's flagged for follow-up verification (see Gaps/follow-ups #1) rather than treated as confirmed.

Sourcing caveat: FDA's own guidance page returned HTTP 404 to direct fetch this session; a StarFish Medical page fetched directly confirmed only general risk-based principles, not matrix specifics. The FDA-modified-matrix content above is built from search-result snippets (Emergo by UL, MEDIcept, jltox, thefdalawblog.com) and one AI-summarized fetch of a MedDeviceGuide explainer page, which itself may have summarized/compressed rather than precisely quoted its own sources — weaker sourcing than the rest of this document, flagged for a follow-up direct read of the actual FDA guidance PDF (via fda.gov/media/ document IDs, which resolved for the ISO 13485-adjacent QMSR sourcing caveat in the sibling rubric, suggesting a direct PDF URL — rather than the redirect-prone guidance-search page used this session — may fetch successfully next time).

Common failure patterns (cross-cutting)

Qualitative, consultancy-sourced (not a verified primary FDA/Notified-Body deficiency database — see Gaps/follow-ups #3):

Missing or retrospective Biological Evaluation Plan — BEP absent, or written after testing to match results already obtained rather than driving the test strategy up front.
Incorrect or incomplete device categorization — worst-case contacting material/component missed; cumulative/repeat-use exposure not accounted for, understating the duration category.
Predicate/material "equivalence" asserted without analytical proof — narrative claims of equivalence to a previously-cleared device without composition-level or process-level data to back it up; one of the most frequently cited drivers of FDA Additional Information requests.
Absent or inadequate chemical characterization for prolonged/permanent-contact devices — no extractables/leachables data, or extraction performed under a single, insufficiently justified condition rather than a scientifically defensible set (polar/non-polar/aqueous, appropriate temperature/time/ratio per ISO 10993-12).
Toxicological risk assessment not actually linked back to endpoints — chemical data exists but margin-of-safety calculations aren't tied to the specific biological endpoints they're meant to close, leaving a paper gap between chemistry and biology.
Sterilization residuals unaddressed or not re-confirmed — EtO/ECH residual data missing, or not repeated after a sterilization-cycle or packaging change.
BER doesn't systematically close the loop — the final report doesn't visibly confirm every endpoint identified in the BEP's matrix was addressed (tested, chemically/toxicologically assessed, or excluded with documented rationale); endpoints silently dropped between plan and report.
Unqualified or unsigned BER — final report lacking sign-off from someone with demonstrable toxicology qualification (e.g. board-certified toxicologist, DABT or equivalent).
Biological evaluation treated as a one-time pre-launch deliverable — not revisited after material, supplier, process, or sterilization-method changes, surfacing only reactively during audit or a field issue.
Outdated standard editions used without disclosure — testing performed to a superseded sub-part edition (e.g. an old 10993-10 covering irritation content since split into -23) without flagging the edition used, creating ambiguity about what was actually demonstrated.

Documents/evidence needed for an ISO 10993 biocompatibility file

Framework/plan level: device and material characterization dossier; documented contact-type and contact-duration categorization rationale (including worst-case component and cumulative-exposure analysis); completed endpoint-selection matrix (ISO Annex A and, for US submissions, the FDA-modified matrix); existing-data/literature review record per endpoint; documented gap analysis; Biological Evaluation Plan (BEP), dated prior to test execution.

Chemical/toxicological route: extractables/leachables study report per ISO 10993-18 (extraction conditions, analytical methods, compound ID/quantification); toxicological risk assessment per ISO 10993-17 (margin-of-safety calculations per compound), signed by a qualified toxicologist.

Biological testing route (where chemical characterization doesn't resolve an endpoint): cytotoxicity test report (10993-5); sensitization/irritation test reports (10993-10/-23); systemic toxicity test reports (10993-11); implantation/local-tissue-response test report (10993-6); hemocompatibility test report (10993-4) for blood-contacting devices; EtO/ECH residuals report (10993-7) for EtO-sterilized devices; genotoxicity, carcinogenicity, reproductive/developmental toxicity assessments where triggered.

Consolidation/lifecycle: Biological Evaluation Report (BER), signed, systematically confirming disposition of every matrix endpoint; change-control procedure triggering biological-evaluation review on material/supplier/process/sterilization/indication changes; record of any post-market biocompatibility-relevant safety signals and their evaluation.

Gaps / follow-ups

ISO 10993-1:2025 edition risk — this rubric is built primarily against the 2018 edition, cross-checked against sources still describing 2018 as the operative FDA-recognized version, but one source (NAMSA) claims FDA recognized the 2025 edition on 25 May 2026 — a date inside this document's own production window. This is single-sourced and not independently corroborated. High-priority follow-up: directly fetch FDA's recognized-consensus-standards database (fda.gov Standards Advisory Committee / Recognized Consensus Standards search tool) to confirm current status before this rubric is used for live customer scoring, since scoring against a superseded edition's categorization scheme would misclassify devices.
FDA's ISO 10993-1 guidance document — direct fetch of fda.gov's guidance page returned HTTP 404 this session. The FDA-modified-matrix content in Part C is snippet/secondary-sourced. Follow-up: locate and directly fetch the actual guidance PDF (likely at an fda.gov/media/{id}/download URL, which resolved successfully for the sibling ISO 13485 rubric's FDA-sourcing needs) rather than the guidance-search landing page used this session.
No named, quantified deficiency database was located for biocompatibility-specific FDA Additional Information requests or Form 483 observations, unlike the MHRA GMP/GDP data used in the GMP/GDP rubric. The failure-pattern lists above are qualitative/consultancy-sourced. Follow-up: FDA's public Form 483/Warning Letter database and 510(k) Additional Information request patterns (if published in aggregate anywhere) would strengthen this section.
A verbatim third-party-hosted copy of ISO 10993-1:2018 surfaced in search results and was deliberately not used (see Sourcing note) — flagging this explicitly in case a future session encounters the same URL and needs a reminder not to draw from it.
ISO 10993-1:2025's new contact-categorization scheme (intact skin / intact mucosal membrane / breached-or-compromised surface / blood, replacing surface/external-communicating/implant) was only surface-confirmed this session, not detailed — if the 2025 edition is confirmed live per item 1 above, this rubric's Part A.1 categorization table will need a substantive rewrite, not just a citation update.
FDA's 2024 draft guidance on chemical-characterization/extractables methodology (referenced in Part C, flagged by thefdalawblog.com as "detailed and burdensome") was identified but not deep-researched — worth a dedicated follow-up pass if Regscribe customers are leaning heavily on the chemical-characterization/toxicological-risk-assessment pathway (which the research above suggests is now the dominant non-animal-testing route), since FDA's specific extraction-condition/analytical-method expectations under that draft guidance weren't captured in table form here.
EU MDR-specific biocompatibility expectations (General Safety and Performance Requirements, Annex I, and how Notified Bodies weight the BEP/BER under MDR vs. the older MDD) were referenced only in passing (via the BEP/BER sourcing search) — not separately researched as their own section, unlike the FDA overlay in Part C. If Regscribe customers need EU-specific biocompatibility scoring, that likely warrants its own overlay section analogous to Part C.
ISO 10993-3 (genotoxicity/carcinogenicity/reproductive toxicity) and ISO 10993-12 (sample preparation and reference materials — the standard that governs extraction conditions referenced throughout this document) were treated as supporting references rather than given their own Part B scope-note row, since the task's explicit sub-part list (-5, -10, -6, -11, -7) didn't include them — flagged in case broader sub-part coverage is wanted in a future revision.

Suggested integration note (not implemented — flagging for a decision, not doing it unasked)

This rubric is not yet wired into lib/rubrics.ts, following the same precedent noted in the ISO 13485 rubric (the RUBRICS registry currently only lists part11 and gmp-gdp). If ISO 10993 is meant to become a selectable rubric in the product, the small follow-up is: add an iso10993 entry to RUBRICS in /Users/khando/Khando/Dev/Projects/regscribe/lib/rubrics.ts pointing at iso10993-rubric.md, plus whatever test coverage lib/__tests__/rubrics.test.ts expects for a new rubric ID. Flagging rather than doing it, since it wasn't asked for and touches app code/tests. Given the ISO 10993-1:2025 edition-currency question flagged in Gaps/follow-ups #1, resolving that first is probably the right sequencing before wiring this into live scoring.

ISO 10993 (Biological Evaluation of Medical Devices)