ISO 10993 Biological Evaluation — What to Settle Before You Commission Testing

Key takeaway — The question that comes up most often in biological safety is "which tests do we need," and it is one step too late. ISO 10993-1 is not a test list but a requirement to evaluate within a risk management process, so the endpoints only emerge once material information and contact categorisation are settled. The Korean basis is the Common Standards for Biological Safety of Medical Devices (MFDS Notice No. 2025-40, effective 17 June 2025). Current as of September 2026.

Reverse the sequence and the cost goes up

The common pattern looks like this. Someone contacts a laboratory, asks for a quotation for biological safety testing, receives pricing for cytotoxicity, sensitisation and irritation, and budgets on that basis. Later, endpoints get added — or the reports that came back turn out to be unusable.

There is a single cause. The endpoints are set by the nature of body contact rather than by the product, and the testing was commissioned before that nature was fixed.

The title of ISO 10993-1 says exactly this: evaluation and testing within a risk management process. Testing is a means of evaluation, not the starting point. So the preparation runs in this order:

1. Secure material information — identify every part that contacts the body
2. Fix the contact categorisation — where does it contact, and for how long
3. Derive the endpoints — the categorisation produces them
4. Remove what existing evidence already addresses — use history, chemical characterisation, existing reports
5. Commission only what remains

Skip step 4 and you pay for testing you did not need. Skip step 2 and you miss testing you did.

Step 1 — nothing starts without material information

The input to a biological evaluation is the material. The resolution of your material information therefore sets the schedule for everything downstream.

"Plastic" or "SUS304" is not enough. For a body-contacting part, the grade, surface treatment, coating (silicone, for instance), additives and colourants have to be identified before the evaluation stands. Where there are several parts, contact has to be resolved part by part.

In import projects this is the classic bottleneck. Where the manufacturer buys raw material in, the chain has to be traced back to the upstream supplier's material certificate (a mill sheet, for example) — and sometimes the manufacturer does not have it either. Where the formulation is core know-how, the manufacturer may decline to release it as a trade secret.

The consequence is that the evaluation stalls, and with it the test commissioning and the technical file. If the deposit has already been paid, there is no leverage left. The one inexpensive precaution is a data-provision obligation in the contract. Put the required documents in a table and present it before signing, and whether the manufacturer can supply them becomes visible on the spot.

Step 2 — contact categorisation determines the endpoints

Categorisation combines two axes.

Where does it contact

Category	Examples
Surface contact	Devices contacting skin, mucosal membranes or breached surfaces
Externally communicating	Devices contacting indirectly via a blood, tissue or fluid path
Implant	Devices placed within tissue, bone or the bloodstream

For how long

Category	Duration
Limited	Up to 24 hours
Prolonged	Over 24 hours up to 30 days
Long-term	Over 30 days

The endpoints emerge from where these two axes meet. A biopsy or puncture needle inserted and withdrawn during a procedure generally sits in limited contact — but contact with blood adds haemocompatibility, and a design that stays in tissue longer moves up a category and brings more endpoints with it.

A frequent deficiency is a contact category that does not match the actual use time. The instructions for use allow repeated use or extended dwell time, while the testing was performed on a limited-contact premise. The contact category has to carry the same value across the specification, the instructions for use and the test request.

Step 3 — which endpoints appear

The ISO 10993 series divides endpoints and methods across its parts. The ones that come up most often:

Part	Subject
10993-1	Evaluation and testing within a risk management process — the overall frame
10993-5	Cytotoxicity (in vitro)
10993-10	Sensitisation
10993-23	Irritation
10993-11	Systemic toxicity
10993-4	Interactions with blood (haemocompatibility)
10993-3	Genotoxicity, carcinogenicity, reproductive toxicity
10993-6	Local effects after implantation
10993-7	Ethylene oxide sterilisation residuals
10993-12	Sample preparation and reference materials
10993-17	Toxicological risk assessment of device constituents
10993-18	Chemical characterisation of materials

Cytotoxicity, sensitisation and irritation are reviewed as a baseline regardless of contact type; the rest attach according to the categorisation.

One point worth noting — irritation used to sit inside 10993-10 and was separated into 10993-23 in the 2021 revision. Older reports and document templates that still follow the previous structure cause confusion when endpoints are cross-checked, so it is worth confirming that the part numbers you cite match the current structure.

And the Korean requirement is not the international standard itself but the edition and methods fixed by the notice. The Common Standards for Biological Safety of Medical Devices build on the ISO 10993 series, but a newer ISO revision does not automatically become the Korean requirement — which is why the notice text has to be checked at the time of application.

Step 4 — the legitimate ways to reduce testing

This is where the cost divides. ISO 10993-1 does not require every endpoint to be tested. Needing an evaluation and needing a test are two different statements.

There are roughly three routes to closing an endpoint without new testing.

1. Existing test data. Reports the manufacturer already holds. But "we have it" and "we can use it" differ — the material tested, the sample preparation, the contact category assumed and the method all have to align with your product and the Korean standard. The criteria for what Korea accepts are in the foreign test reports guide.

2. Chemical characterisation and toxicological risk assessment. Identify what leaches from the material (10993-18) and assess whether the quantity is toxicologically acceptable (10993-17). It reduces animal testing and is gaining weight internationally, but it requires both chemical analysis and toxicological assessment, so it is not always the cheaper path. The comparison depends on the material composition and the number of endpoints in play.

3. Material use history. Where the same material has a documented record of use under the same contact conditions, that can feed the evaluation. A general statement that the material "is widely used" is not enough; the evidence has to be specific.

All three share one requirement: the basis for the decision has to be documented. A decision not to test carries an obligation to explain why testing was not needed, and without that explanation it becomes a deficiency.

One more thing for sterile devices

Where ethylene oxide sterilisation is used, residuals testing (10993-7) comes as part of the set. Allowable EO and ECH residues are read differently by contact category, so even a short-contact device has to demonstrate compliance with the applicable limit through a test report.

What gets missed here — the actual residual level depends heavily on whether aeration immediately after sterilisation was adequate. Where the aeration process is not covered by the sterilisation validation, reports can carry acceptable numbers and still fail on reproducibility.

Where it sits in the technical file

Biological safety documentation does not stand alone. Material information, sterilisation method, intended use and duration of use exchange values with each other, and the result has to stay consistent inside the logic of the technical file. Change the contact category and the endpoints change; change a line in the intended-use statement and the contact category can change.

So this is less a document attached after development and more a file designed alongside the material and the intended use.

Common deficiency findings

• Material information stopping at "plastic" or "SUS304" — no upstream supply chain data
• Contact category inconsistent with the use conditions in the instructions for use
• Sample preparation (10993-12) not representative of the actual product form
• Manufacturer's reports attached as-is, with no comparison of material, preparation or method
• Omitted endpoints with no documented justification for the omission
• EO sterilisation with residuals testing missing, or aeration not validated

Before you start

• List every body-contacting part (material, grade, contact status per part)
• Confirm the route to upstream material certificates — put a data-provision obligation in the contract
• Fix the contact category and duration in writing (cross-check against specification and instructions for use)
• Derive the endpoints the categorisation requires
• Compare the manufacturer's reports on material, preparation and method → screen what is usable
• Decide whether the chemical characterisation route fits (compare by endpoint count and material composition)
• Write the justification for any endpoint you intend to omit
• For EO sterilisation, confirm residuals testing and aeration validation

---

In biological safety, cost divides less on the number of endpoints than on getting the premises right. Send the list of contacting parts and the manufacturer's document inventory, and we will identify which endpoints apply and which are already addressed — see free preliminary review.