Biocompatibility Testing for Medical Devices: What FDA Actually Requires and How to Get It Right

Biocompatibility Testing for Medical Devices: What FDA Actually Requires and How to Get It Right

If you are developing a medical device that contacts the human body -- even indirectly -- biocompatibility is not optional, and it is not an afterthought. It is one of the first things FDA reviewers scrutinize in a 510(k), De Novo, or PMA submission. Yet it remains one of the most misunderstood and mishandled components of a regulatory package. Sponsors either over-test (burning runway on studies that were never needed) or under-test (triggering an AI or major deficiency that delays clearance by six to twelve months).

This post breaks down exactly what FDA expects, how ISO 10993 translates into your submission strategy, and where teams most commonly get tripped up.

The Regulatory Foundation: ISO 10993 and 21 CFR Part 820

FDA does not have a standalone biocompatibility regulation in the CFR the way it does for, say, design controls under 21 CFR Part 820.30. Instead, FDA references a voluntary consensus standard: ISO 10993-1:2018, Biological Evaluation of Medical Devices -- Part 1: Evaluation and Testing Within a Risk Management Process.

The agency's primary guidance document is the 2023 FDA guidance: 'Use of International Standard ISO 10993-1, Biological Evaluation of Medical Devices -- Part 1: Evaluation and Testing Within a Risk Management Process.' This guidance is not aspirational. It defines FDA's current thinking and directly maps to what reviewers use when they assess your biocompatibility data.

Under the Quality System Regulation (21 CFR Part 820, now being harmonized with ISO 13485 under the Quality Management System Regulation), design controls require that design outputs -- including materials -- meet design inputs. Biocompatibility testing is a direct output of that process. Failure to document it properly is a design control deficiency, not just a biocompatibility gap.

The Risk-Based Framework: It Starts With Device Categorization

ISO 10993-1 organizes biological evaluation around two primary variables: the nature of body contact and the duration of that contact.

Contact categories include:

• Surface-contacting devices (skin, mucosal membrane, breached or compromised surfaces)
• External communicating devices (blood path indirect, tissue/bone/dentin, circulating blood)
• Implant devices (tissue/bone, blood)

Duration categories are defined as:

• Limited: less than 24 hours
• Prolonged: 24 hours to 30 days
• Permanent: greater than 30 days

These categories drive which endpoints from ISO 10993 Parts 3 through 22 are relevant to your device. The most commonly required endpoints include cytotoxicity (ISO 10993-5), sensitization (ISO 10993-10), genotoxicity (ISO 10993-3), systemic toxicity, and -- for implants or blood-contacting devices -- hemocompatibility (ISO 10993-4) and implantation studies (ISO 10993-6).

Here is what many sponsors miss: FDA does not require you to run every test. What FDA requires is a documented, scientifically justified biological evaluation that explains which endpoints are relevant, how you addressed them (whether through testing, literature, or existing data), and why your approach is sufficient given the device's risk profile.

The Biological Evaluation Plan and Report: Your Most Important Deliverable

Before any testing begins, you need a Biological Evaluation Plan (BEP). This document should identify all patient-contacting materials, map each to the appropriate ISO 10993-1 contact category and duration, identify applicable endpoints, and justify your testing or data-leveraging strategy.

After evaluation and testing are complete, you produce a Biological Evaluation Report (BER). The BER is what goes into your submission. FDA reviewers expect this document to be comprehensive, traceable to your risk management file (per ISO 14971), and authored or reviewed by someone with relevant toxicology and materials science expertise.

Submitting raw test reports without a BER -- or submitting a BER that does not connect endpoints to device contact categories -- is one of the most common reasons biocompatibility sections generate an AI (Additional Information) request.

Where Sponsors Get Into Trouble

Based on experience supporting 510(k) and PMA submissions across device classes, the highest-frequency failure points are:

• Using predicate device biocompatibility data without justification. Substantial equivalence to a predicate does not automatically transfer biocompatibility. You must show material equivalence or conduct independent evaluation.
• Ignoring processing and sterilization effects. FDA expects you to test final, finished, sterilized devices -- not raw materials. Sterilization can introduce residuals (e.g., ethylene oxide) that change the biological risk profile entirely.
• Inadequate chemical characterization. FDA increasingly expects a toxicological risk assessment (TRA) grounded in chemical characterization data per ISO 10993-18 before defaulting to animal-based testing. This is not just best practice -- it is now an explicit FDA expectation in the 2023 guidance.
• Misidentifying contact type or duration. A device used in a wound care application that contacts compromised skin is not the same as one contacting intact skin. This distinction changes your endpoint requirements substantially.

A Practical Path Forward

Start your biocompatibility evaluation at the same time you finalize your material selections -- not after design freeze. Retrofitting biocompatibility to a locked design is expensive and sometimes impossible without triggering a material change that restarts the clock.

Engage a qualified toxicologist early. FDA does not specify credentials, but reviewers notice when a BER lacks scientific rigor. If your team does not have in-house toxicology expertise, that gap needs to be filled before you submit.

Finally, treat your biocompatibility file as a living document within your design history file (DHF). Material changes, supplier changes, and sterilization method changes can all invalidate prior biocompatibility conclusions and require re-evaluation.

Work With an Expert Before You Submit

At ADB Consulting and CRO Inc., we have guided device companies through biocompatibility strategy, BEP and BER development, and FDA deficiency responses across Class I, II, and III devices. Whether you are early in development or staring at an AI letter, we can help you build a defensible, submission-ready biocompatibility package.

Book a free discovery call with Andre Butler today. Visit adbccro.com to schedule time directly. Let us make sure your biocompatibility strategy is one less thing standing between you and FDA clearance.

Why Your Biocompatibility Strategy Can Make or Break Your Submission Timeline

Biocompatibility testing is one of the most misunderstood — and most commonly under-planned — components of a medical device submission. Sponsors frequently either over-test (burning time and budget on unnecessary assays) or under-test (triggering FDA requests for additional data mid-review). Neither outcome is acceptable when you are racing toward a 510(k) clearance or PMA approval.

The foundation of a defensible biocompatibility program is ISO 10993-1:2018, Biological Evaluation of Medical Devices — Part 1: Evaluation and Testing Within a Risk Management Process. But the standard does not stand alone. FDA's 2020 guidance document, Use of International Standard ISO 10993-1 Biological Evaluation of Medical Devices — Part 1, significantly expanded FDA's expectations and introduced concepts that are not always obvious from reading the ISO standard itself. If your team is building a test matrix without that guidance open on the table, you are working from an incomplete picture.

Step One: Classify Your Device by Contact Nature and Duration

Before you run a single test, you need to answer two foundational questions: What does your device contact? and For how long? ISO 10993-1 and FDA's guidance use these two axes to drive every subsequent decision.

Contact Nature Categories

• Surface-contacting devices: Intact skin, mucosal membranes, or breached or compromised surfaces
• Externally communicating devices: Blood path indirect, tissue/bone/dentin communicating, or circulating blood
• Implant devices: Tissue/bone or blood

The distinction between 'mucosal membrane' and 'breached surface' matters enormously. A wound dressing contacting intact skin carries a very different biological risk profile than one contacting a chronic wound. Misclassifying contact nature at the outset can result in an incomplete test matrix that FDA will flag during substantive review.

Contact Duration Categories

• Limited: Single or multiple exposure, cumulative duration of 24 hours or less
• Prolonged: Cumulative exposure between 24 hours and 30 days
• Permanent: Cumulative exposure exceeding 30 days

Pay close attention to the word cumulative. FDA's 2020 guidance explicitly states that cumulative contact duration must account for repeated use over a device's lifetime. A single-use catheter used once for 90 minutes is limited contact. The same catheter used daily for six weeks is not — it crosses into prolonged, and your test matrix must reflect that clinical reality.

Building the Test Matrix: What ISO 10993-1 Table 1 Actually Tells You

Table 1 of ISO 10993-1:2018 is the starting point, not the finish line. It maps contact categories to a set of biological effect endpoints that must be addressed — not necessarily tested in a laboratory. FDA's guidance reinforces this: the biological evaluation is a risk management exercise, and existing data (literature, material characterization, predicate device data) can satisfy endpoints without generating new in vitro or in vivo data.

The core endpoints you must address include:

• Cytotoxicity
• Sensitization
• Irritation or intracutaneous reactivity
• Systemic toxicity (acute)
• Subacute and subchronic toxicity (for prolonged/permanent contact)
• Genotoxicity
• Implantation (for implant devices)
• Hemocompatibility (for blood-contacting devices)
• Chronic toxicity and carcinogenicity (for permanent contact)
• Reproductive and developmental toxicity (risk-based assessment required)

For permanent implants or devices with circulating blood contact, degradation testing per ISO 10993-9, -13, -14, and -15 is also expected. FDA's guidance adds a requirement for a chemical characterization under ISO 10993-18 before deciding whether toxicological risk assessment (per ISO 10993-17) can replace animal testing. This is not optional — it is now a standard FDA expectation across nearly all device categories.

Common Planning Mistakes That Trigger FDA Deficiencies

Based on experience reviewing FDA deficiency letters and working through biocompatibility responses, the following gaps appear repeatedly:

• Failing to conduct chemical characterization before selecting the test battery, leaving no toxicological basis for skipping endpoints
• Using extraction conditions that do not reflect actual clinical use (wrong solvent polarity, temperature, or surface-area-to-volume ratio per ISO 10993-12)
• Omitting a written biological evaluation plan (BEP) and biological evaluation report (BER) — FDA expects both as part of the submission package
• Applying a 'worst-case' predicate argument without documenting material equivalence at the formulation level
• Not updating the biocompatibility evaluation when a manufacturing process or material supplier changes post-clearance

Integrating Biocompatibility Into Your Design History File Early

Under 21 CFR Part 820 (and the updated Quality System Regulation aligned with ISO 13485), biocompatibility is a design control requirement, not a pre-submission afterthought. The BEP should be initiated during design inputs and updated as materials are finalized. Waiting until the device is locked to commission testing adds months to your timeline and limits your ability to make material changes without regulatory consequence.

If you are preparing a 510(k), your biocompatibility summary must demonstrate that all applicable endpoints in Table 1 have been addressed, with clear rationale for any endpoint that is waived. If you are pursuing a PMA, expect deeper scrutiny, including FDA review of your raw test reports and extraction methodologies.

Work With an Expert Before You Commission a Single Test

The cost of running the wrong test — or running the right test under the wrong conditions — is not just the lab invoice. It is the three to six months of submission delay while you generate replacement data. A well-constructed biological evaluation plan, built before you engage a testing laboratory, is the single highest-value investment you can make in your biocompatibility program.

At ADB Consulting and CRO Inc., Andre Butler and the team help medical device companies design biocompatibility strategies that are scientifically defensible, FDA-aligned, and efficient. Whether you are starting fresh with a novel device or resolving a deficiency letter on an existing submission, we can help you build a clear path forward.

Book a free discovery call at adbccro.com and let us review your current biocompatibility plan — before FDA does.