Biological Risk Assessment: New EN ISO 10993-1:2025

The new edition of the reference standard for biological risk assessment (EN ISO 10993-1:2025) was published in November 2025; at the end of February 2026, UNI also adopted the standard and made it available on its website. This is a new edition that brings several significant changes compared to the previous 2020 edition.

The main changes in EN ISO 10993-1:2025

The new edition introduces a significant change, already anticipated by the new title: “General requirements and principles for the assessment of biological safety within a risk management process.”

Compared to the title of the previous edition (“Evaluation and testing within a risk management process”), the new title focuses attention on the concept of biological safety, where the word “safety” is used in the same sense as in the reference standard for risk management (EN ISO 14971), namely the absence of unacceptable (biological) risks.

The structure of EN ISO 10993-1 itself is aligned with the definitions and phases of the risk management process according to ISO 14971, applied in the biological context. Specifically, the following phases must be defined and documented:

• Biological evaluation plan: the document must contain specific information (listed in section 5 of the standard); among these, the definition of acceptability criteria for biological risks and overall residual risk is also required (similar to what is done in the risk management plan according to EN ISO 14971).
• Biological risk analysis: starting from the collection of all relevant information (description of constituent materials, identification of biological characteristics, identification of possible biological effects), hazards, hazardous situations, and possible biological harm must be identified, also considering reasonably foreseeable misuse (e.g., use for a different duration than intended or in contact with different body parts); for each hazardous situation, the risk must be estimated in terms of the combination of severity and probability of occurrence.
• Biological risk evaluation: verify the acceptability of each risk based on the acceptability criteria defined in the plan.
• Biological risk control measures: implement appropriate risk control measures for all unacceptable risks and re-evaluate the risk.
• Biological evaluation report: document the results of these activities in a report.
• Management of production and post-production activities: plan and establish the necessary activities to collect biologically relevant post-market information, in order to re-evaluate the acceptability of residual risk throughout the device lifecycle.

In essence, the approach to biological risk assessment must follow the same methodology and principles that apply in the general risk management process according to EN ISO 14971.

Additional modifications are as follows:

• The standard includes a harmonization table ZA.1, which shows the correspondence between the sections of the standard and the covered GSPRs of the MDR.
• The contact categories are now:
  • Devices in contact with intact skin;
  • Devices in contact with intact mucous membranes;
  • Devices in contact with compromised skin/mucous membranes and internal tissues (other than circulating blood);
  • Devices in contact with circulating blood.
• For exposure duration, while maintaining the three categories (limited, prolonged, and long-term), strict criteria are present for calculation in case of daily contact and intermittent contact (it is necessary to consider the days of contact from first to last use); the concept of bioaccumulation is present (which always leads to the “long-term” classification).
• Table A1 of endpoints now expands into 4 new tables dedicated to biological effects. Furthermore, toxicity effects (acute, subacute, subchronic, and chronic) are consolidated into the concept of systemic toxicity. Finally, genotoxicity is now required for almost all devices with prolonged or long-term contact (except for intact skin). Pyrogenicity disappears from general effects to become a parameter to be evaluated only in specific cases. The standard contains additional biological effects to be considered in specific cases (e.g., immunotoxicity, neurotoxicity, reproductive and developmental toxicity).
• The concept of “biological equivalence” has been introduced, formalized with a phased pathway to demonstrate equivalence with another device (chemical, physical, material, and contact equivalence) which, if verified, allows the device to be considered safe without new testing; equivalence is expressed in terms of similarity, where any differences must be justified based on risk.

Impact on Technical Documentation

The new edition of standard EN ISO 10993-1:2025 requires a review and update of biological risk documentation, through the performance of a gap analysis to verify whether existing biological information and assessments allow coverage of the new requirements. In particular, the following must be taken into consideration:

1. Biological risk assessment plan: now explicitly required, it must define in advance the risk acceptability criteria and the strategy for assessment.
2. Risk-based approach: implement a biological risk management system, similar to what is defined in EN ISO 14971.
3. Integration with PMS: It will be essential to link biological safety to PMS activities to actively monitor risk acceptability during the product’s life.

Impact on Testing

The standard provides precise guidance on testing: it is not necessary to repeat tests for devices already on the market if there have been no product modifications and if there are no negative signals from PMS indicating unacceptable risk.

The manufacturer must conduct a gap analysis to verify whether the new edition of the standard requires the assessment of new biological effects compared to those already considered. If there are no new applicable effects, there is no need to update the biological risk documentation, but it is mandatory to formally document this review process.

In case of product modifications, it will be necessary to re-evaluate the risk according to the rules of ISO 10993:2025. If unacceptable risks emerge during evaluation, it will be necessary to proceed with the implementation of new control measures, with a risk-benefit assessment, with the collection of new data or, only if necessary, with the execution of new biological tests.

Conducting Gap Analysis and Managing Results

As established by the standard, conducting and formally documenting a gap analysis is mandatory for devices already on the market. This strategic step allows verification of the applicability of new biological effects and avoidance of new testing in the absence of product modifications.

Sistemir is available to perform gap analysis and manage its results, supporting manufacturers in updating technical documentation.