Biocompatibility documentation under MDR is the structured evidence that a medical device is biologically safe for its intended contact with the human body. The evidence is built through a biological evaluation process defined by EN ISO 10993-1:2025, conducted within a risk management framework, and supported by the relevant parts of the ISO 10993 series. Under MDR Annex I Section 10, the manufacturer must demonstrate that materials and substances in contact with patients, users, and third parties are chosen and controlled so that toxicity, carcinogenicity, and other biological hazards are acceptable. Under MDR Annex II Section 6, the resulting evidence lives in the pre-clinical section of the technical file as a biological evaluation plan, a biological evaluation report, and the underlying characterization and test records they depend on. Auditors read the file in that exact order and expect every endpoint decision to be traceable to either existing data, chemical characterization, or an experimental study that was itself justified by the risk assessment.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • Biocompatibility under MDR is governed by Annex I Section 10 (material safety) and documented in Annex II Section 6 (pre-clinical and clinical evidence) of Regulation (EU) 2017/745.
  • EN ISO 10993-1:2025 is the current harmonised standard for biological evaluation within a risk management process and replaces EN ISO 10993-1:2020. The rest of the ISO 10993 series supplies the endpoint-specific methods.
  • Biological evaluation is an evidence-planning process, not a testing plan. The biological evaluation plan decides which endpoints are addressed by existing data, chemical characterization, or new experimental work.
  • The technical file must contain, at minimum, a biological evaluation plan, a biological evaluation report, the material characterization records, and any test reports the report relies on. Each link must be traceable.
  • The most common Notified Body finding is not missing tests. It is missing rationale — endpoints silently excluded, or tests performed without a toxicological interpretation that ties them back to Annex I Section 10.

Biocompatibility in the MDR context

Annex I Section 10 of Regulation (EU) 2017/745 is the clause that anchors biocompatibility. It requires devices to be designed and manufactured in such a way that they are suitable for their intended purpose with regard to chemical, physical, and biological properties. It covers the choice of materials, their compatibility with biological tissues, cells, and body fluids, and the control of substances that may leach from the device. It includes specific language on substances that are carcinogenic, mutagenic, or toxic to reproduction, and on endocrine-disrupting substances above defined thresholds. The section is short in word count and enormous in consequence — most material-related findings from Notified Bodies cite Section 10 as the reference obligation.

Annex II Section 6 is where the evidence lands in the technical file. Section 6 requires pre-clinical and clinical data — including the results of biological evaluation — to demonstrate conformity with the general safety and performance requirements. This is the section a Notified Body assessor opens when they want to see whether the material safety story is coherent. If Annex I Section 10 is the obligation, Annex II Section 6 is the proof.

The bridge between the two is EN ISO 10993-1:2025, the harmonised standard that defines the biological evaluation process. Under MDR Article 8 and the harmonisation framework, compliance with the current edition of EN ISO 10993-1:2025 provides a presumption of conformity with the biological aspects of Annex I Section 10 that the standard covers. EN ISO 10993-1:2025 is also explicit that biological evaluation must run inside a risk management process — which for MDR purposes means the EN ISO 14971:2019+A11:2021 process that the rest of the technical file already uses. Biocompatibility is not a parallel universe. It is one branch of the risk file, with its own standard.

The ISO 10993-1 decision pathway

EN ISO 10993-1:2025 does not start with testing. It starts with a question: what does this device actually touch, for how long, and what do we already know about the materials? The answer to that question drives everything downstream.

The decision pathway has four stages. The first stage is definition of the device, its materials, its intended use, and its contact category and duration. Contact categories are grouped as surface-contacting, externally communicating, and implant. Durations are grouped as limited (up to 24 hours), prolonged (24 hours to 30 days), and long-term (over 30 days). The combination produces a contact type that determines which biological endpoints need to be addressed.

The second stage is collection of existing information. What do the suppliers already know about the raw materials? What has been published on the same formulations? What prior biological testing exists on the same or equivalent devices? What does the manufacturing process add or remove? This stage often closes more gaps than the testing stages combined, and it is the stage startups skip most frequently.

The third stage is the risk-based decision. For each biological endpoint relevant to the contact type, the evaluator decides whether existing data are sufficient, whether chemical characterization under ISO 10993-18 can address the endpoint without experimental biological testing, or whether an experimental study under the relevant part of the ISO 10993 series is needed. This is the stage where the biological evaluation plan is written.

The fourth stage is execution and interpretation. Studies that were justified are performed. Results are interpreted against the risk assessment. The biological evaluation report ties every endpoint back to the evidence that resolves it and states the overall conclusion on biological safety. If the evidence is not sufficient, the loop reopens.

Throughout the pathway, the risk management link is explicit. Every decision about evidence — including decisions not to test — is a risk management decision and has to be recorded as one. A biological evaluation that exists separately from the risk file is a biological evaluation that will not survive an audit.

Material characterization as the foundation

Material characterization sits at the base of the biocompatibility file because every endpoint decision above it depends on knowing what the device is actually made of. The term covers two layers. Compositional information describes what the raw materials contain, at the level of polymers, additives, processing aids, colourants, and known residues. Chemical characterization under ISO 10993-18 extends this — when needed — into analytical identification and quantification of substances that may be released under the conditions of use.

For a biological evaluation to be defensible, the compositional layer has to be documented before any endpoint decision is made. In practice this means written records from every raw material supplier, certificates of analysis per production lot, process validation records that account for substances introduced during manufacturing, and — for any substance whose presence or release could raise a toxicological concern — a plan for how that substance will be handled in the evaluation.

The deeper analytical work, including extractables and leachables studies, is covered in detail in the chemical characterization in technical documentation post. The point for the biocompatibility file is that chemical characterization is not a separate deliverable that arrives at the end. It is the input that feeds every other decision. Biological evaluation plans written without it are guesses.

The biological endpoint matrix

EN ISO 10993-1:2025 lists a set of biological endpoints that may need to be addressed depending on the contact type. The endpoints include cytotoxicity, sensitization, irritation or intracutaneous reactivity, material-mediated pyrogenicity, acute systemic toxicity, subacute and subchronic toxicity, genotoxicity, implantation effects, haemocompatibility, chronic toxicity, carcinogenicity, reproductive and developmental toxicity, and degradation-related considerations for degradable materials. Not every endpoint applies to every device. The contact type determines which ones are in scope.

The standard frames this as a matrix — contact type on one axis, biological endpoint on the other. For each cell where the combination applies, the evaluator has to decide how the endpoint will be addressed. Three legitimate answers exist. Existing data (supplier information, published literature, prior testing on the same material and same contact type) can resolve the endpoint. Chemical characterization combined with toxicological risk assessment can resolve the endpoint, especially for systemic and long-term toxicity endpoints where substance-level exposure is the driver. New experimental biological testing under the relevant part of the ISO 10993 series can resolve the endpoint when nothing cheaper is sufficient.

What is not a legitimate answer is silence. An endpoint that applies to the contact type and is not addressed in the biological evaluation plan is a finding waiting to be written. An endpoint that is addressed in the plan but whose resolution is not traceable to specific evidence is the same finding in a different form.

Risk-based testing — what, when, and why

The risk-based mindset introduced by EN ISO 10993-1:2025 has changed the biocompatibility file from a testing catalogue into an evidence argument. The shift matters because it means the file is no longer assessed on how many tests were performed. It is assessed on how well each endpoint was resolved relative to the risk.

Risk-based testing starts with the toxicological question. For a given contact type and duration, what is the realistic exposure of the patient to substances from the device? If that exposure can be bounded by chemical characterization — the substances that can come out are identified, quantified, and compared against toxicological thresholds of concern — then a substantial number of endpoints can be closed without experimental biological testing. This is the pathway EN ISO 10993-1:2025 actively encourages, consistent with broader regulatory movement toward replacement of animal testing where scientifically justified.

Where experimental testing is needed, it should be narrowly scoped to the specific endpoints that the risk assessment identified. A full battery of ISO 10993 tests performed by default — cytotoxicity, sensitization, irritation, systemic toxicity, genotoxicity, implantation, all in one package — is common for legacy devices but is rarely the right answer for a startup device under modern evaluation. The right answer is the plan that justifies each test and excludes the ones that are not needed, each exclusion recorded with its rationale.

Two tests remain almost universal in practice. Cytotoxicity (typically per ISO 10993-5) is almost always performed because it is inexpensive, standardised, and sensitive to many contamination modes. Sensitization is usually addressed experimentally or by strong prior evidence because chemical characterization alone rarely closes it. Beyond these two, the matrix narrows sharply depending on the device.

Documentation structure in the technical file

The biocompatibility documentation lives under Annex II Section 6 of the technical file, in a dedicated biological evaluation section. The structure that survives audits is consistent across devices.

At the top sits the biological evaluation plan. It states the device, the materials, the contact category and duration, the biological endpoints relevant to the contact type, and the strategy for addressing each endpoint. It references the risk management file, the material composition records, and any prior evidence being relied upon. The plan is dated, version-controlled, and approved before any experimental work starts.

Below the plan sits the material characterization record. Compositional information from suppliers, certificates of analysis, processing residues considered, and — where applicable — the chemical characterization report under ISO 10993-18. This is the factual base on which the rest of the evaluation rests.

Next are the experimental test reports, each for a specific endpoint, each under the relevant part of the ISO 10993 series. Each report is linked upward to the biological evaluation plan (which justified it) and downward into the biological evaluation report (which interprets it).

Above everything sits the biological evaluation report. It walks through each endpoint, states how it was addressed, summarises the supporting evidence, and draws a conclusion on biological safety of the device for its intended use. The report references every supporting document by controlled identifier and version. It closes with the overall conformity statement against MDR Annex I Section 10.

Finally, the biological evaluation connects into the broader risk management file. Any residual risks identified during the evaluation are tracked in the ISO 14971 risk file. Any post-market information needs are captured in the PMS plan. The biocompatibility evidence is not an island — it is one branch of the overall conformity argument, and the cross-references make that explicit.

Common gaps we see

Endpoint silently skipped. An endpoint that applies to the contact type is not addressed in the plan at all. The evaluator assumed it was covered elsewhere, or assumed the device did not need it, or simply missed it. The fix is a formal endpoint matrix built from EN ISO 10993-1:2025 before the plan is written.

Chemical characterization missing under the plan. The plan refers to chemical characterization as an input, but the actual chemical characterization report does not exist or is incomplete. The biological evaluation then rests on a foundation that is not in the file. Build the characterization before the plan — not after.

Test reports without toxicological interpretation. An extractables study or a systemic toxicity study produces raw results that sit in the file untethered from any threshold of concern. Data are not evidence. Data plus interpretation are evidence.

Contact category drift. The biological evaluation was done assuming one contact category, and the intended purpose in the clinical evaluation assumes a different one. Re-open the biological evaluation whenever the intended purpose, contact tissues, or contact duration change.

Reliance on supplier declarations without verification. The plan assumes the supplier's compositional declarations are complete, and does not capture what happens during manufacturing. Processing residues — cleaning agents, mould release agents, sterilant residues, adhesives — are missed. The assessor finds them.

Legacy test batteries repeated on new devices. A full ISO 10993 battery from a legacy device is copied onto a new device without a fresh risk-based rationale. This passes sometimes, but it is expensive, it is slow, and when the contact type differs even slightly it produces gaps the battery does not cover.

Biological evaluation detached from risk management. The biocompatibility file sits in its own binder and never references the ISO 14971 risk file. The evaluator did the work but forgot it was supposed to be part of the risk management process EN ISO 10993-1:2025 requires.

The Subtract to Ship angle

Biocompatibility is one of the domains where the Subtract to Ship framework for MDR produces the largest savings and the fewest compromises. The subtractions are specific, legitimate, and traceable to the standard.

The first subtraction is the battery cut. Start with the endpoint matrix from EN ISO 10993-1:2025, not with a legacy test list. Remove every endpoint the contact type does not require. Remove every endpoint that existing data, supplier information, or published literature already resolves. Document each removal as a reasoned exclusion in the plan. The remaining list is short, specific, and each item earns its place.

The second subtraction is the characterization-first order. Before commissioning any experimental biological test, commission — or retrieve — the chemical characterization. For systemic and long-term endpoints, characterization combined with toxicological risk assessment routinely replaces expensive animal studies. The money not spent on testing is money not spent.

The third subtraction is the silent-duplication cut. If a literature review, a supplier declaration, and a prior study all address the same endpoint, the file needs one clean chain of reasoning — not three parallel ones. Pick the strongest chain, reference it cleanly, and drop the redundant evidence from the evaluation narrative (retain it in the file as supporting material, but stop making the assessor read three versions of the same argument).

Each subtraction traces to a specific provision. Annex I Section 10 is the obligation. Annex II Section 6 is the documentation requirement. EN ISO 10993-1:2025 is the methodology. ISO 10993-18 is the analytical framework. The risk management wrapping comes from EN ISO 14971. Nothing in the framework comes from opinion. Everything comes from the Regulation and its harmonised standards.

Reality Check — Where do you stand?

  1. Have you documented the contact category and contact duration of your device against EN ISO 10993-1:2025, and is the documentation consistent with the intended purpose in your clinical evaluation?
  2. Do you have written compositional information for every material in the device, sourced from suppliers and supplemented with process-residue data?
  3. Does your biological evaluation plan list every endpoint relevant to the contact type and state explicitly how each one will be addressed?
  4. For endpoints excluded from experimental testing, is the rationale written down and traceable to a specific piece of evidence?
  5. Is your biological evaluation linked into the ISO 14971 risk management file, or does it live as a separate binder?
  6. If a test report exists in the file, is it accompanied by a toxicological interpretation that ties the results back to Annex I Section 10?
  7. Could a Notified Body assessor trace any biological safety conclusion in your file to the specific document, version, and page that supports it?

Frequently Asked Questions

Is EN ISO 10993-1:2025 mandatory for CE marking under MDR? The MDR does not name specific standards as mandatory. Under MDR Article 8, compliance with a harmonised standard provides presumption of conformity with the requirements it covers. EN ISO 10993-1:2025 is the current harmonised standard for biological evaluation within a risk management process and is the edition Notified Bodies currently expect. Manufacturers may demonstrate conformity by other means, but the practical path for the vast majority of devices is to follow the current edition of the standard.

Do I have to perform every test in the ISO 10993 series? No. EN ISO 10993-1:2025 is explicit that biological evaluation is risk-based. The contact type and duration determine which endpoints are relevant, and for each relevant endpoint the evaluator decides whether existing data, chemical characterization, or experimental testing is the right answer. Testing is required only where the risk assessment concludes that other evidence is insufficient.

Can literature data replace experimental biological testing? Yes, where the literature covers the same materials, the same contact type, and the same duration, and where the quality of the published evidence is adequate. The biological evaluation plan must state which endpoint the literature addresses and why the evidence is considered sufficient. A general reference to "published safety data" without specific traceability is not enough.

Where does the biological evaluation report sit in the technical file? Under MDR Annex II Section 6 on pre-clinical and clinical evidence. It is one of the core pre-clinical deliverables alongside design verification, performance testing, and (where applicable) electrical safety and software evidence. It must be cross-referenced from the GSPR checklist in Section 4 against every Annex I Section 10 requirement it helps to demonstrate.

What happens when the intended purpose changes after the biological evaluation is done? The biological evaluation is reopened. A change in tissues contacted, duration of contact, or patient population can invalidate the original endpoint matrix and require additional evidence. This is one of the most common sources of late-stage rework in startup projects and is also one of the reasons intended purpose should be stabilised as early as possible.

What is the most common Notified Body finding on biocompatibility? Missing rationale. Endpoints silently excluded without documented justification. Test reports present but not interpreted. Chemical characterization absent where the plan assumed it. Findings rarely turn on a missing test — they turn on a missing argument linking the evidence to the conclusion.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Annex I Section 10 (chemical, physical and biological properties) and Annex II Section 6 (pre-clinical and clinical data). Official Journal L 117, 5.5.2017.
  2. EN ISO 10993-1:2025 — Biological evaluation of medical devices — Part 1: Requirements and general principles for the evaluation of biological safety within a risk management process. Current harmonised edition, published December 2025, superseding EN ISO 10993-1:2020.
  3. ISO 10993 series — Biological evaluation of medical devices, Parts 2 through 18, referenced by EN ISO 10993-1:2025 for endpoint-specific methods including cytotoxicity, sensitization, irritation, systemic toxicity, genotoxicity, implantation, and chemical characterization.
  4. EN ISO 14971:2019 + A11:2021 — Medical devices — Application of risk management to medical devices. The risk management framework within which EN ISO 10993-1:2025 biological evaluation is conducted.

This post is part of the Technical Documentation & Labeling series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. Biocompatibility is one of the domains where the difference between a smart plan and a default test battery is measured in months and hundreds of thousands of euros. Start with the endpoint matrix, lean on chemical characterization, and only test what the risk assessment actually requires.