ISO 10993-17: What the standard has changed and now requires from manufacturers

The ISO 10993-17 standard is part of the ISO 10993 series of standards on biocompatibility. ISO 10993-17 describes the procedures for Toxicological Risk Assessment.

In the fall of 2023, a comprehensive standard revision was published after over 20 years.

Medical device manufacturers should know,

• when they have to comply with ISO 10993-17,
• what the standard requires,
• what the current changes are, and
• when and how they should implement these changes.

This article will help.

1. Context of ISO 10993-17

1.1 The concept of Toxicological Risk Assessment

Toxicological Risk Assessment (TRA) is an essential component of the biological evaluation. It is used to identify potential health risks and evaluate them by determining limit values and estimating exposure.

Health risks can arise from

• leachable substances (from the material itself),
• impurities (e.g., from the production of the medical device), or
• degradation products

that enter the human body from the medical device.

The Toxicological Risk Assessment is a prerequisite within the evaluation of biocompatibility according to ISO 10993-1 in order to ensure the legally required patient safety when using medical devices.

1.2 The regulatory requirements

The MDR formulates the legal requirements as follows:

Devices shall be designed, manufactured and packaged in such a way as to minimise the risk posed by contaminants and residues to patients, taking account of the intended purpose of the device, and to the persons involved in the transport, storage and use of the devices. Particular attention shall be paid to tissues exposed to those contaminants and residues and to the duration and frequency of exposure.

MDR, Annex I, Part 10.2

ISO 10993-1, for example, refers to the need for Toxicological Risk Assessment:

Adequate risk assessment requires characterization of toxicological hazards and exposures, as well as other potential biological responses to medical devices.

ISO 10993-1, Section B.2.1

1.3 Terms and abbreviations

This article uses many concepts and definitions from ISO 10993-17. Here is an overview:

TCL	Tolerable Contact Level	Estimation of surface contact exposure to an identified constituent that does not cause significant irritation
TI	Tolerable Intake	Estimation of daily exposure to an identified constituent over a period of time (e.g., acute, subacute, subchronic or chronic) based on the body mass considered to be of no health concern
POD	Point of Departure	Low point on a toxicological dose-response curve established on the basis of experimental or observational data. Various values can be considered as POD, such as the low reference dose value, the lowest observed adverse effect, the minimum irritation or a value with no irritation or no observed adverse effect
EEDmax	Worst-case exposure dose per kilogram of body weight	The exposure dose describes the amount of a constituent that comes/can come into contact with the body via an exposure route during a certain period of time
MoS	Margin of Safety	Ratio between the tolerable contact level of the constituent (numerator) or the tolerable intake (numerator) and the exposure dose (denominator)
TTC	Threshold of toxicological concern	Exposure level below which there is no significant risk to human health

1.4 Buy ISO 10993-17

You can find the English version of ISO 10993-17:2023 for around EUR 30 on the evs.ee website.

2. Toxicological Risk Assessment procedure

2.1 Overview

Before the actual Toxicological Risk Assessment (TRA), the manufacturer must identify the constituents of the medical device the patient may be exposed to during clinical use. In doing so, the manufacturer should proceed in accordance with the requirements of the sister standard ISO 10993-18.

Only then does the actual TRA (scope of ISO 10993-17) take place, which can be divided into three steps (see Fig. 1):

1. Identification of hazards that may arise from the identified constituents of the medical device
2. Risk assessment including
   • Determination of the tolerable contact level or intake (alternative: Toxicological Threshold of Concern: TTC)
   • Estimation of the exposure dose (worst-case approach)
   • Derivation of the Margin of Safety (MoS)
3. Risk evaluation: The final step is the evaluation of the toxicological risk based on the identified hazards, the tolerable contact level or tolerable intake and the estimated exposure dose for each constituent. The risk estimates are compared with the acceptance criteria to derive possible gaps or residual risks.

In all steps of the TRA, manufacturers should consider the characteristics of the medical device to be evaluated and its clinical use:

• materials used
• type of use, e.g., cumulative use with new device
• contact type of exposure, e.g., skin
• exposure duration, e.g., chronic
• patient group, e.g., children
• dimension/contact area and number of medical devices in use
• uncertainty factors for the use of data from the literature

2.2 Pre-assessment: Identification of the constituents

In order to assess toxicological hazards, the manufacturer must identify the constituents that may be released during the clinical use of their medical device. This is done by means of a comprehensive material characterization of the medical device parts with direct and/or indirect patient contact.

Information on all constituents of the materials used is usually missing. A chemical analysis must then be carried out on the final medical device in accordance with ISO 10993-18. The clinical application is simulated by selecting a suitable extraction method, e.g., by taking into account the contact surfaces, contact type and contact duration.

A large number of unidentifiable substances complicates the TRA and can lead to residual risks that may result in further investigations.

2.3 The actual TRA

Step 1: Identification of hazards

Once the manufacturer knows the constituents that may be released, the first step is to assess them:

• Do these constitutents need to be considered for the clinical use of the device?
• Do they pose any hazards?

The new version of the standard allows a Toxicological Screening Limit (TSL) to be used for this assessment. A TSL is used to evaluate the cumulative exposure dose of an constituent over a period of time and determine whether it poses a negligible toxicological risk. If the maximum exposure dose is below the specified TSL, no further risk assessment for systemic harm is necessary.

To identify the hazards posed by the substance released from the medical device, the first step is to collect and evaluate toxicological data on the substance (database research). Consideration of the clinical use and the quality of the data are important here:

• consideration of the identified endpoints based on categorization of the medical device according to ISO 10993-1
• consideration of the route of exposure, e.g., skin, oral intake, inhalation
• assessment of the quality of the data, e.g., by stating the guideline according to which the study was conducted

As an output of this step, the manufacturer knows the hazards of the identified constituent based on the available toxicological data from the literature.

Step 2: Risk assessment

The second step is the risk assessment. The manufacturer weighs up two things:

• the tolerable intake for the type of contact and duration
• the worst-case maximum exposure during use of the device

This requires several calculation steps.

a) Calculation of the Tolerable Contact Level or Tolerable Intake

The Tolerable Contact Level or Intake of the identified constituent is determined. The Tolerable Contact Level TCL or the Tolerable Intake TI is calculated. These describe the dose-response relationship of the constituent, i.e., the dose above which a toxicological effect is possible.

The collected toxicological data form the basis for the correct determination of TCL/TI. They provide the information up to which the exposure value of the contact or intake of the constitutent is assessed as safe.

This information is referred to as the Point of Departure (PoD). The following are possible:

• toxicological limit values of the constituent (e.g., the No Adverse Effect Level, NOAEL)
• data of a chemical surrogate (with justification and uncertainty factor)
• in silico data (e.g., use of TTC values of the Cramer Classes)

A conservative approach is recommended when determining TCL/TI. To this end, the manufacturer should take additional uncertainty factors into account (Modifying Factors, MF). These factors describe uncertainties arising from the transmission of data with different initial parameters:

Uncertainty factor	Explanation, example
Intraspecies variation	Consideration of variations within the human population with regard to biological uptake, metabolism, tissue distribution, excretion, and tolerance of substances
Interspecies variation	Are data from studies with humans available or are they animal studies? Consideration of extrapolation of data from animal studies to humans
Quality of the data	If the data from studies are carried out in accordance with the relevant guidelines and GLP (Good Laboratory Practice), it can be assumed that the data is of good quality.
Quality of the study	Data are available for a different route or duration of exposure
Exposure route and duration	If, for example, data from short-term studies are used for long-term exposure, this must be taken into account via safety factors.
Limit values	The use of limit values such as Low Adverse Effect Level (LOAEL) instead of No Adverse Effect Level (NOAEL) must be taken into account.

Alternatively, manufacturers may choose a Toxicological Threshold of Concern (TTC) for the substance if little or no toxicological data is available. The TTC is a value below which the risk of harm is considered negligible.

b) Estimation of the exposure dose

The next step is calculating each constituent’s estimated worst-case exposure dose (EED_max). Various factors are taken into account:

• bioavailability of the substance
• size and materials of construction of the medical device
• intended use
• route of exposure
• patient population
• duration and frequency of use

c) Derivation of the Margin of Safety (MoS)

A further step is required for the risk assessment: the calculation of the Margin of Safety (MoS) and, thus, the representation of the acceptability of the toxicological risk.

The MoS is determined by comparing the estimated exposure dose with the Tolerable Contact Level (TCL) or Tolerable Intake (TI). An MoS value > 1 indicates a low toxicological risk.

Step 3: Risk evaluation

In the third step, the manufacturer decides on risk acceptance based on the criteria previously defined in accordance with ISO 14971 and ISO 10993-1. These criteria determine whether the estimated risk is acceptable or whether further measures are required.

Suppose the acceptance criteria are not met, for example, because the exposure to a constituent is too high. In that case, the manufacturer must further investigate the toxicological risk and determine additional risk reduction measures.

Additional tests can be carried out as a follow-up activity, the output of which enables a more precise evaluation and the exclusion of risks.

3. Practical tips: What you should look out for in the TRA

Tip 1: Involve all data

Involve all data from the clinical use in the analysis. This includes:

• number and dimensions of devices per application
• patient group
• contact duration (cumulative, if applicable)
• type of contact

These points are important in order to be able to realistically assess the risks from released constituent when using the medical device and to address the endpoints in accordance with ISO 10993-1.

Tip 2: Sensible chemical characterization

Select a sensible analysis and parameters for chemical characterization, as this usually provides the main input for the toxicological assessment.

The derivation of the selected method should be based on the clinical use of the medical device and, at the same time, fulfill the requirements of ISO 10993-18. In this way, you avoid additional work by evaluating constituents that would not be released in the actual application.

Tip 3: Pay attention to the quality of toxicological data

Pay attention to the quality of the toxicological data used and document it. Animal studies are carried out in accordance with toxicological guidelines such as OECD and quality management systems such as GLP. Data from such studies can be classified as qualitatively appropriate and are suitable for the derivation of limit values.

Tip 4: Consider clinical use

When deriving limit values, always pay attention to your medical device’s clinical application and consider this. In particular, you should know the exposure routes, as these have an influence on the limit values.

Tip 5: Estimate conservatively

Always use a conservative approach to ensure patient safety.

Tip 6: Involve experts

Involve experts in planning the biocompatibility tests and have them carry out the Toxicological Risk Assessment. Benefit from their experience when assessing the toxicological data. A lack of experience on the part of the assessors can lead to audit deviations, as this is a requirement of the standard.

4. The new ISO 10993-17:2023

a) The changes

An update to ISO 10993-17, which had been in force for over 20 years, was published in the fall of 2023. This means that the oldest standard in the ISO 10993 family, which was valid from 2002 to 2023, has undergone a significant revision.

The standard now no longer only deals with the definition of permissible limit values for substances but also describes how to carry out the toxicological assessment of a medical device constituent. The title of the standard has been adapted accordingly. The length of 65 pages can also be explained by the fact that the new version contains numerous examples.

Other new features include:

• comprehensive description of the process with calculation examples for determination of Tolerable Intake (TI), Tolerable Contact Level (TCL), and worst-case exposure estimation based on body weight (EEDmax)
• implementation of approaches to reduce the assessment effort: TSL (Toxicological Screening Limit) and TQmax (total quantity released)
• selection of the initial value POD (Point of Departure) and use of uncertainty factors with specification of “default” values
• implementation of the Margin of Safety (MoS) as a calculation parameter specific to the endpoint
• explanations of the documentation effort (e.g., justifications for selection of the POD or uncertainty factors)
• removal of the Tolerable Exposure (TE) concept. Clinical application is now involved via exposure assessment.

b) The consequences

Good news: Toxicological Risk Assessment that were prepared for medical devices on the market before the revised standard came into force do not need to be adapted to the new requirements.

Nevertheless, check that your documentation is up to date and complete. Toxicological data on substances must be up to date. There may be changes to materials, suppliers, or the production process, new data, or relevant feedback from the market that need to be evaluated.

c) The FDA also plays along

The FDA lists the new ISO 10993-17 edition as a “Recognized Standard”.

5. Summary and conclusion

The current edition of ISO 10993-17 introduces far-reaching changes. In particular, it describes a process for Toxicological Risk Assessment and supports readers with many examples.

The Toxicological Risk Assessment process consists of a total of three steps:

• identification of hazards
• risk assessment
• risk evaluation

Manufacturers who do not yet comply with the latest version of the standard should check that their documentation is up to date and complete (see chapter 4b).

---

Change history

• 2024-03-02: Reference to the recognition as a Recognized Standard by the FDA added in chapter 4.c)
• 2024-02-13: First version of the article created