Biological Hazards, Hazardous Situations, and Harms: What Your BER Needs to Get Right

The 2025 revision of ISO 10993-1 deliberately aligns biological evaluation with the risk management terminology from ISO 14971. The standard now explicitly uses the terms "biological hazard," "biologically hazardous situation," and "biological harm" and expects manufacturers to identify, connect, and document all three as part of their biological evaluation.¹

This is not a cosmetic change. The previous edition framed biological evaluation primarily around endpoints and testing. The 2025 edition frames it as a risk management activity. The distinction matters because reviewers are no longer just checking whether you tested for the right endpoints. They are checking whether you identified the biological hazards associated with your device, described the circumstances under which those hazards could result in patient exposure, and assessed the potential harms that could follow.

Getting these three concepts right in your BER is where many manufacturers struggle, and where notified body questions are increasingly focused.

The definitions and why they matter

A biological hazard is a potential source of biological harm. It exists as an inherent property of the device, its materials, or its manufacturing process. For example, a nickel-containing alloy in a surgical implant is a biological hazard because nickel is a known sensitizer. The hazard exists regardless of whether any patient is ever exposed to it. It is a property of the material, not an event.²

A biologically hazardous situation is a circumstance in which a patient or user is actually exposed to a biological hazard. The nickel-containing alloy becomes a biologically hazardous situation when the implant is placed in contact with tissue and nickel ions leach from the device surface into surrounding tissue. The hazard (nickel as a sensitizer) has become a situation (patient tissue exposed to nickel ions). This distinction matters because some hazards never lead to hazardous situations under normal clinical conditions, and your BER needs to explain why.³

Biological harm is the actual injury or damage to health that results from exposure to the hazard. In this example, the biological harm would be a type IV hypersensitivity reaction (contact dermatitis or, in the case of an implant, localized inflammation, pain, or implant loosening). Not every hazardous situation results in harm. Whether harm occurs depends on factors like the dose, the duration of exposure, the patient's individual susceptibility, and the effectiveness of any risk controls in place.⁴

Where BERs commonly fall short

The most frequent documentation failure is not that manufacturers fail to identify hazards. Most BERs list relevant biological hazards somewhere in the document. The problem is that the hazards are listed without the connecting logic that ties them to specific hazardous situations and specific potential harms. The reviewer sees a list of hazards but cannot trace the path from hazard to patient exposure to potential injury.

Hazards without hazardous situations

A BER identifies "residual ethylene oxide (EO) from sterilization" as a biological hazard. This is correct. But the document never describes the hazardous situation: how is the patient exposed to the residual EO? Through direct tissue contact with the device surface? Through inhalation of off-gassing during package opening? Through systemic absorption from a device implanted in contact with blood? Each of these is a different hazardous situation with different exposure characteristics, different duration, and different potential harms. A reviewer who sees "residual EO" listed as a hazard but no description of the exposure pathway will ask for clarification, because without the hazardous situation, it is not possible to assess the risk.

Hazardous situations without severity and probability

A BER describes a hazardous situation: "patient tissue is exposed to extractable compounds from the device's silicone housing during prolonged implantation." This is a well-defined hazardous situation. But the document then jumps directly to the TRA results without first establishing the potential harms, their severity, or the probability of occurrence. The 2025 standard expects the biological evaluation to estimate risk using ISO 14971 methodology, which means assigning severity and probability to each identified harm. A BER that identifies hazardous situations but skips the risk estimation step will draw questions about whether the biological evaluation is actually integrated with the risk management process.

Harms described generically

A BER states that the potential biological harm from extractable compounds is "toxicity." This is too broad to be useful. What kind of toxicity? Acute systemic toxicity from a bolus release of a high-concentration leachable? Chronic toxicity from cumulative low-dose exposure over the device's implant life? Local tissue irritation at the device-tissue interface? Each of these is a different harm with a different severity level, different probability of occurrence, and potentially different risk control measures. Using medically precise terminology (from sources like the MedDRA dictionary) to define potential harms makes the risk assessment more defensible and helps reviewers understand exactly what was evaluated.⁵

Examples: what is and is not a hazardous situation

One of the harder conceptual distinctions in biological evaluation is recognizing when a hazard exists but a hazardous situation does not. This matters because if no hazardous situation exists, there is no patient exposure, and therefore no biological risk to assess. Documenting this reasoning in your BER is important because it justifies why certain hazards were identified but did not require testing or further evaluation.

Hazard present, no hazardous situation

A polycarbonate housing contains bisphenol A (BPA) as a residual monomer. BPA is a known endocrine disruptor and a biological hazard. However, the device is an external monitoring device that contacts only intact skin for periods of less than 24 hours. Extraction studies under simulated clinical conditions showed no detectable BPA migration above the analytical evaluation threshold. In this case, the biological hazard (BPA in the material) exists, but the biologically hazardous situation (patient exposure to BPA at a biologically relevant dose) does not occur under the intended use conditions. The BER should document the hazard, reference the extraction data that demonstrates no clinically relevant exposure, and conclude that no hazardous situation arises. This is a justified exclusion, not a gap.

A titanium implant contains trace aluminum from the alloy (Ti-6Al-4V). Aluminum is a documented neurotoxin at high doses, making it a biological hazard. However, the device is an orthopedic implant with no contact with neural tissue, and the release rate of aluminum ions from the passivated titanium alloy surface has been extensively characterized in published literature and shown to be well below established tolerable intake values. The hazard exists (aluminum in the alloy), but the hazardous situation (patient neural tissue exposed to neurotoxic doses of aluminum) does not arise because the exposure route, dose, and target tissue do not align. The BER documents this with reference to the specific alloy composition, published corrosion data, and tolerable intake calculations.

Hazard present, hazardous situation exists, but harm does not necessarily follow

A urinary catheter made from PVC contains the plasticizer DEHP. DEHP is classified as a CMR substance (reproductive toxicant) under EU regulations, making it a biological hazard. The device contacts mucosal membrane for prolonged duration (greater than 24 hours), and extraction studies confirmed DEHP leaches from the catheter surface at quantifiable levels. This is a biologically hazardous situation: the patient is exposed to a known reproductive toxicant through mucosal contact. However, whether biological harm actually occurs depends on the dose relative to the patient's tolerable exposure, the duration of use, and the patient population (for example, the risk considerations are different for a neonatal patient versus an elderly patient). The BER must document the hazard, the hazardous situation, the exposure data, and the risk assessment demonstrating that the exposure level is below the tolerable intake for the intended patient population, or, if it is not, what risk controls are in place (such as labeling restrictions or material substitution).

A wound dressing releases trace amounts of a colorant additive. The colorant was identified as an extractable in E&L testing above the AET. This is a biological hazard and a biologically hazardous situation exists (the patient's wound bed is exposed to the colorant through direct contact with compromised tissue). Whether biological harm occurs depends on the toxicological profile of the specific colorant, the quantity released per exposure, and the duration of use. The TRA evaluates the margin of safety. If the MOS is adequate, the BER documents that the hazardous situation was identified, the risk was assessed, and the residual biological risk is acceptable. If the MOS is inadequate, the BER must document what risk controls were implemented.

Hazard present, hazardous situation exists, harm is probable without controls

A device sterilized with ethylene oxide has EO residual levels that exceed ISO 10993-7 limits. EO is a known mutagen and carcinogen. The device is implanted in direct contact with tissue. The hazardous situation is clear (patient tissue exposed to mutagenic and carcinogenic residuals above established limits), and biological harm (genotoxic effects, potential carcinogenic effects) is probable without additional risk controls. This is not a documentation problem to justify away. It requires either reducing EO residuals through process changes until they meet ISO 10993-7 limits, or implementing alternative sterilization methods. The BER documents the hazard, the hazardous situation, the identified harm, and the risk control measures taken to reduce the residual risk to an acceptable level.

What triggers notified body questions

Notified body reviewers are trained to look for the complete chain from hazard through hazardous situation to harm. When questions come back, they typically fall into these categories:

"The biological hazards have not been sufficiently identified." This usually means the BER listed hazards generically (e.g., "chemical hazards from device materials") without identifying specific hazards tied to the device's actual material composition, manufacturing processes, and sterilization method. The reviewer expects to see hazards identified at the level of specific substances or specific material interactions, not broad categories.

"The relationship between identified hazards and biological endpoints has not been established." This means the BER identified hazards and separately listed the endpoints that were tested, but never connected the two. For example, the BER identified extractable compounds as a hazard and reported that cytotoxicity testing was performed, but never explained which specific hazard the cytotoxicity test was intended to address, or why cytotoxicity was the appropriate endpoint for that particular hazard. The 2025 standard expects each evaluated endpoint to be traceable back to an identified biological hazard.

"The risk assessment does not include severity and probability estimation for identified biological harms." This means the BER identified hazards and hazardous situations but treated the risk assessment as a pass/fail exercise (test passed, therefore safe) rather than estimating the severity and probability of the potential harms. The alignment with ISO 14971 means that a biological evaluation is expected to include quantitative or semi-quantitative risk estimation, not just a binary "the test passed" conclusion.

"Foreseeable misuse scenarios have not been considered in the hazard identification." This is a new requirement in the 2025 revision. The BER identified hazards and hazardous situations for the intended use conditions but did not consider what happens under reasonably foreseeable misuse. For example, a device intended for 24-hour skin contact was not evaluated for the hazardous situation that arises when a patient leaves the device in place for 72 hours, which is a foreseeable misuse scenario that changes the exposure duration and potentially the biological risk profile.

How to structure the documentation

There is no single required format for documenting biological hazards, hazardous situations, and harms in a BER. But the documentation needs to make the chain visible and traceable. Reviewers should be able to follow the logic from any identified hazard to the hazardous situation it creates (or the justification for why it does not create one), to the potential harm, to the risk estimation, to the risk control, and to the residual risk assessment.

Some manufacturers use a tabular format where each row traces a single hazard through the complete chain. Others integrate the analysis into the narrative sections of the BER. Either approach works as long as the connections are explicit and traceable. What does not work is listing hazards in one section, endpoints in another section, and test results in a third section with no documented relationship between them.

The BER should also explicitly reference the risk management file (per ISO 14971) and demonstrate that the biological hazards identified in the biological evaluation are consistent with the hazards identified in the broader risk analysis. If the risk management file identifies a biological hazard that does not appear in the BER, or vice versa, a reviewer will ask why. Consistency between these two documents is a frequent source of questions during notified body review.

If your BER treats hazard identification as a checklist exercise rather than a device-specific risk analysis, or if the connections between hazards, hazardous situations, and harms are not explicitly documented, your documentation is likely to generate questions during review. If you want to check whether your biological evaluation documentation gets this chain right before submission, request a gap analysis or get in touch to discuss your package.