Device Contact Categories and Exposure Duration Under ISO 10993-1:2025: When to Go Beyond the Tables

One of the most consequential changes in ISO 10993-1:2025 is the restructuring of how devices are categorized for biological evaluation. The single Table A.1 from the 2018 edition has been replaced by four separate tables organized by contact type. At the same time, the standard introduced new rules for calculating exposure duration that will reclassify some devices into higher-risk categories than they were previously assigned. And critically, the tables are now explicitly a starting point for your biological evaluation, not the endpoint.

Getting the categorization wrong has real consequences. Under-categorize your device and your biological evaluation misses endpoints that a reviewer will flag. Over-categorize it and you commit to testing that may not be scientifically justified for your device. Either way, the documentation needs to show the reasoning behind your categorization, not just the result.

What changed from Table A.1 to Tables 1 through 4

In the 2018 edition, Table A.1 was a single matrix that covered all device types, contact categories, and exposure durations in one table. Manufacturers found their device's row based on contact type (surface device, externally communicating, or implant) and contact duration (limited, prolonged, or permanent), then read across to see which biological effects needed evaluation.

The 2025 edition replaced this with four tables, each organized by the type of tissue the device contacts:¹

Table 1: Devices in contact with intact skin. This covers surface-contacting devices like electrodes, wound dressings on intact skin, compression garments, and external monitoring equipment.

Table 2: Devices in contact with mucosal membranes. This covers contact lenses, urinary catheters, endotracheal tubes, dental materials in contact with oral mucosa, and similar devices.

Table 3: Devices in contact with breached or compromised surfaces, or internal tissue. This covers wound dressings on compromised skin, surgical instruments that contact tissue, orthopedic implants, and any device that contacts tissue below the intact skin barrier.

Table 4: Devices in contact with blood. This covers catheters in the cardiovascular system, blood oxygenators, dialysis equipment, vascular stents, and heart valves.

The terms "surface device," "externally communicating device," and "implant device" from the 2018 edition have been removed because they created ambiguity. For example, an externally communicating device could contact mucosa, internal tissue, or blood depending on the specific device, and all three require different biological evaluation approaches. The 2025 categorization by tissue type resolves this by focusing on what the device actually touches rather than how it is constructed.²

How exposure duration is calculated now

The 2025 revision introduced significant changes to how contact duration is determined. The three duration categories remain the same (limited: up to 24 hours, prolonged: more than 24 hours to 30 days, long-term: more than 30 days), but how you calculate the total exposure period has changed.

Any contact on a calendar day counts as a full day

Under the 2025 standard, any portion of a day during which the device contacts the patient counts as one contact day. A device that touches a patient's skin for 15 minutes on Monday is counted as one contact day, the same as a device that remains in place for 23 hours. This simplifies duration calculation and eliminates the ambiguity that arose under the previous standard when manufacturers tried to argue that brief contact periods should not count toward cumulative exposure.³

Intermittent contact

Intermittent contact is defined as contact with an interval of at least 24 hours between consecutive periods of tissue contact. This distinction matters because it changes how you count cumulative exposure.

For example, consider a blood glucose monitoring sensor that is applied to the skin for 14 days continuously, then removed for a day while the patient replaces it with a new sensor. The first sensor had 14 continuous contact days. If the patient uses a new sensor for another 14 days, the total exposure period for that type of device is 28 contact days in a single patient, which crosses the threshold from prolonged into long-term contact. The fact that there was a one-day gap between the two sensor applications does not reset the clock. The total exposure period is the sum of all contact days from first to last use.⁴

Contrast this with a surgical retractor that contacts internal tissue for 45 minutes during a procedure, and the same patient undergoes another procedure three months later using the same type of retractor. This is intermittent contact (well over 24 hours between contacts), and the total exposure is 2 contact days. Unless the device introduces substances that bioaccumulate, this would be categorized as limited contact despite the three-month span between uses.

Bioaccumulation changes the math

The 2025 standard explicitly requires manufacturers to consider whether the device releases substances that bioaccumulate in the body. If a device with limited or prolonged contact releases substances that persist in the patient's body between uses, the biological evaluation may need to treat the device as long-term contact, because the patient's cumulative chemical exposure does not reset between contact periods even though the physical contact does.⁵

For example, a dialysis catheter contacts blood for several hours per session, three times per week. Based on contact days alone, this might be categorized as prolonged contact. But if the catheter releases phthalate plasticizers that accumulate in the patient's tissues between sessions, the biological evaluation needs to account for the cumulative chemical exposure, not just the intermittent physical contact. This could require additional endpoints or more conservative tolerable exposure calculations in the TRA.

When the tables are not enough

The four tables in ISO 10993-1:2025 list the biological effects that should be considered for each combination of contact type and duration. But the standard is clear that these tables are a starting framework, not a comprehensive list of everything your biological evaluation needs to address. There are several situations where your evaluation must go beyond what the tables specify.

When the device contacts multiple tissue types

Many devices contact more than one type of tissue during clinical use. For example, an endotracheal tube contacts mucosal membrane (Table 2) at the oral and tracheal surfaces, and may also contact breached tissue if intubation causes minor mucosal trauma (Table 3). A central venous catheter contacts skin at the insertion site (Table 1), subcutaneous tissue along the tunneled segment (Table 3), and blood at the tip (Table 4). In these cases, the biological evaluation needs to address the requirements from every relevant table, not just the table for the primary contact type. The BER should document which portions of the device fall under which table and evaluate accordingly.

When the device creates conditions not covered by the tables

The tables address biological effects related to material-body interaction. They do not cover every possible biological risk. For example, a device that generates localized heat during operation (like certain laser delivery systems or RF ablation catheters) may create thermal injury risks that are not captured by the standard material-based endpoints. The biological evaluation should identify these risks through the hazard identification process and address them even though they do not correspond to a table entry.

When additional biological effects are triggered

Beyond the endpoints listed in Tables 1 through 4, ISO 10993-1:2025 identifies several biological effects that are required when specific conditions are met but do not appear as standard table entries for most device categories. These include immunotoxicity, neurotoxicity, reproductive and developmental toxicity, and material-mediated pyrogenicity. Each has defined triggers in the standard: neurotoxicity is required when the device contacts nervous system tissue or cerebrospinal fluid, reproductive toxicity is triggered by specific materials, patient populations, or anatomical contact, and immunotoxicity must be considered when material properties are suggestive of immunotoxicological effects. These are not optional considerations. If the trigger conditions apply to your device, the biological evaluation must address them regardless of what the tables indicate for your contact category.

When clinical data or post-market surveillance reveals unexpected effects

If clinical experience with the device or similar devices has revealed biological effects that are not predicted by the table-based evaluation, the BER needs to address those effects. For example, if post-market surveillance for a class of silicone breast implants revealed an association with a rare lymphoma (BIA-ALCL), the biological evaluation for a new silicone implant needs to address that risk even though the standard tables do not include a specific endpoint for it. The tables tell you the minimum. Clinical evidence can tell you there is more to evaluate.

When foreseeable misuse changes the contact category

The 2025 standard explicitly requires consideration of reasonably foreseeable misuse. If a device intended for limited skin contact is frequently left in place longer than the manufacturer's instructions (a foreseeable misuse scenario), the biological evaluation should consider the biological effects associated with the longer exposure duration, not just the intended duration. For example, a transdermal drug delivery patch labeled for 24-hour use but commonly left in place for 48 to 72 hours (documented through post-market surveillance or clinical literature) would need evaluation for the prolonged contact endpoints, not just the limited contact endpoints.⁶

When the standard says "unless otherwise justified"

Several entries in Tables 1 through 4 include the qualifier "unless otherwise justified." This means the biological effect should be evaluated unless the manufacturer provides a documented scientific rationale for why it is not applicable to their specific device. This is not a blanket exemption. "Unless otherwise justified" means you need a device-specific justification that explains why the risk does not apply, references relevant data, and is traceable to your hazard identification. A statement like "this endpoint is not applicable" without supporting rationale will not satisfy a reviewer.

Common categorization mistakes

Categorizing by the device instead of by the tissue contact. A manufacturer categorizes their device as "Table 1 - intact skin" because the device is worn on the body, without considering that part of the device also contacts mucosal membrane or breached skin. Each contact interface needs its own evaluation against the appropriate table.

Calculating duration from a single use rather than cumulative exposure. A reusable surgical instrument is categorized as limited contact because each procedure is less than one hour. But the instrument is used on the same type of patient repeatedly, and the manufacturer does not assess whether the cumulative contact days across a patient's treatment course (for example, multiple debridement sessions on a chronic wound patient) could move the device into prolonged contact territory.

Ignoring bioaccumulation for intermittent contact devices. A device with genuinely intermittent contact (more than 24 hours between uses) is categorized based on contact days alone, without assessing whether any released substances persist in the body between uses. If they do, the effective chemical exposure is continuous even though the physical contact is intermittent.

Treating the tables as a pass/fail checklist. A manufacturer evaluates every endpoint listed in the relevant table, receives passing results, and concludes the biological evaluation is complete. But the tables are the starting framework, not the complete scope. If the manufacturer's own hazard identification or clinical evidence suggests additional risks beyond what the tables list, those risks need to be addressed in the biological evaluation regardless of the table content.

What the documentation needs to show

The BEP and BER need to document the categorization reasoning, not just the result. This means identifying the specific tissue types the device contacts, explaining how the total exposure period was calculated (including whether contact is daily, intermittent, or continuous), documenting whether bioaccumulation was considered and what the conclusion was, and justifying any cases where the evaluation goes beyond or falls short of what the tables indicate.

For devices that fall into multiple tables or have complex exposure scenarios, the documentation should make the reasoning visible enough that a reviewer can follow the logic from the device description to the contact categorization to the selected biological effects to the evaluation strategy. If any of those connections are missing or implicit, the reviewer will ask for clarification.

If your biological evaluation documentation includes device categorization and you want to verify that it accurately reflects the 2025 requirements before submission, request a gap analysis or get in touch to discuss your package.