Medical device manufacturers face a blunt regulatory reality: proving a product is safe for patient contact is no longer a matter of animal studies alone. Modern biocompatibility programs lean heavily on chemistry-based evaluation, and the keystone document for interpreting that chemistry data is ISO 10993-17. The ISO 10993-17 toxicological risk assessment translates extractables and leachables data into a defensible claim of patient safety. Get it right and your submission sails through; get it wrong and you will absorb months of deficiency letters.
This guide walks through the 2023 revision of ISO 10993-17, explains the core concepts regulators expect you to master, and maps out a six-step workflow your team can apply to any device programme.
What ISO 10993-17 actually covers
ISO 10993-17:2023 (Toxicological risk assessment of medical device constituents) replaced the 2002 edition and brought the standard into alignment with modern chemical characterization practice. It sets the methodology for deriving exposure-based limits for every identified chemical constituent that can migrate from a device into the patient. In practical terms, ISO 10993-17 is how you convert a list of extractables from ISO 10993-18 into a risk conclusion regulators will accept.
The standard is not a shortcut around animal testing. It is the quantitative framework that tells you when additional biological testing is warranted and when chemistry alone is sufficient. FDA’s 2023 biocompatibility guidance and the EU MDR both cite ISO 10993-17 as the expected methodology for chemical-based safety evaluation.
Core concepts you must master
Analytical Evaluation Threshold (AET)
The AET is the concentration below which an extractable is considered too low to warrant toxicological evaluation. It is derived from the Dose-Based Threshold (DBT) using an uncertainty factor (often 1 or 0.5) and the clinical exposure. The 2023 revision clarifies how to set the AET for leachables studies on permanent-contact implants versus short-term devices, a change that reshaped many existing dossiers.
Tolerable Intake (TI)
Tolerable Intake is the amount of a constituent that can be absorbed daily without appreciable risk. TI is derived from a point of departure (NOAEL, BMD, TTC) divided by uncertainty factors covering interspecies, intraspecies, subchronic-to-chronic extrapolation, and severity of endpoint. ISO 10993-17 points to the same uncertainty-factor logic used by EMA and ICH Q3C, which makes the derivation scrutable across agencies.
Margin of Safety (MoS)
MoS is the ratio of Tolerable Intake to estimated patient exposure. A ratio of 1 or higher is the pass criterion; regulators expect ratios well above 1 for permanent contact categories. The MoS is the single number reviewers look for first, so your dossier should surface it prominently.
The six-step ISO 10993-17 toxicological risk assessment workflow
Step 1: Chemical characterization
Before TRA begins, you need extractables data generated under ISO 10993-18. The extraction conditions must bracket or exaggerate clinical use. Your chemistry lab should provide a compound list with concentrations, identification confidence (Level 1-4 per AAMI TIR 106), and molecular information sufficient for structure-based hazard evaluation.
Step 2: Set the Analytical Evaluation Threshold
Calculate the AET for each analytical technique using the patient’s clinical dose and the DBT appropriate to your contact category. Non-volatile AET, volatile AET, and semi-volatile AET will all differ. Any extractable detected above its AET must enter the TRA; below AET it can be dismissed with documented justification.
Step 3: Identify and quantify extractables
Work with your analytical chemists to resolve identity. Unknown compounds above AET cannot be dismissed, they require either further identification or a conservative Threshold of Toxicological Concern (TTC) treatment per Cramer class III. Our Toxicology Monographs provide verified identification and hazard data for more than 7,200 compounds commonly seen in extractables studies.
Step 4: Derive a Tolerable Intake for each compound
This is where the ISO 10993-17 toxicological risk assessment becomes real work. For each identified extractable you need either a published PDE/ADI, a regulatory limit (ICH Q3C, EMA), or a de novo derivation from toxicity data. When data are sparse, read-across from a structurally similar compound is allowed under ISO 10993-17 §6.3. See our Read-Across Assessment method for a defensible approach.
Step 5: Calculate the Margin of Safety
Estimate patient exposure from leachables data (or extractables if a leachables study is not required) using the clinical dose regime. Divide the TI by the estimated exposure. Document the assumptions, body weight, duration, simultaneous exposure route, because reviewers will test them.
Step 6: Report and justify
The TRA report is not a spreadsheet. It must narrate the study design, justify AET selection, document identification confidence, present the MoS for every constituent, and explicitly conclude on residual risk. Regulatory reviewers expect an audit trail from raw chromatogram to risk conclusion.
Common pitfalls to avoid
Pitfall 1: Using the wrong contact category. Permanent-contact implants and limited-contact devices have dramatically different AETs. A mismatch here invalidates the entire risk assessment.
Pitfall 2: Ignoring carcinogenic and mutagenic endpoints. ICH M7 thresholds for DNA-reactive compounds are much lower than the Cramer-class TTC. Treating a mutagen with a standard TTC is a common deficiency letter trigger.
Pitfall 3: Unknowns above AET left unresolved. Every unidentified extractable above its AET must be either identified or conservatively evaluated. Regulators will not accept “not detected in library” as a dismissal.
Pitfall 4: Weak read-across justification. Read-across is powerful but scrutinised. Document the structural similarity, toxicokinetic similarity, and mechanism-of-action concordance, the three pillars the EMA read-across framework expects.
Pitfall 5: No narrative synthesis. A TRA that presents tables without a risk narrative leaves reviewers guessing. Write the conclusion first, then let the data support it.
When is a leachables study required on top of extractables?
A common misunderstanding is that extractables data always suffice. ISO 10993-17 does not make that assumption. For long-term and permanent-contact devices, particularly implants in contact with blood or cerebrospinal fluid, regulators expect a leachables study that reproduces clinical exposure conditions. The ISO 10993-17 toxicological risk assessment uses leachables data to refine the worst-case estimate produced by extractables and to confirm that migration into the patient remains within the Tolerable Intake budget.
Decision triggers for a leachables study include: extractable concentrations close to the AET, compounds with narrow therapeutic windows, devices intended for paediatric use, and any constituent flagged as a potential DNA-reactive impurity under ICH M7. The FDA biocompatibility guidance is explicit that leachables may be required even when extractables are below AET if the clinical dose pushes cumulative exposure above the TI.
Building a leachables protocol that actually satisfies ISO 10993-17 toxicological risk assessment expectations is not a trivial exercise. Simulation media, temperature, contact time, and replicate strategy all need defensible choices tied to the intended clinical use. The chemistry lab you partner with should have a documented approach for justifying these parameters to notified bodies.
How ToxLibrary supports your TRA program
A defensible ISO 10993-17 toxicological risk assessment depends on two inputs: quantitative chemistry data and trustworthy toxicology references. ToxLibrary provides the second. Our compound profiles cover PDEs, derivation histories, and mechanism-of-action flags for over 7,200 compounds seen in E&L studies. When you need a Tolerable Intake for a compound without a published PDE, our Read-Across Assessment service builds the derivation with the documentation regulators expect.
For an orientation to the broader chemistry behind device safety, our earlier guide to chemical compounds and their effects gives the foundational context non-toxicologists on your team need.
If you are building or reviewing a TRA dossier and want a second pair of eyes, reach out. Thirty years of medical device toxicology experience across E&L, biocompatibility, and regulatory review stand behind every assessment we deliver.
