Biological evaluation is not a separate compliance packet. It is part of risk management. If the BER and risk file do not speak to each other clearly, reviewers usually see that as a documentation weakness even when the science itself is solid.
The strongest files show how biological hazards were identified, how evidence supports each endpoint conclusion, how residual risk was evaluated, and where those conclusions appear in the risk-management system.
When biological evaluation and risk management are separated too aggressively, the file starts to look fragmented. The BER may contain strong science, but if the risk-management file does not show how that science was used, the submission still feels incomplete.
Why Biological Evaluation Lives Inside Risk Management
ISO 10993-1 explicitly places biological evaluation within the broader risk-management framework. That means endpoint selection, evidence review, waiver logic, and final safety conclusions should all be understood as risk-management activities rather than isolated scientific exercises.
The ISO 14971 Framework and Biological Hazards
Under ISO 14971, hazards need to be identified, risk-estimated, controlled where necessary, and followed through to residual-risk evaluation. Biological hazards are part of that structure. Endpoints such as cytotoxicity, sensitization, irritation, systemic toxicity, hemocompatibility, and genotoxicity should not exist only in the BER narrative. They should also be visible in the risk logic.
- Hazard identification: biological endpoints represent potential harm categories that need recognition in the risk file.
- Risk estimation: probability and severity logic should be supported by the biological evidence available.
- Risk control: material choice, process controls, testing, chemistry, and labeling may all function as biological risk controls.
- Residual risk: the final safety position should reflect what remains after those controls and supporting evidence are considered.
How BER Conclusions Feed the Risk File
The BER is where the evidence is evaluated, but that evidence needs somewhere to land. If the BER concludes that cytotoxicity risk is negligible based on an applicable ISO 10993-5 extract test, or reaches an endpoint-specific genotoxicity conclusion after evaluating chemistry and TRA alongside the other relevant evidence under ISO 10993-3 and the applicable market framework, those conclusions should support the corresponding biological-hazard entries in the risk-management file. ISO 10993-17 and ISO 10993-18 provide important evidence routes; they do not, by themselves, replace the Part 3 endpoint evaluation.
Where Many Technical Files Break Down
A common failure pattern is a polished BER sitting next to a separate risk file with minimal biological detail and no clear cross-reference. The result is that reviewers have to infer the connection themselves. That usually creates avoidable friction and questions about how integrated the evaluation really was.
What Good Traceability Looks Like
- BER to risk file: endpoint conclusions reference the relevant risk-management sections or hazard identifiers.
- Risk file to BER: biological hazards point back to the underlying evaluation sections, test reports, or waiver rationale.
- Consistent terminology: the same endpoint and hazard language is used across the BEP, BER, and risk file.
- Benefit-risk alignment: residual-risk and benefit-risk wording does not contradict the biological evaluation conclusion.
Post-Market Surveillance Still Matters
Risk management does not stop at submission. Post-market inputs such as adverse biological reactions, supplier changes, new literature, or chemistry shifts can all affect whether the biological safety position still holds. That is another reason the biological evaluation should be integrated into the risk-management system rather than treated as a one-time report.
Many files contain a BER and a separate risk-management file with no explicit bridge between them. Reviewers usually expect the integration to be visible, traceable, and bidirectional rather than implied.
Practical Fix for Legacy Files
If the biological evaluation and risk file were written separately, the solution is usually not a full rewrite. It is a focused integration pass: align hazard terminology, add references, reconcile residual-risk language, and make sure the evidence trail is visible from both directions.
Key References
- ISO 14971 risk management for medical devices
- ISO 10993-1 for biological evaluation within a risk-management process
- ISO 10993-3:2026 for evaluation of genotoxicity, carcinogenicity, reproductive toxicity and developmental toxicity; use the licensed final text for clause-level implementation
- ISO 10993-17 and ISO 10993-18 where chemistry and toxicology inform—rather than independently replace—endpoint and residual-risk conclusions
- EU MDR Annex I and FDA biocompatibility guidance where traceability and consistency become review issues
Why this perspective is practical
Arvind Rathore is the founder of MedDev Advisory, where his work focuses on ISO 10993 biological-evaluation strategy and documentation. Before establishing the practice, he was a Marie Skłodowska-Curie Early Stage Researcher at INSERM U1026 Biotis within the ImplantSens network. His research covered implantable electrochemical biosensors, cytotoxicity, oxidative stress, sterilization effects and biomaterial–cell interactions, with research placements in France, Germany and Sweden. Peer-reviewed work in Bioelectrochemistry and Advanced Sensor Research also informs his evidence-led approach. Read more about Arvind Rathore.
Need help aligning your biological evaluation with the ISO 14971 risk-management file before submission?
For the complete risk-and-evidence reasoning framework, explore The Biological Evaluation Strategy Handbook; for a specific file, discuss the project directly.