Biocompatibility and Cybersecurity Standards for Medical Devices in Australia

Updated: 2026-11-11 · GRZAN Regulatory Team · Verification date 2026-10-20

1. Key takeaways

Australia has no harmonised standards list of the European kind. The statutory standards are limited to ISO 13485:2016 and the sterilisation and packaging ISO standards listed in the schedules of the Therapeutic Goods (Conformity Assessment Standard for Quality Management Systems) Order 2019; standards for biocompatibility, the software lifecycle and similar topics are “state of the art” references and are not statutory standards. Cybersecurity, by contrast, is written into Essential Principle clause 12.1.

The statutory quality management system standard is ISO 13485:2016 under the CASO 2019 (F2019L00426), authorised by section 41DC of the Therapeutic Goods Act 1989.
Schedule 2 of the CASO lists sterilisation and packaging ISO standards, including ISO 11607-1/2:2019, ISO 17665-1:2006, ISO 17664:2017, ISO 20857:2010, ISO 25424:2018 and ISO 18362:2016.
Essential Principle clause 12.1 has covered cybersecurity, data and information management, and development, production and maintenance requirements since 25 February 2021, operating as a clarification of existing requirements rather than a new requirement; clause 13B on software version and build numbers was added at the same time.
The TGA states that IEC 62304 (software lifecycle processes) and IEC 62366 (usability engineering) represent the state of the art, and that the design control requirements of IEC 62304 apply regardless of whether a Schedule 3 Part 1 or Part 4 certificate is held (TGA guidance, 23 September 2024).
No TGA guidance dedicated to biocompatibility or ISO 10993, nor its publication date, has been found (practical estimate, pending verification); the TSE guidance of 2 October 2024 can be referenced for substances of animal or microorganism origin, but it cannot substitute for an ISO 10993 guideline.

2. Legal basis

Therapeutic Goods (Conformity Assessment Standard for Quality Management Systems) Order 2019 (Therapeutic Goods (Conformity Assessment Standard for Quality Management Systems) Order 2019), registered as F2019L00426; authorised by section 41DC of the Therapeutic Goods Act 1989; signed on 26 March 2019, registered and effective on 27 March 2019, with the full text applying from 31 March 2019; operative provisions in sections 5–6 and Schedule 1 and Schedule 2.

Schedule 1 is ISO 13485:2016, with three variants corresponding respectively to Schedule 3 Part 1 clause 1.4, Part 4 clause 4.4 and Part 5 of the Therapeutic Goods (Medical Devices) Regulations 2002. Schedule 2 lists sterilisation and packaging ISO standards (including ISO 11607-1/2:2019, ISO 17665-1:2006, ISO 17664:2017, ISO 20857:2010, ISO 25424:2018, ISO 18362:2016 and others).

Cybersecurity: Essential Principle Schedule 1 clause 12.1 expressly covers cybersecurity, data and information management, and development, production and maintenance requirements; since 25 February 2021 this has operated as a clarification of existing requirements rather than a new requirement; clause 13B (software version and build numbers) was added at the same time.

Software lifecycle standard positioning: the TGA states that IEC 62304 (software lifecycle processes) and IEC 62366 (usability engineering) represent the state of the art; the design control requirements of IEC 62304 are unrelated to whether a Schedule 3 Part 1 or Part 4 certificate is held (TGA guidance, 23 September 2024).

Names and dates of relevant TGA guidance: Complying with medical device cyber security requirements (2 October 2025); Complying with identification requirements for medical devices that contain software (18 October 2024); Demonstrating evidence to comply with the Essential Principles (20 November 2025); Essential Principles checklist (10 September 2025).

Practical estimate: no TGA guidance dedicated to biocompatibility or ISO 10993, nor its publication date, has been found (pending verification); for substances of animal or microorganism origin, the TGA guidance Transmissible Spongiform Encephalopathies (TSE): TGA approach to minimising the risk of exposure (2 October 2024) may be referenced, but it cannot substitute for an ISO 10993 guideline.

3. Expert insights

Insight 1: importing the European mindset of presumption of conformity with harmonised standards into Australia creates pitfalls. Australia’s statutory standards are limited to those scheduled in the CASO 2019, and all other standards belong to the state of the art. This means that citing ISO 10993 cannot support a claim of presumed conformity with the Essential Principles; it must instead be used to demonstrate that the state of the art has been reached.

Insight 2: cybersecurity is an Essential Principle clause, not supplementary guidance. Clause 12.1 has covered cybersecurity since 25 February 2021, by way of clarification of existing requirements. In other words, missing cybersecurity evidence constitutes a breach of the Essential Principles, with the same level of consequence as labelling or performance problems.

Insight 3: the design control requirements of IEC 62304 are unrelated to certificate status. The TGA states expressly that even without a Schedule 3 Part 1 or Part 4 certificate, the design control requirements of IEC 62304 still apply. This is a key reminder for software products proceeding under the Part 6 declaration of conformity pathway.

4. Practical recommendations

Maintain two separate lists, one for statutory standards and one for state of the art standards; the former supports conformity claims and the latter demonstrates the technical level, and the wording used in documents must distinguish the two.
Build software lifecycle documentation per IEC 62304 regardless of the certificate pathway, and maintain controlled records of version and build numbers per clause 13B.
Bind cybersecurity evidence into a separate volume covering development, production and maintenance, mapped to clause 12.1.
Organise biocompatibility evidence according to the ISO 10993 series, and note its state of the art positioning in the Essential Principles checklist.

5. Verification checklist

□ Statutory standards (CASO 2019 schedules) and state of the art standards have been distinguished
□ Software lifecycle documentation has been established per IEC 62304
□ Version and build number management corresponds to clause 13B
□ Cybersecurity evidence covers development, production and maintenance
□ Biocompatibility evidence is organised per ISO 10993 with its positioning noted

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Australian market. Our team prepares TGA-compliant CTOs and evidence dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com

Disclaimer

Prepared by GRZAN from publicly available regulation. It is provided for general information only and does not constitute legal advice. Legislation and official fees are subject to change by the competent authority.

About GRZAN

GRZAN (Global Regulatory Zone Access Navigator) — the global market-access navigator for medical devices and IVDs.

GRZAN is a specialist consultancy for medical device and IVD market access, providing end-to-end regulatory solutions across the product lifecycle and making international market entry simpler and faster.

Key figures. More than 25 wholly owned subsidiaries worldwide covering 50+ countries and regions; chosen by 100+ listed and leading Chinese device manufacturers, with 4,000+ successful cases; 12+ years in the sector and 200+ regulatory training sessions and seminars delivered.

What we do. Global market access: multi-country registration programmes, technical documentation, regulatory advice. Clinical evidence: clinical evaluation reports (CER), usability studies, overseas clinical investigations. Quality systems: ISO 13485, MDSAP, FDA QMSR and BGMP implementation and audit readiness. Authorised representative and licence-holder services across Southeast Asia, Latin America, the Middle East, Africa, Europe and North America.

Why GRZAN. A real operating entity, with the certificate held by the manufacturer: our direct overseas subsidiaries act as the compliant local holder, so the regulatory relationship stays clear and you keep control rather than being tied to a distributor. Direct access to the team: no time-zone gap, no language barrier, no cultural gap. Review points anticipated: we know what FDA 510(k), EU MDR, Southeast Asian, Latin American and Middle Eastern reviewers look for, which shortens timelines and reduces deficiency letters. Pathway planning: pre-decision analysis and risk assessment before you commit.

Every engagement rests on three commitments: efficiency through pre-submission review, certainty through a clear pathway, and stability through a licence-holder that stays in place.

Take your devices global with GRZAN

We work with manufacturers worldwide to open new markets with a clear regulatory pathway.