Biocompatibility, Sterilisation and Stability Evidence: What CAB Technical Review Focuses On

1. Key takeaways

Testing evidence is where the technical file is most often complete in substance and wrong in coverage. The reports usually exist; the problem is that they were written for a different model, a superseded standard version, or a laboratory whose competence is not documented. Malaysian review does not ask for more testing so much as for proof that the testing in the file answers the device being registered.

Three evidence families carry most of the weight. Biocompatibility is assessed under the ISO 10993 series, with the assessment matched to the nature of contact, since contact type and duration determine the endpoints. Sterilisation validation follows the standard for the method used. Stability and shelf life data support the expiry date and the transport and storage claims on the label. Each has to appear in the CSDT as a report plus the evaluation that interprets it.

• Biocompatibility: ISO 10993 series, with endpoints set by contact type and duration; report plus biological evaluation.
• Sterilisation: validation report for the method used — ISO 11135 for ethylene oxide, ISO 11137 for radiation.
• Class A and sterility: where a Class A product is sterile, the sterilisation validation report forms part of the notification material, following the IVD A(S) logic.
• Stability: supports the labelled expiry date and transport and storage conditions, under principle 5.
• Update limits: the automated re-registration route does not allow preclinical reports to be updated.
• Most common gaps: model coverage, outdated standard versions, missing ISO 17025 evidence.

2. Legal basis

The evidence obligations derive from Appendix 1 of the Third Schedule to MDR 2012. Principle 1, on chemical, physical and biological properties, is the basis for biocompatibility testing, and principle 5 covers transport and storage conditions, which is the basis for stability data supporting the labelled shelf life. The MDA IVD registration training material from 2023 sets out the verification report expectations for the A(S) and A(M) categories. The Automated Re-Registration Guide, in FAQ Q10 (July 2026), addresses the limits on updating preclinical reports.

The update rule deserves separate attention because it changes how the file should be built. On the automated re-registration route, preclinical reports — biocompatibility, stability and validation reports — cannot be updated. Anything that constitutes a substantial change to the registered device must go through CN approval before it can be reflected. Version updates that do not amount to a substantial change are handled in the ordinary pathway according to the MDA’s acceptance position. The implication is that a report which is thin at submission stays thin for the life of the registration.

3. Expert insights

Insight 1: coverage is a design question, not a paperwork question. Where a family or series is registered, the most frequent deficiency is that the reports cover models other than those on the registration. Reviewers compare the model list in the reports against the registered models, and a mismatch is not resolved by explanation. The fix belongs in the testing plan, where the model chosen for testing should be the worst case within the family and that reasoning should be written down.

Insight 2: an outdated standard version needs a statement, not silence. Reports against an earlier edition of a standard are common and are not automatically rejected. What causes difficulty is the absence of any explanation. A short statement identifying the version applied, its relationship to the current edition and the reason the difference does not affect the conclusion converts a potential finding into a documented judgement.

Insight 3: laboratory competence is part of the evidence. A report is only as good as the laboratory that produced it, which is why ISO 17025 accreditation evidence belongs in the file rather than in a drawer. Where a test was performed by a laboratory without accreditation for that method, the report may still be usable, but the file has to say so and explain why the result remains reliable. Silence on the point leaves the reviewer to assume the worst.

Insight 4: stability data carries two claims at once. Shelf life and storage conditions are usually treated as one subject, but they answer different questions: how long the device remains within specification, and whether the conditions under which it is transported and stored preserve that performance. The conventional approach combines accelerated and real-time ageing. Where a new claim is made on the basis of that data, the basis has to be stated, because an exemption claim without a foundation is a claim the reviewer cannot verify.

4. Practical recommendations

• Build a test evidence matrix. Rows for the report type, columns for the registered model, and each cell holding the report number, version and date. Family submissions and annual self-checks both run off it.
• Test the worst case and say so. Where a model is selected to represent a family, record the reasoning in the testing plan.
• Add a standards version note. Where an earlier edition was applied, explain the difference and why it does not affect the conclusion.
• File the accreditation evidence. Keep ISO 17025 scope documents with the reports they support.
• Match sterilisation evidence to the method. Use the validation standard corresponding to the sterilisation method, and confirm the report is present for Class A sterile products.
• Assume the reports are fixed at submission. Because the automated route does not permit updates, resolve weaknesses before filing rather than planning to correct them later.

The matrix is the single most useful artefact in this area. It exposes coverage gaps in a minute, it makes the annual compliance self-check mechanical, and it tells a manufacturer immediately which models are unsupported when a new variant is added to a registered family.

5. Verification checklist

• □ Biocompatibility assessment matched to contact type and duration, with report and biological evaluation
• □ Sterilisation validation report present for the method used, under ISO 11135 or ISO 11137 as applicable
• □ Class A sterile products supported by a validation report in the notification material
• □ Stability data support both the labelled expiry date and the transport and storage conditions
• □ Report model coverage consistent with the registered models
• □ Standard version stated, with an explanation where an earlier edition was applied
• □ ISO 17025 accreditation evidence retained with the reports

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Malaysia. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the MDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com