ISO 23640: Stability Studies for IVDs Under the IVDR

Introduction

ISO 23640 is the standard every IVD manufacturer cites for stability, and it is not harmonised under Regulation (EU) 2017/746. That is not a technicality. It means that when a notified body reviewer opens Section 6.3 of your technical file, there is no presumption of conformity to fall back on, no European annex mapping clauses to requirements, and no shortcut. The reviewer assesses your shelf life against the Regulation itself, and against the performance you claimed in your own instructions for use.

This is the section of the file that manufacturers underestimate most consistently. Stability looks like a laboratory problem — put reagent on a shelf, test it at intervals, plot the line — and it is assessed as a documentation problem. The IVDR requirements for in vitro diagnostics impose specific numbers of lots, specific study designs and specific content for each report, and they sit in a part of Annex II that changed substantially from the Directive.

This article covers what actually creates the stability obligation, what Annex II Section 6.3 requires study by study, what ISO 23640 gives you and what it deliberately does not, how accelerated data and acceptance criteria are assessed, where in-use and shipping studies go wrong, where the stability report belongs in the file, and how a stability claim is maintained after launch.

Table of Contents

• Why ISO 23640 is not a harmonised standard under the IVDR
• Three requirements in Annex I create the obligation, and none of them uses the word stability
• Annex II Section 6.3 asks for three studies, and only one of them needs three lots
• What ISO 23640 contains, and what it deliberately leaves to you
• The scope line that decides whether the standard applies to your device
• A second edition is in ballot, and it will not change the regulatory position
• Accelerated studies buy a launch date, not a shelf life
• Acceptance criteria are the part no standard will write for you
• In-use stability is more than open-vial data
• Shipping stability is a device study, not a packaging study
• Where the stability report belongs, and why reviewers cannot find it
• Class D devices get no help from the common specifications
• A shelf life is a claim that ages
• Frequently asked questions
• Conclusions

Why ISO 23640 is not a harmonised standard under the IVDR

The European adoption of the standard is EN ISO 23640:2015, which is identical to ISO 23640:2011 and superseded EN ISO 23640:2013. Its Annex ZA — the annex that maps clauses of the standard onto legal requirements and gives the standard its legal effect — is written against Directive 98/79/EC. The Directive was repealed on 26 May 2022. The mapping went with it.

References of harmonised standards for in vitro diagnostics under the IVDR are published in the annex to Commission Implementing Decision (EU) 2021/1195, which has now been amended eight times: January 2022, May 2022, July 2023, March 2024, October 2024, April 2025, January 2026 and most recently by Implementing Decision (EU) 2026/1313 of 15 June 2026. The consolidated summary list runs to roughly two dozen references. EN ISO 23640 has never appeared on it.

What has appeared is instructive. The Commission's summary list now carries the whole EN ISO 18113 series in its 2024 editions, harmonised on 30 January 2026 by Implementing Decision (EU) 2026/197. Those are the labelling standards: they specify how a shelf life claim, a storage condition and an in-use statement are expressed on the label and in the instructions for use. EN ISO 17511:2021 covers metrological traceability. EN ISO 20916:2024 covers clinical performance studies. In other words, the standards that govern how you declare a stability claim and how you generate clinical data are harmonised; the standard that governs how you establish the stability claim itself is not.

Applying EN ISO 23640:2015 remains good practice and no reviewer will criticise you for it. What it does not do is shift the burden of proof. Under a harmonised standard you argue compliance with the standard; here you argue compliance with Annex II Section 6.3, clause by clause, and the standard is at best supporting evidence that your method was sound.

There is a practical consequence for the GSPR checklist. Manufacturers routinely enter EN ISO 23640:2015 in the "standards applied" column against the stability requirements and treat the row as closed. It is not closed. The evidence column has to name the stability study reports themselves, with document identity, revision and section, because Annex II Section 4 requires the technical documentation to identify the controlled documents that demonstrate conformity. A standard reference is not evidence of anything.

Three requirements in Annex I create the obligation, and none of them uses the word stability

Search Annex I of Regulation (EU) 2017/746 for "stability" and you find it in the labelling and instructions-for-use provisions of Section 20, and in the performance study provisions. The requirement to establish stability at all is carried by three general safety and performance requirements that never name it.

GSPR 6 requires that the characteristics and performance of a device are not degraded to the point of compromising health or safety during the lifetime the manufacturer indicates, under the stresses of normal use. GSPR 7 requires that design, manufacture and packaging protect characteristics and performance during transport and storage, naming temperature and humidity fluctuation as examples. GSPR 9.2 is the shortest and the sharpest: performance characteristics are maintained during the lifetime of the device as the manufacturer indicates it.

Read together, they mean something specific. The manufacturer sets the lifetime; having set it, the manufacturer owns the burden of showing that performance holds across it. A shelf life is not a datum you discover about your product. It is a claim you make and then have to defend, and its length is a commercial decision constrained by evidence — which is why an eighteen-month claim supported by twelve months of real-time data is a finding, and a twelve-month claim supported by twenty-four months of data is merely conservative.

The other end of the chain is Section 20. The label must carry the date up to which the device can be used safely without degradation of performance, and any special storage or handling conditions that apply. The instructions for use must state in-use stability, which the Regulation describes as potentially including storage conditions and the shelf life after the primary container is first opened, together with the storage conditions and stability of working solutions where relevant. Every one of those printed statements is a claim. Every claim needs a study behind it.

Annex II Section 6.3 asks for three studies, and only one of them needs three lots

Section 6.3 of Annex II is headed to cover claimed shelf life, in-use stability and shipping stability — and to exclude specimen stability, which is documented with the specimen types in Section 6.1. The three sub-sections are frequently treated as one deliverable with three chapters. They are three studies with materially different requirements, and the differences are where files fail.

The most consequential number in the whole section is the requirement in 6.3.1 for testing on at least three different lots manufactured under conditions essentially equivalent to routine production. The lots do not have to be consecutive, which is a genuine concession. They do have to be representative of routine manufacture, which is not. Three lots from a development or pilot line do not satisfy the requirement, and the discrepancy is trivially visible to an auditor who compares the stability protocol lot numbers against the batch records and the process validation report.

In-use and shipping stability each require one lot. That asymmetry is deliberate: shelf life claims are about lot-to-lot variability in ageing, while in-use and shipping studies are about the response of the product to a defined stress. It also means there is no excuse for the in-use study to be missing, since it costs one lot.

Notice what all three have in common: acceptance criteria and testing intervals are named as required content of the report. They are not optional design details. A stability report that presents results and then concludes that no significant change was observed, without a pre-specified limit against which significance was judged, is incomplete on the face of the Regulation.

What ISO 23640 contains, and what it deliberately leaves to you

ISO 23640:2011 is twelve pages. That fact alone tells you what kind of document it is. It specifies general requirements for stability evaluation and specific requirements for real-time and accelerated evaluation, for four purposes: establishing shelf life including transport conditions, establishing stability in use after the primary container is first opened, monitoring the stability of product already on the market, and verifying stability specifications after a change to the product that might affect stability.

Those four purposes map almost exactly onto what the IVDR wants, which is why the standard remains the right framework even without harmonised status. The fourth purpose in particular — verification after a change — is the one manufacturers most often skip, and it is the one that keeps a stability file alive rather than turning it into an archived launch document.

What the standard does not do is supply numbers. It will not tell you how many lots, how long, at what intervals, or what limit. It normatively references ISO 14971 for risk management and ISO 18113-1 for labelling terminology, and it points at CLSI EP25 for the study design and statistics. That is the honest division of labour: the Regulation supplies the lot counts, the standard supplies the process, and the statistical guideline supplies the method.

The current edition of that guideline is CLSI EP25-Ed2, published in 2023 and superseding EP25-A from 2009, with a correction notice issued in April 2024 that fixes errors in the power analysis appendix and in a worked example. It is 124 pages of regression-based procedures for establishing and confirming stability claims, and it addresses transport conditions, mean kinetic temperature and accelerated testing directly. If you are choosing between reading ISO 23640 and reading EP25-Ed2 before designing a study, read EP25-Ed2.

The scope line that decides whether the standard applies to your device

ISO 23640 applies to reagents, calibrators, control materials, diluents, buffers and reagent kits, collectively called IVD reagents, and it can be applied to specimen collection devices that contain substances used to preserve the sample or to initiate reactions within the collection device. It explicitly does not apply to instruments, apparatus, equipment, systems or specimen receptacles, nor to the sample under examination.

That exclusion matters for two common device types. If your device is an analyser, the standard is out of scope and your Section 6.3 argument has to be built on instrument lifetime, component ageing, maintenance intervals and calibration stability rather than on reagent ageing. If your device is a plain specimen receptacle with no preservative, Section 6.3 still applies — the Regulation makes no exception — but you will be reasoning about packaging integrity and sterility maintenance rather than about analyte recovery.

A second edition is in ballot, and it will not change the regulatory position

ISO/DIS 23640, edition 2, is under development at ISO/TC 212. The project was approved in March 2024, the committee draft was registered in October 2024 and approved for registration as a DIS in January 2026, the DIS ballot opened on 6 May 2026 and voting closed on 30 July 2026. The draft is twelve pages, the same length as the current edition, which suggests a revision rather than a rewrite.

Plan for it, but do not wait for it. Even when the second edition is published and adopted as an EN, harmonisation is a separate act requiring a standardisation request, a CEN Annex ZA written against Regulation (EU) 2017/746, an assessment by the Commission and publication in the Official Journal. Judging by the standards that have completed that route recently — the ISO 18113 series took until January 2026 — the gap between publication and harmonisation is measured in years. Your file has to stand on the Regulation in the meantime.

Accelerated studies buy a launch date, not a shelf life

The Regulation is unusually explicit here: accelerated studies or data extrapolated from real-time data are acceptable for an initial shelf life claim, but they must be followed up with real-time stability studies. Two words in that sentence do the work. "Initial" means the claim is provisional. "Shall" means the follow-up is not a commitment you make if convenient.

The practical consequence is that a submission relying on accelerated data must contain the real-time programme as part of the file, not as an intention. That means the real-time protocol, the identity of the lots on test, the testing schedule and the dates at which results will be available and the claim reviewed. A reviewer who sees an accelerated Arrhenius extrapolation with no accompanying real-time protocol is looking at an incomplete Section 6.3, and the deficiency is easy to write.

Two further points are worth stating plainly. First, an Arrhenius model assumes a single dominant degradation mechanism with temperature-independent kinetics across the range studied, and that assumption fails routinely for biological reagents, where phase changes, protein denaturation and microbial growth introduce mechanisms at elevated temperature that do not operate at 4 °C. Where the assumption fails, the extrapolation is not conservative — it is arbitrary. Second, an accelerated study justifies an interim claim, never an extension: manufacturers who want to move from twelve months to twenty-four cannot do it with a fortnight at 37 °C. That extension requires real-time data to the new claim.

Acceptance criteria are the part no standard will write for you

This is where most stability files are genuinely weak, and no amount of standard citation helps. An acceptance criterion is a statement of how much the measured property may change before the device no longer performs as claimed. It has to be derived, and the derivation has to be recorded.

The derivation runs backwards from the instructions for use. If the IFU claims a coefficient of variation of 5% at the medical decision point, the total error budget at the end of shelf life has to accommodate that claim, which means the acceptable drift over the shelf life is what remains after lot-to-lot variability, calibration uncertainty and day-to-day imprecision have taken their share. If the IFU claims a limit of detection, the criterion has to be expressed in terms of that limit at the end of the claimed period, not at release. Criteria set as a fixed percentage of the release value with no link to the clinical claim are common and indefensible.

The other input is risk management under ISO 14971. For an IVD, the harm from a degraded reagent is indirect: the device produces a wrong or delayed result, a clinician acts on it, and the patient is harmed by the decision rather than by the device. That chain is what turns an analytical drift into a severity rating, and it is what tells you whether a 10% loss of signal is a nuisance or a false negative. A stability acceptance criterion that has never been through the risk file is a number someone chose.

Choose the metrics with the same care. The standard's own logic is that you select the properties most likely to reveal a change that matters — which may be analytical performance, but may equally be a physical, chemical or microbiological property that moves earlier and more sensitively than the assay result. Appearance and pH are not substitutes for performance, but a pH shift that precedes signal loss by three months is a far better stability indicator than the signal itself.

In-use stability is more than open-vial data

Section 6.3.2 asks for a study on one lot reflecting actual routine use, whether real or simulated, and gives open-vial stability and, for automated instruments, on-board stability as examples. Where calibration stability is claimed for automated instrumentation, supporting data must be included. In practice, "reflecting actual routine use" is the phrase that is ignored.

A study in which a vial is opened once, resealed and stored undisturbed at the labelled temperature does not reflect routine use in a laboratory where the same vial is opened twenty times over a fortnight, spends forty minutes on the bench at each use, and sits on a heated analyser deck between runs. The claim printed in the instructions for use is the one the customer relies on, and it has to be supported by a study that resembles what the customer does.

The exposure profile is worse, not better, for near-patient and self-testing devices, and Annex I makes that explicit: characteristics and performance have to be checked specifically where they may be affected by lay use, or by the environment in which near-patient testing takes place. A cassette carried in a bag, a dropper bottle stored in a bathroom, a strip vial opened repeatedly with wet hands — these are the in-use conditions, and a study run by a trained operator in a controlled laboratory does not represent them.

Work through the instructions for use line by line and list every temporal statement: use within so many hours of opening, stable on board for so many days, reconstituted working solution valid for so many hours, recalibrate every so many days or after every lot change. Each of those is a separate claim under Section 6.3.2. If there are five statements and one study, four claims are unsupported.

Shipping stability is a device study, not a packaging study

Section 6.3.3 asks for a study on one lot of devices to evaluate the tolerance of the devices to the anticipated shipping conditions, under real or simulated conditions, and it requires that variable conditions such as extreme heat and extreme cold are included. The report needs the protocol, the acceptance criteria, the conclusions and a justification of the shipping conditions selected.

The recurring failure is a category error. Manufacturers commission a transport simulation, receive a report showing that the shipper held between 2 and 8 °C for seventy-two hours across a summer profile, file it under 6.3.3 and consider the requirement met. It is not: that report characterises the container. Section 6.3.3 asks whether the device still performs, which means running the assay on shipped material against the same acceptance criteria used in the shelf life study, and confirming that the shipped units are indistinguishable from the controls.

The justification of conditions is the second half of the requirement and is usually missing altogether. Justifying means describing the actual distribution network — road, air, sea, the countries served, the seasons, the number of legs, whether the last leg is controlled by a distributor — and showing that the profile studied bounds it. A manufacturer selling into the Gulf in August and to Nordic customers in January has to have studied both extremes, and dry ice sublimation, pressure changes in air freight and freeze-thaw in unheated warehouses all belong in that analysis.

One more point, because it produces recalls rather than findings: the shipping study covers the outbound leg from the manufacturer. It does not cover onward shipping by a distributor unless the distribution agreement imposes the same conditions and the manufacturer verifies compliance. Under the IVDR, distributors have their own storage and transport obligations, but the performance claim on the label remains the manufacturer's.

Where the stability report belongs, and why reviewers cannot find it

There is genuine ambiguity in the Regulation here, and it is worth naming rather than papering over. Stability is documented in Annex II Section 6.3, which sits alongside analytical performance in 6.1 and clinical evidence in 6.2 without being folded into either. MDCG 2022-2 on clinical evidence for IVDs lists stability among the indicators of analytical performance, which points the other way. And Annex XIII, which defines what the analytical performance report has to demonstrate, refers to the parameters of Annex I 9.1(a) — a list that does not include stability as such.

So three documents point in three directions, and the result is predictable: some manufacturers put stability in the analytical performance report, some create a standalone stability summary, and some do both inconsistently, at which point the reviewer finds two sets of numbers and asks which is current.

Take a position and hold it. Write one stability report per device, covering all three sub-sections of 6.3 with a section each. Place it in Section 6.3 of the technical documentation, where the Regulation puts it. Cross-reference it from the analytical performance report, because the shelf-life-end performance is an analytical performance argument and the performance evaluation report has to reach a conclusion that holds across the device lifetime. Enter it in the GSPR checklist against GSPR 6, 7 and 9.2 by document number, revision and section. What you must not do is duplicate the content, because two copies drift and the drift becomes the finding.

Class D devices get no help from the common specifications

Manufacturers of class D devices reasonably assume that the common specifications fill the gap left by the missing harmonised standard. They do not. Commission Implementing Regulation (EU) 2022/1107, applicable since 25 July 2024, lays down common specifications for certain class D devices in respect of the performance characteristics of Annex I Section 9.1 points (a) and (b), Section 9.3 and Section 9.4 point (a).

Compare that scope with the three requirements that actually carry the stability obligation. GSPR 6, GSPR 7 and GSPR 9.2 are all outside it. The common specifications will tell a manufacturer of an HIV or HCV assay what analytical sensitivity to achieve and what panels to run; they will not tell that manufacturer how to establish a shelf life. For the highest-risk devices in the Regulation, the stability argument is built from Annex II Section 6.3, the state of the art and your own risk analysis — exactly as it is for a class A reagent.

A shelf life is a claim that ages

Two of the four purposes in the scope of ISO 23640 are post-market: monitoring the stability of product already on the market, and verifying stability specifications after a change that might affect stability. Both are routinely dropped once the certificate is issued, and both are visible in a surveillance audit.

Ongoing monitoring means keeping lots from routine production on real-time test after launch, at a defined frequency, against the same acceptance criteria. It is the mechanism that detects a slow shift in a raw material, a supplier change that passed incoming inspection, or a claim that was optimistic to begin with. It is also the evidence that supports a shelf life extension, since a claim cannot be extended on anything other than real-time data to the new period.

Change verification means having a rule, in the change control procedure, that identifies which changes require stability re-verification: raw material or supplier change, formulation change, primary container or closure change, fill volume change, manufacturing site or process change, and any change to storage or transport conditions. Under a substantial change assessment these are the changes most likely to require notification to the notified body, and the stability rationale is what supports the assessment either way.

The post-market surveillance side is explicit in the Regulation. Degradation-related complaints — lot failures near expiry, controls out of range at the end of a kit, results shifting after a shipment — are inputs to the post-market surveillance plan, and their rate is exactly the kind of indicator that MDCG 2025-10 expects to be set pre-market and reassessed with real data. If complaints of that kind rise statistically significantly, Article 83 trend reporting is engaged. A stability programme that does not connect to the post-market file leaves that signal undetected until a notified body finds it.

Frequently asked questions

Is ISO 23640 mandatory under the IVDR?

No. No standard is mandatory under the IVDR; standards are voluntary, and their value lies in the presumption of conformity that harmonisation confers. ISO 23640 does not currently carry that presumption for the IVDR, because its reference has not been published in the Official Journal in support of Regulation (EU) 2017/746. Applying it is sound practice and widely expected as state of the art, but conformity is demonstrated against Annex I and Annex II, not against the standard.

How many lots do I need for an IVD shelf life study?

At least three, under Annex II Section 6.3.1, manufactured under conditions essentially equivalent to routine production. The three lots do not have to be consecutive. In-use stability under Section 6.3.2 and shipping stability under Section 6.3.3 each require one lot. The three-lot requirement is about capturing lot-to-lot variability in ageing, so lots from a pilot or development line do not satisfy it.

Can I claim a shelf life based on accelerated stability data?

For an initial claim, yes. Annex II Section 6.3.1 accepts accelerated studies or data extrapolated from real-time data for an initial shelf life claim, but requires that they are followed up with real-time studies. The real-time protocol, the lots on test and the reporting schedule should be in the technical documentation at submission. Accelerated data cannot be used to extend an existing claim.

What is the difference between in-use stability and open-vial stability?

Open-vial stability is one component of in-use stability. Section 6.3.2 covers the stability of the device in actual routine use, which typically includes open-vial stability, on-board stability on an automated analyser, the stability of reconstituted or diluted working solutions, and calibration stability where it is claimed. Each statement of this kind printed in the instructions for use is a separate claim requiring its own data.

Does specimen stability belong in Section 6.3?

No. Section 6.3 explicitly excludes specimen stability. Sample handling limits — storage duration, temperature limits, freeze-thaw cycles, the interval between collection and analysis — are documented with the specimen types in Section 6.1 of Annex II, and they belong to the analytical performance argument. Device stability and specimen stability are different studies answering different questions.

Is EN ISO 23640:2015 still useful if it is not harmonised?

Yes. It remains the recognised framework for designing and documenting an IVD stability evaluation, it is normatively linked to ISO 14971 and the ISO 18113 labelling series, and it points at CLSI EP25 for study design and statistics. What it no longer provides under the IVDR is a presumption of conformity, so it belongs in the technical documentation as the method you followed, not as the justification for the claim.

When will the second edition of ISO 23640 be published?

ISO/DIS 23640 edition 2 completed its enquiry ballot on 30 July 2026 and is under development at ISO/TC 212. Publication depends on the ballot outcome and any subsequent FDIS stage. European adoption as an EN and harmonisation under the IVDR would each be separate steps after that, so manufacturers should build the current file against the Regulation rather than wait for the revision.

Conclusions

Treat Section 6.3 as three studies with three protocols and three reports, not as one chapter. Fix acceptance criteria before the data exist and derive them from the performance you print in the instructions for use, through the risk file. If you launch on accelerated data, put the real-time programme in the submission. List every temporal statement in the instructions for use and confirm that each one has a study. Measure the device after shipping, not just the temperature inside the box. And keep lots on test after launch, because a shelf life is a claim you have to keep defending.

The absence of a harmonised standard is not a licence to be vague — it is the opposite. Where a presumption of conformity is unavailable, the file has to argue the case explicitly, requirement by requirement, and the argument has to be visible to a reviewer who has never seen your product.

The EU IVDR Technical Documentation Kit on MD Regulatory provides the eight Annex II templates with Section 6 split into 6.1 to 6.5 as the Regulation writes it, a verification and validation template that carries stability across at least three lots alongside analytical performance and software verification, and a GSPR evidence column that records document, revision and section — all aligned with Regulation (EU) 2017/746 and immediately deployable in an existing ISO 13485 quality management system.

Related articles

• IVDR Explained: What Regulation (EU) 2017/746 Requires
• IVDR Technical Documentation: Annex II Section by Section
• MDCG 2022-2 Explained: Clinical Evidence for IVDs
• ISO 20916: Good Study Practice for IVD Performance Studies
• EU IVDR Transition Deadlines 2027, 2028 and 2029
• ISO 14971 Risk Management for Medical Devices