Jherrod ThomasThe Lion of Functional Safety™

August 20, 2026 · 15 min read

ISO 14971 §5.2 / §7.4 / §10ISO 10993-1 / -4 / ISO 1107021 CFR 820 QMSR / Class I

When the Intended Use Statement Described Two Moments and the Device Stayed In for Four Days: The Abiomed 14Fr Low Profile Introducer Recall Through an ISO 14971 and ISO 10993 Lens

A vascular introducer is one of the least glamorous objects in a cath lab. It is a plastic tube with a hemostasis valve, a sidearm, and a dilator. Its entire published purpose is to let something else get into the artery. On July 17, 2026 the FDA classified the removal of one of them as a Class I recall, and in doing so took an entire generation of heart pump off the market with it.

The interesting part of this recall is not the thrombus. Thrombus on indwelling arterial hardware is the oldest problem in interventional cardiology and nobody is surprised by it. The interesting part is the sentence FDA prints under Device Use, and what that sentence quietly assumes about how long the device is in the body.

1. The public record

On May 22, 2026, Abiomed — now Johnson & Johnson MedTech — sent affected customers a letter recommending that all 14Fr Low Profile Introducer Kits be removed from where they are used or sold. Not corrected. Not relabelled. Quarantined and returned to Sedgwick.

The FDA issued an Early Alert on June 2, 2026, updated it to a Class I classification on July 17, 2026, and made a final formatting revision on July 31, 2026. The American Hospital Association flagged it to member hospitals on August 3, 2026, in the same bulletin as the ResMed Astral supercapacitor action. (FDA recall notice; FDA Early Alert; AHA News)

Four product codes are in scope:

| Product code | Description | UDI-DI | | --- | --- | --- | | 1000434 | 14 Fr x 13 cm Low Profile Introducer Kit for Impella CP | 00813502012996 | | 1000435 | 14 Fr x 25 cm Low Profile Introducer Kit for Impella CP | 00813502013009 | | 1000542 | 14 Fr x 13 cm and 25 cm Low Profile Introducer Kit (Japan) | — | | 1000413 | Impella CP Set with SmartAssist (10th Generation) | 00813502013566 |

That last row is the one to sit with. The pump set is in the recall not because the pump failed, but because — in FDA's words — the kit "is only compatible with Impella CP 10th generation ... and therefore the pump set is included in the removal." The agency is explicit that no other commercially available generation of Impella CP is affected.

FDA's stated reason:

Abiomed has identified a higher rate of complaints than expected related to thrombus formation on the 14Fr Low Profile Introducer Kit during prolonged use of the introducer. If thrombus formation occurs, the user may have difficulty aspirating the sheath sidearm or valve. The user may also observe thrombus in the syringe or sidearm post aspiration or around the valve following CP pump removal.

And the harm pathway:

Thrombus formation within the indwelling sheath lumen or the annular gap between the sheath inner diameter and the catheter outer diameter during prolonged support may result in disruption of blood flow near the access site. If thrombus is dislodged during ongoing support, manipulation, or removal, this may result in peripheral vessel obstruction with ischemia ... Under less common circumstances, exposure could progress to irreversible vascular occlusion with potential for permanent impairment if not corrected.

As of May 15, 2026: three serious injuries, no deaths. Johnson & Johnson told Cardiovascular Business that only six U.S. hospitals held affected product. (Cardiovascular Business, June 2, 2026; HPN Online, July 17, 2026)

Now the Device Use line, verbatim:

The 14Fr Low Profile Introducer Kit is intended to facilitate access to the vascular system for the introduction and removal of the Impella CP with SmartAssist and ancillary devices.

Introduction and removal. Two moments. Meanwhile the device it introduces is labelled for temporary ventricular support of four days or less in cardiogenic shock, and the sheath does not come out in between. (Impella left-side indications and safety information)

The sibling recall nobody is connecting

Six weeks later, a second Class I action landed on the same product family from a completely different failure mode. On June 10, 2026 Abiomed and its manufacturing partner Oscor wrote to customers about leakage in 14Fr and 23Fr introducers — at the sidearm, under the sheath cap, and along hub score lines — attributed to manufacturing issues. FDA issued an Early Alert June 18, and classified it Class I on August 3, 2026 as 13 separate recall entries, one carrying recall number Z-2684-2026, all logged as a correction rather than a removal. As of April 22 the firm had reported eight instances of major bleeding and three complaints with corresponding patient deaths, which Abiomed determined were not attributable to the leakage. The recall record notes the manufacturing flaw is "not visually detectable by the user." (FDA Early Alert, June 18, 2026; Medical Daily, August 3, 2026)

Two Class I actions, one sheath family, seven weeks apart. One says stop using it. The other says keep using it and watch harder. Both are correct given their evidence. That they arrived together is the signal.

2. The standards lens

2.1 ISO 14971 §5.2 and IEC 62366-1 §5.1 — the use specification is missing a duration field

ISO 14971:2019 Clause 5.2 requires the manufacturer to document the intended use and reasonably foreseeable misuse. IEC 62366-1:2015 Clause 5.1 is more specific about what belongs in a use specification: the intended medical indication, patient population, part of the body, operating principle, and the frequency and duration of use.

"Introduction and removal" is not a duration. It is an event list. And critically, the four-day indwell is not misuse — there is no other way to deliver the therapy. The sheath is the only thing holding the arteriotomy open around a catheter that is drawing blood out of a ventricle. If your use specification does not contain the number 96 hours, your risk file has never been asked the question the field just answered.

This is the finding in one line: the accessory's use specification was written from the perspective of the procedure, and the hazard lives in the interval between the two procedures.

2.2 ISO 10993-1 §5 — the contact-duration category decides which tests you owe

ISO 10993-1:2018 categorizes a device by nature and duration of body contact. This one is unambiguous on the nature axis: external communicating device, circulating blood. The duration axis has three bins:

An introducer framed as "introduce and remove" reads as Category A. An introducer that stays in a femoral artery for the duration of Impella CP support is Category B, every time, with no exceptions. The endpoint set is not the same. Category B blood-contacting devices carry a fuller hemocompatibility obligation under ISO 10993-4:2017 — thrombosis, coagulation, platelets, haematology, complement activation — and the thrombosis endpoint in particular is meant to be evaluated in a flowing model with an exposure duration representative of clinical use.

The public record does not state which category Abiomed claimed. It does not have to. FDA's own recall text puts the failure condition at "prolonged use" and "prolonged support," which is ISO 10993-1's own word for the category boundary. That is the tell.

A four-hour ex vivo shunt test tells you nothing useful about ninety-six hours of near-stagnant blood in an annular gap of a fraction of a millimetre. Stasis is a time integral. You cannot short-cycle it.

2.3 ISO 11070 — the product standard bounds the sheath as a conduit, not as a resident

ISO 11070:2014 + A1:2018, Sterile single-use intravascular introducers, dilators and guidewires, is the applicable product standard. It is a good standard. It specifies hemostasis-valve leakage, sidearm and hub integrity, corrosion resistance, tensile strength, surface condition, and force to insert.

Look at what that covers and what it does not. The June leakage recall — sidearm, sheath cap, hub score lines — falls squarely inside ISO 11070's leakage and integrity clauses. That is a conformance and process-control failure against a requirement that exists.

The thrombus recall does not map onto ISO 11070 at all, because ISO 11070 contains no indwell-duration thrombogenicity requirement. The standard bounds the introducer as a passage. Nothing in it obliges you to characterize what happens in the gap between the sheath bore and the catheter shaft on day three.

When a device's real duty cycle sits outside its product standard's scope, the risk management file is the only thing standing there. That is exactly the situation ISO 14971 exists for, and exactly the situation where teams defer to the harmonized standard and stop.

2.4 ISO 14971 §7.4 — the risk control that created the hazardous situation

Clause 7.4 requires the manufacturer to determine whether new hazards or hazardous situations are introduced by the risk control measures themselves, and to evaluate the resulting risks.

"Low Profile" is a risk control. Large-bore femoral access is the dominant complication source for percutaneous mechanical circulatory support — limb ischemia, access-site bleeding, vessel injury. Reducing the sheath's footprint is a legitimate, well-motivated mitigation with real clinical benefit behind it.

The recall is scoped exclusively to the low-profile variant, and FDA states plainly that no other commercially available Impella CP generation is involved. That scoping is the Clause 7.4 finding. A geometry and configuration change made to reduce one harm produced a variant-specific thrombogenic behaviour the predicate configuration did not exhibit. The public record does not disclose whether the driver was annular clearance, valve geometry, material, or coating — and it does not need to for the process point to stand. Whatever changed, the trade-off row was not in the file, or it was in the file with a probability estimate the field has now falsified.

2.5 Detection — every named control is either manual or post-hoc

FDA names three ways a clinician learns this has happened:

  1. difficulty aspirating the sheath sidearm or valve
  2. thrombus visible in the syringe or sidearm after aspiration
  3. thrombus around the valve following CP pump removal

Item 3 detects the failure after the harm window has closed. Items 1 and 2 are operator-performed, intermittent, unlogged, and have no defined interval or pass/fail threshold on the public record. The SmartAssist instrumentation on the catheter — placement signal, motor current — watches the catheter. Nothing watches the annulus around it. In FMEA terms, the detection rating on this failure mode is poor and one of the three "controls" is an autopsy.

2.6 ISO 14971 §10 and 21 CFR 820 — the postmarket loop did fire, in the right order, too slowly

"A higher rate of complaints than expected" is a precise regulatory phrase. It means a complaint-rate expectation existed, a trend rule was defined, and the rule tripped — ISO 14971 Clause 10 production and post-production information, ISO/TR 20416 postmarket surveillance, 21 CFR 820.100 CAPA and 820.198 complaint files, all working as designed.

Worth noting the regulatory backdrop: the QMSR amendments to 21 CFR Part 820 took effect February 2, 2026, incorporating ISO 13485:2016 by reference. Design validation now runs through ISO 13485 §7.3.7, which requires validation under conditions representative of actual use. Different citation, identical demand — and "actual use" of this sheath is four days, not four minutes.

The postmarket system worked. It is just that a complaint-rate trend rule is a lagging indicator whose unit of measurement is patients. Three serious injuries is the resolution of that instrument.

3. A worked snippet

3.1 The ISO 14971 risk row that should have existed

| ID | Hazard | Foreseeable sequence of events | Hazardous situation | Harm | P1 | P2 | Severity | Risk | Control | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | RM-041 | Thrombogenic surface / flow stasis | Sheath remains indwelling for full support duration (up to 96 h) → annular gap between sheath ID and catheter OD sustains low shear → fibrin and platelet deposition accumulates | Occlusive thrombus in annulus, sidearm or valve, undetected during ongoing support | Peripheral vessel obstruction, limb ischemia | Med | High | Critical | Unacceptable | Duration-matched ISO 10993-4 thrombosis testing; specified annular flush protocol; scheduled aspiration check with defined criterion | | RM-042 | Embolization of formed thrombus | Catheter manipulation, repositioning or removal at end of support dislodges annular thrombus | Distal embolus in femoral or infrapopliteal circulation | Irreversible vascular occlusion, permanent impairment | Low | High | Critical | Unacceptable | Mandatory aspiration-and-verify step in removal IFU; sheath exchange interval; documented removal sequence | | RM-043 | New hazard from risk control (§7.4) | Low-profile geometry adopted to reduce access-site injury alters annular clearance or valve geometry relative to predicate | Variant-specific thrombus rate exceeds predicate | As RM-041 / RM-042 | Med | High | Critical | Unacceptable | Comparative bench and in vivo thrombogenicity versus predicate sheath at labelled maximum duration |

The rows are not exotic. RM-043 is the one that decides the recall, and it is the row that only gets written if someone at design review asks the Clause 7.4 question out loud.

3.2 Fault tree — top event: peripheral vessel obstruction with ischemia during or after Impella CP support

                  TOP: Peripheral vessel obstruction with ischemia
                                      |
                                    [AND]
                    ______________________|_______________________
                   |                                              |
      G1: Occlusive thrombus present               G2: Detection fails before harm
          in sheath annulus / valve                    (no timely intervention)
                   |                                              |
                 [OR]                                           [AND]
        ___________|___________              ___________________|___________________
       |           |           |            |                   |                   |
   B1: Low-shear  B2: Contact  B3: Flush /  B4: Aspiration   B5: No continuous   B6: Post-removal
   stasis in      activation   aspiration   check has no     annulus monitoring  inspection is
   annular gap    of coagul-   protocol     defined interval  instrumented on     the only other
   sustained      ation on     undefined    or pass/fail      the console         detection means
   over 24-96 h   sheath       in IFU       threshold
                  surface
       |
   [Basic event: use specification omits maximum continuous
    indwell duration -> 10993-1 duration category understated
    -> 10993-4 thrombosis testing envelope never covered 96 h]

Read the AND gate at the top. Thrombus alone is survivable — it is routine, and the field manages it. The harm requires the second branch: nothing in the system is looking. Both branches trace back to the same missing number in the use specification.

4. Derived requirements (excerpt)

SHTH-SR-001 — Use specification shall state maximum continuous indwell duration. The introducer use specification shall state a maximum continuous indwell duration not less than the maximum labelled support duration of every pump with which the introducer is declared compatible (96 h for Impella CP). Verification: traceability review from each compatible pump's labelled support duration to the introducer use specification. Acceptance: zero compatible pumps whose labelled duration exceeds the introducer's stated indwell duration.

SHTH-SR-002 — Biological evaluation shall be categorized on actual indwell, not on procedural intent. The biological evaluation plan shall categorize the device per ISO 10993-1:2018 as external communicating, circulating blood, prolonged contact (more than 24 h up to 30 days), and shall include ISO 10993-4:2017 thrombosis evaluation in a flowing in vivo model run for not less than the maximum indwell duration of SHTH-SR-001, with the mated catheter in situ. Verification: study report review. Acceptance: thrombus score at each of the annulus, hemostasis valve and sidearm regions no worse than the predicate sheath configuration tested under identical duration and anticoagulation regimen.

SHTH-SR-003 — The annular gap shall be a controlled interface with a specified flush performance. The sheath inner diameter and mated catheter outer diameter shall be specified as a controlled interface with a maximum annular cross-sectional area and a documented annular volume. The labelled sidearm flush protocol shall fully displace that annular volume, verified by dye-clearance or equivalent. Verification: dimensional stack-up analysis plus bench flush study across the tolerance extremes of both mating parts. Acceptance: complete annular volume exchange at the labelled flush rate and volume, at both worst-case clearance conditions.

SHTH-SR-004 — A detection means shall exist that does not require pump removal. The system shall provide a means of detecting developing annular or valve thrombus during ongoing support, with a defined check interval and an objective pass/fail criterion, and the result shall be recordable. Where the means is manual aspiration, the IFU shall specify interval, aspirate volume and a resistance criterion. Verification: usability validation per IEC 62366-1 with representative users at the end of a simulated 96 h support run. Acceptance: detection of a seeded partial obstruction at a stated interval in at least 90 percent of simulated-use trials, and zero cases where post-removal inspection is the first detection.

SHTH-SR-005 — Exclusive-compatibility accessories shall be assessed inside the parent device risk file. Any accessory whose failure can propagate to the therapy device, or whose withdrawal would render a therapy device unusable, shall be assessed within the parent device's risk management file and its change history reviewed at the parent device's design reviews. Exclusive single-source compatibility shall require either a qualified alternate or a documented ISO 14971 Clause 7 justification for the residual availability risk. Verification: configuration review of every accessory with a one-to-one compatibility constraint. Acceptance: each such accessory has a qualified alternate or a signed justification on file.

5. What the headline really tells us

The headline says a heart pump accessory was recalled for blood clots. The engineering record says something narrower and considerably more portable: a component whose intended-use statement described two procedural moments spent four days inside a femoral artery, and the risk file was written against the sentence rather than against the duty cycle.

Every consequence follows from that one omission. The ISO 10993-1 duration category was decided by the sentence, which decided which ISO 10993-4 thrombosis testing was owed, which decided that ninety-six hours of annular stasis was never characterized. The applicable product standard, ISO 11070, was silent because it bounds the sheath as a conduit and nobody noticed that the real device is a resident. The Clause 7.4 trade-off between access-site injury and annular stasis went unrecorded because the second half of it was outside the frame. And the detection strategy ended up as a clinician's thumb on a syringe plunger, plus a look at the valve after the pump is already out.

Then the compatibility constraint took over. Because the low-profile kit mates only with the 10th-generation Impella CP set, there was no fallback sheath to switch to. The only available containment was to withdraw both. A component-level risk decision became a platform-level market action — which is what always happens when an accessory is treated as an accessory right up until it is the only thing holding the artery open.

Six hospitals. Three serious injuries. No deaths. By recall standards this is a small one, and it will be forgotten by October. It is worth keeping because it is the cleanest example I have seen this year of a specific, checkable failure: a use specification with no duration field, on a device whose entire hazard is duration.

If you build accessories, go read your own Device Use paragraph today and ask whether it contains a number. If it contains only verbs, you have this same file open somewhere.

Sources

— Jherrod Thomas, The Lion of Functional Safety™