September 15, 2026 · 15 min read

ISO 14708-3 / ISO 14708-1ISO 14971 §5.2 / §7.1 / §1021 CFR 820.100 / Class I Recall

When the Fatigue Load Was Applied by the Surgeon: The Boston Scientific Infinion CX Lead Recall Through an ISO 14708-3 and ISO 14971 Lens

On September 3, 2026 the FDA published a Class I recall notice for the Boston Scientific Infinion CX spinal cord stimulator lead. One thousand and eighty-one serious injuries. Zero deaths. Roughly 1,079 unused leads being returned. The failure mode is one sentence long and it names the exact place on the part where the standard's type test does not reach.

I have spent most of this year writing about software that forgot something. This one is a piece of platinum-iridium and polyurethane failing in fatigue at a clamp, which makes it a refreshing change and a harder problem. Software you can patch. A lead that is already inside somebody's spine, you cannot.

1. The public record

Boston Scientific sent affected customers a letter on June 17, 2026 recommending that all unused Infinion CX Leads be removed from where they are used or sold and returned to the company. Two catalog items are named: the Infinion CX Lead Kit, 50 cm (SC-2317-50) and the Infinion CX Lead Kit, 70 cm (SC-2317-70). The FDA's recall database entry was created on August 5, 2026, and CDRH published the public recall notice on September 3, 2026, identifying it as the most serious recall type. (FDA recall notice; CDRH recall database, event 98974)

The FDA's stated reason is worth quoting exactly, because every clause in it is a design statement:

"Boston Scientific stated that the Spinal Cord Stimulator (SCS) System lead body may experience mechanical stress at the anchor site, which may result in high impedance measurements or lead fractures. Abnormal impedance measurement may lead to inadequate stimulation and/or additional intervention, including lead explant and replacement."

And the number: as of May 27, 2026, Boston Scientific reported 1,081 serious injuries and no deaths associated with the issue. (FDA recall notice)

Three details in the corrective action deserve attention before anyone gets to the engineering.

First, the scope. The action covers unused leads only. The FDA notice states plainly that it "does not affect the devices that have already been implanted," and that "no additional patient monitoring beyond routine clinical follow-up is recommended." The population that generated 1,081 serious injuries is the implanted population, and the control measure offered to that population is the follow-up schedule they were already on.

Second, the commercial framing. The FDA recall database entry describes the removal of unused Infinion CX leads as part of a planned transition to the next-generation Infinion Pro lead, and Boston Scientific told MedTech Dive that "Infinion CX leads were already being phased out" and that manufacturing had ended. The recall affects 1,079 devices per the database. (MedTech Dive, September 4, 2026; CDRH recall database entry 220311)

Third, the harm characterization. Boston Scientific's statement to MedTech Dive is careful and, read as an engineer rather than as a lawyer, revealing: "The most frequently observed harm is inadequate stimulation. If reprogramming does not resolve the issue, additional intervention, including lead explant or replacement, may be required. These interventions represent the most serious harm observed." The severity of the top harm is therefore a revision surgery on the spine, and the sequence to get there is: mechanical degradation, then impedance rise, then loss of therapy, then a failed attempt to reprogram around it, then a scalpel.

For background on the device: the Infinion CX lead is a percutaneous lead that carries electrical pulses from an implanted pulse generator to electrodes in the epidural space, where the stimulation masks pain signals travelling to the brain. It is indicated for management of chronic pain of the trunk and limbs. The anchor is the small silicone or polymer sleeve the implanting physician places over the lead where it exits the ligament, sutured down to the supraspinous fascia so the lead cannot migrate away from the target vertebral level.

That anchor is the entire story.

2. The standards lens

2.1 The load case nobody owns

A percutaneous SCS lead has three mechanically distinct zones. The distal segment floats in the epidural space and sees very little strain. The proximal segment runs subcutaneously to the generator pocket and sees gentle, distributed bending. Between them is a single point where the lead is rigidly clamped to bone-adjacent fascia by a suture that a human being tightened by hand, in a sterile field, by feel.

Every time the patient flexes or extends their spine, the free lead moves and the clamped lead does not. The strain concentrates at the clamp boundary. This is a textbook fatigue-at-a-stress-riser geometry, and the amplitude of the load depends on a variable the manufacturer does not control and, as far as the public record shows, never bounded: suture tension.

ISO 14708-3:2017, Implants for surgery — Active implantable medical devices — Part 3: Implantable neurostimulators, is the governing product standard. It is explicit that "the tests specified in this document are type tests and are to be carried out on a sample of a device," meaning the test article and its fixturing are defined by the manufacturer in the test plan. (ISO 14708-3:2017; ANSI Blog summary)

That is the gap. A flex-fatigue type test run on a lead held in a compliant, well-distributed fixture is a perfectly valid test of the lead. It is not a test of the lead as implanted, because as implanted the lead is held in a short, stiff, hand-tightened clamp that the test plan treated as an accessory rather than as a boundary condition. ISO 14708-1 requires the manufacturer to consider the device in its intended configuration; the anchor is part of that configuration whether or not it shares a model number with the lead.

The clause to write against is not a hidden one. It is the ordinary one, applied to the right test article.

2.2 The use specification that did not bound the input

ISO 14971:2019 §5.2 requires the manufacturer to document the intended use and reasonably foreseeable misuse, and IEC 62366-1 requires the use specification to identify the user profile and the use environment. A suture tension applied by a pain physician, in a prone patient, under fluoroscopy, at the end of a procedure, is a use-related input to a fatigue calculation.

If the Instructions for Use say "secure the anchor" without a specified torque, a specified suture, a specified knot count, or a go/no-go gauge, then the fatigue life of the joint is a free variable across the implanting population. You cannot write a meaningful S-N curve against an unspecified load. ISO 14971 §5.4 would have caught this as a foreseeable sequence of events: anchor over-tightened → local compression of the lead body → reduced effective cross-section and increased local strain → accelerated conductor fatigue → open circuit.

This is the same class of finding I wrote about in the Stellantis Dundee interlock case — a risk control whose effectiveness depends entirely on how a human executes it, with no verification that they executed it correctly, and no analysis of what happens when they do it with the best of intentions and too much force.

2.3 The detection signal that was already there

Here is the part that should bother every design engineer reading this. The FDA notice says the mechanical stress "may result in high impedance measurements or lead fractures."

Lead impedance is not an exotic measurement. It is a first-order diagnostic that the implanted pulse generator can take on every electrode contact, on a schedule, without patient action. The published clinical literature has, for years, listed impedance checks as one of the two standard ways to diagnose a lead fracture or disconnect — "lead fracture or disconnect occurs in 5.9%–9.1% of devices and is diagnosed through imaging of the lead or checking lead impedances." (ASRA News — Complications of Spinal Cord Stimulator Implantation)

So the device has a sensor for the degradation mechanism, on board, powered, already in the signal chain. And the risk control allocated to it, per the FDA notice, is "routine clinical follow-up" — a manual, episodic, appointment-driven check.

Under ISO 14971 §7.1, risk control options are applied in order of priority: inherently safe design first, protective measures second, information for safety last. Continuous on-device impedance trending with an automatic patient-facing notification is a protective measure. "See your physician at your next visit" is information for safety. A hazard that lands 1,081 people in the serious-injury column was controlled at the bottom of the hierarchy while a top-half control was sitting unused in the hardware.

2.4 The post-production loop

ISO 14971 §10 requires the manufacturer to actively collect and review production and post-production information, and — this is the operative sentence — to re-evaluate the risk assessment when the collected information shows that previously estimated risk is no longer acceptable.

The relevant question is not whether Boston Scientific collected the data. It is what the acceptance criterion was. Anchor-associated lead fracture in a Boston Scientific spinal cord stimulator was specific enough and public enough to be the subject of a case presentation titled "Lead Fracture of Boston Spinal Cord Stimulator implanted with Clik Anchor" at the 19th NANS Annual Meeting in 2015. (NANS 2015 abstract) The broader literature has reported lead breakage at roughly 9.1% incidence and hardware failure as 25–30% of the causes of explantation, with reoperation in about 9.5% of cases across 2–12 year follow-up. (J Neurosurg Spine 32(1), 2019; Rates and Causes of Reoperations Following Spinal Cord Stimulation)

When a well-known complication rate sits in the literature at high single digits, there is a strong pull to treat "we are in line with published rates" as evidence of acceptability. That is benchmarking, not risk management. ISO 14971 asks whether this residual risk is acceptable against your stated criteria and your benefit-risk argument — not whether it is average.

Note also what 21 CFR 820.100 (now harmonized under the QMSR) requires of the CAPA system: analysis of quality data to identify existing and potential causes of nonconforming product, using appropriate statistical methodology where necessary. Eleven years between a named case report and a Class I removal is a long time for a trend analysis to run.

3. A worked snippet

Here is the risk analysis I would expect to find in the file, written the way it should have been written before the first implant. Severity and probability bands are manufacturer-defined under ISO 14971; I am using a 5-level scale (S1 negligible through S5 catastrophic; P1 improbable through P5 frequent).

3.1 ISO 14971 risk rows (excerpt)

| ID | Hazard | Foreseeable sequence of events | Harm | S | P (pre-control) | Risk | Control allocated | | --- | --- | --- | --- | --- | --- | --- | --- | | RR-SCS-11 | Mechanical energy — cyclic strain concentration | Anchor sutured over lead body → spinal flexion/extension cycles → strain concentrated at clamp boundary → conductor fatigue → partial open circuit | Loss of therapy; revision surgery | S4 | P4 | Unacceptable | Anchor geometry change (strain relief); bounded suture tension; on-device impedance trending | | RR-SCS-12 | Mechanical energy — over-compression at implant | Physician over-tightens anchor suture → local cross-section reduction → accelerated fatigue at that point | Revision surgery | S4 | P3 | Unacceptable | Torque-limited or self-locking anchor; IFU with specified suture and knot count; intraoperative impedance check | | RR-SCS-13 | Functional — undetected degradation | Impedance rises over weeks → no automatic notification → patient self-titrates amplitude upward → conductor fails open between clinic visits | Abrupt loss of therapy; pain crisis; unscheduled surgery | S4 | P4 | Unacceptable | Automatic impedance trend alarm at patient remote and clinician portal | | RR-SCS-14 | Functional — compensatory programming masks trend | Clinician reprograms to alternate contacts to restore coverage → underlying mechanical failure progresses unrecorded | Delayed revision; larger explant | S3 | P3 | ALARP with control | Programmer shall log and flag reprogramming events driven by impedance excursion |

The rows that matter are RR-SCS-13 and RR-SCS-14. Both describe a degradation that the system can see and does not act on.

3.2 Fault tree — loss of stimulation therapy

                    TOP: Loss of effective SCS therapy
                    requiring surgical revision  [S4]
                                 |
                               (OR)
        _________________________|_________________________
       |                         |                         |
   G1 Conductor              G2 Degradation           G3 Correct
   open circuit at           undetected until         therapy not
   anchor boundary           therapy is lost          restorable by
       |                         |                    reprogramming
     (AND)                     (AND)                       |
   ____|____               _____|_____                 BE-3.1 Insufficient
  |         |             |           |                spare contacts /
BE-1.1    BE-1.2      BE-2.1        BE-2.2             coverage margin
Cyclic    Local       No on-device  Clinic
strain    strain      impedance     interval
above     riser from  trend alarm   longer than
design    anchor      implemented   degradation
allowable clamp                     window

   MINIMAL CUT SETS OF INTEREST
   {BE-1.1, BE-1.2}   -- mechanical, closed by design change
   {BE-2.1, BE-2.2}   -- detection, closed by ONE requirement (BE-2.1)

The point of drawing it is the second cut set. Closing BE-2.1 — implement the impedance trend alarm — breaks the detection path on its own, without touching the mechanical design, without a new 510(k) for the lead, and without waiting for a next-generation part. It is the cheapest requirement in this whole document and it is the one that is missing.

3.3 DFMEA row, AIAG-VDA style

| Item | Failure mode | Effect | S | Cause | O | Prevention control | Detection control | D | AP | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Lead body at anchor interface | Conductor fatigue fracture | Loss of stimulation; revision surgery | 9 | Cyclic strain concentrated at hand-tightened clamp; suture tension unbounded | 6 | Flex-fatigue type test fixtured with production anchor at specified tension; strain-relief geometry | Bench impedance measurement at end of line only | 8 | H | | Lead body at anchor interface | Partial conductor damage (high impedance, not open) | Progressive therapy degradation; amplitude creep | 7 | Same | 6 | Same | On-device impedance trend with automatic notification (not implemented) | 8 | H |

Action Priority is High on both rows, and it is High because of the Detection column, not the Occurrence column. That is the tell.

4. Derived requirements (excerpt)

| ID | Requirement | Traces to | | --- | --- | --- | | SYS-REQ-SCS-201 | Lead flex-fatigue type testing per ISO 14708-3 shall be performed with the production anchor installed on the test article at the maximum suture tension specified in the IFU, plus the design margin. The test article shall survive not fewer than 10,000,000 flexion cycles at the 95th-percentile spinal range of motion without a change in conductor resistance greater than 10 percent from baseline on any contact. | RR-SCS-11, BE-1.1, BE-1.2 | | SYS-REQ-SCS-202 | The anchor shall limit the compressive load transmitted to the lead body to a specified maximum regardless of applied suture tension, by mechanical means (self-locking or torque-limiting feature). Verification shall demonstrate that the limit holds at three times the maximum tension a clinician can apply by hand with the specified suture. | RR-SCS-12 | | SYS-REQ-SCS-203 | The implantable pulse generator shall measure impedance on every electrode contact at intervals not exceeding 24 hours, store a rolling 180-day trend, and classify each contact as nominal, drifting, or out-of-range against thresholds defined in the design file. | RR-SCS-13, BE-2.1 | | SYS-REQ-SCS-204 | On transition of any contact to the drifting or out-of-range classification, the system shall notify the patient at the remote control within 24 hours and flag the device record in the clinician portal within 24 hours. The notification shall be non-dismissible until acknowledged and shall not alter stimulation parameters on its own. | RR-SCS-13, BE-2.2 | | SYS-REQ-SCS-205 | The clinical programmer shall record, for every reprogramming session, the impedance vector before and after the change, and shall display a warning when a contact is being deselected while classified as drifting or out-of-range. Records shall be retrievable for post-production surveillance under ISO 14971 §10. | RR-SCS-14, CAPA input |

SYS-REQ-SCS-203 and -204 are the pair I would defend hardest, because they are firmware in the generator, not a change to the implanted lead. They protect the patients the recall explicitly does not cover. Everything else on this list helps the next cohort; those two help the cohort that already has the part in them.

5. What the headline really tells us

The headline says a lead was recalled. The database says 1,079 unused units and a planned product transition. Neither of those is the engineering event.

The engineering event is that the highest-stress boundary condition on this device is created during surgery, by a human, with an unspecified force, on a component the type test plan treated as an accessory — and that when the resulting degradation began to show up as a measurable electrical signal on an instrumented implant, the system's response was to wait for the patient's next appointment. Two missing artifacts, both ordinary: a flex-fatigue qualification fixtured with the production anchor at a bounded, specified tension, and an impedance trend alarm that turns a silent mechanical failure into an event with a timestamp.

The 1,081 serious injuries are not evidence that spinal cord stimulation is unusually dangerous; the published revision rates say it has always carried hardware risk. They are evidence that a known, named, decade-old failure mode stayed inside the acceptable band because the band was drawn against the literature average rather than against what the design could actually have achieved. ISO 14971 §10 does not ask whether you are normal. It asks whether you are still right.

6. Sources

— Jherrod Thomas, The Lion of Functional Safety™