ISO 14971 — Medical Device Risk Management

Why does it matter?

ISO 14971:2019 gives manufacturers one lifecycle process for medical device risk, from the first hazard to post-production feedback. The EU lists it as a harmonized standard under the Medical Devices Regulation.

Key benefits include:

• Benefit is a defined term

The 2019 edition defines benefit, reasonably foreseeable misuse and state of the art, and aligns benefit-risk analysis (clause 7.4) with the terminology used in some regulations.

• Overall residual risk has criteria

The method for evaluating overall residual risk and the criteria for its acceptability are defined in the risk management plan, and can differ from the criteria for individual risks (clauses 4.4 and 8).

• Security risks are in scope

Risks related to data and systems security are named in the scope, and the foreword says the process can manage them.

• A documented review before release

The review before commercial distribution checks execution of the risk management plan, and its results are documented as the risk management report (clause 9).

• Post-production feedback

Clause 10 sets what information to collect, how to review it and which actions to take when it is relevant to safety.

How does it work?

ISO 14971:2019 has ten clauses and three informative annexes. Clause 4 sets general requirements: the risk management process (4.1), management responsibilities (4.2), competence of personnel (4.3), the risk management plan (4.4) and the risk management file (4.5). Annex A gives the rationale for the requirements, Annex B the risk management process for medical devices and Annex C fundamental risk concepts.

Clause 5 covers risk analysis: intended use and reasonably foreseeable misuse (5.2), characteristics related to safety (5.3), hazards and hazardous situations (5.4) and risk estimation (5.5). Clause 6 evaluates risk. Clause 7 controls it through option analysis (7.1), implementation (7.2), residual risk evaluation (7.3), benefit-risk analysis (7.4), risks arising from control measures (7.5) and completeness of risk control (7.6).

Clause 8 evaluates overall residual risk and clause 9 is the review before commercial distribution. Clause 10 covers production and post-production activities: general (10.1), information collection (10.2), information review (10.3) and actions (10.4).

Key Elements

• Risk management plan and file (clauses 4.4 and 4.5)

The plan sets the activities and criteria, including those for overall residual risk. The file holds the records of the risk management process.

• Intended use and misuse (clause 5.2)

The intended use and the reasonably foreseeable misuse of the device, which frame the hazard analysis.

• Hazards and hazardous situations (clauses 5.4 and 5.5)

Identification of hazards and hazardous situations, and estimation of the resulting risk.

• Risk evaluation (clause 6)

Each estimated risk is evaluated against the manufacturer's objective criteria for risk acceptability.

• Risk control (clause 7)

Control options, implementation, evaluation of residual risk, benefit-risk analysis, risks arising from controls and completeness of risk control.

• Production and post-production (clause 10)

Information collection, review of that information and actions when it is relevant to safety.

What does it cover?

ISO 14971:2019 applies to all phases of a medical device life cycle and to risks such as those related to biocompatibility, data and systems security, electricity, moving parts, radiation and usability. It can also be applied to products that are not medical devices in some jurisdictions. It does not apply to decisions on using a device in a particular clinical procedure or to business risk management. Risk management can be part of a quality management system, but the standard does not require one (clause 1).

What are its objectives?

ISO 14971:2019 sets out a process through which a manufacturer can (introduction):

Identify the hazards associated with the medical device.

Estimate and evaluate the risks associated with those hazards.

Control these risks.

Monitor the effectiveness of the controls throughout the life cycle of the device.

Apply the process to all phases of the life cycle, using objective criteria for risk acceptability that the manufacturer establishes (clause 1).

Framework in Context

ISO/TR 24971:2020 is the companion guidance and keeps the clause numbering of this standard. Other standards or regulations can require specific risk management methods for a particular device, and those must also be followed (introduction). The FDA states that its QMSR, which incorporates ISO 13485:2016, now specifically requires risk management. The European Standard EN ISO 14971:2019 was approved by CEN on August 5, 2019 without modification, and Implementing Decision (EU) 2021/1182 lists it with its A11:2021 amendment.

Common Framework Mappings

Organizations commonly map ISO 14971 to related medical device, quality, safety, and information security frameworks to harmonize risk controls, demonstrate regulatory compliance, and align design, testing, and cybersecurity practices.

Mapped frameworks include:

FDA 21 CFR Part 820 (Quality Management System Regulation, QMSR)

IEC 60601-1

IEC 62304

IEC 62366-1

ISO 13485

ISO 31000

ISO/IEC 27001

NIST Cybersecurity Framework