What it is
ISO 14971 is the international standard that defines a risk management process for medical devices and IVDs across the full lifecycle. It requires manufacturers to plan, analyze, control, and monitor risks, then document decisions and residual risk to support safe, effective use (ISO 14971:2019; companion guidance ISO/TR 24971:2020). It applies to hardware, software, and SaMD and aligns with EU MDR/IVDR and FDA QMSR expectations.
Regulatory framework
- EU (MDR/IVDR): Risk management embedded in General Safety and Performance Requirements (MDR Annex I Ch. I §1–9; IVDR Annex I). Technical documentation must show risk control and benefit–risk (Annex II–III).
- US (FDA): QMSR (21 CFR 820) expects risk-based design and production controls; design validation must show user needs and intended use (21 CFR 820.30(g)). Residual risk information appears in applicable product standards (e.g., IEC 60601-1).
- Standards set: ISO 14971:2019 (requirements) with ISO/TR 24971:2020 (practical guidance); links to IEC 62366-1 (use-related risk), IEC 62304/IEC 82304-1 (software risk), and cybersecurity (IEC 81001-5-1).
Key elements / What it covers
- Risk management plan: Scope, roles, criteria, and methods.
- Hazard analysis: Hazards, foreseeable misuse, user errors, and hazardous situations.
- Risk estimation & evaluation: Severity/occurrence logic with acceptance criteria tied to policy.
- Risk control: Inherent safety by design → protective measures → information for safety; verify effectiveness.
- Residual risk & benefit–risk: Justify acceptability and disclose needed information in labeling.
- Risk management report & file: Consolidated conclusions with full traceability; living documentation.
Process — how it works
- Plan: Approve a risk plan with acceptance criteria, interfaces, and review gates (ISO 14971 §4).
- Analyze: Identify hazards from design, use, software, supply chain, and environment; map to hazardous situations.
- Evaluate & control: Prioritize risks; implement layered controls; verify they work and do not introduce new risks.
- Assess residual risk: Recalculate; weigh benefit–risk; define labeling and training needs.
- Review & release: Issue a risk management report; link to design validation and clinical evidence.
- Monitor: Feed PMS/PMCF, complaints, and field data back into the file; trigger CAPA when trends emerge.
Common pitfalls
- Listing hazards without specific, verified controls or tests.
- Skipping foreseeable misuse and usability-driven errors.
- Accepting residual risk without a clear, documented benefit–risk rationale.
- Letting the file go stale; not updating after changes, complaints, or new science.
- Using warnings as primary controls instead of safer design options.
Quick checks / Tips
- Trace each hazard → control → verification → residual risk decision.
- Confirm acceptance criteria match company policy and standards.
- Show how usability (IEC 62366-1) and software/cyber risks (IEC 62304/IEC 81001-5-1) are addressed.
- Update the file with PMS/PMCF signals and revise labeling when needed.
FAQ
Is ISO 14971 mandatory?
Regulators do not name it universally, yet MDR/IVDR and FDA QMSR require an effective risk process. ISO 14971 is the accepted way to demonstrate that process.
How does ISO 14971 link to MDR?
It operationalizes MDR Annex I risk requirements. Your technical documentation must show risk controls, residual risk, and benefit–risk that support claims.
Do software and SaMD follow ISO 14971?
Yes. Apply ISO 14971 along with IEC 62304/IEC 82304-1 and cybersecurity controls; include data integrity, updates, and alarm logic in the risk file.
What proof do reviewers expect?
A complete, current risk file: plan, analyses, control verification, residual-risk rationale, and a signed risk management report tied to testing, usability, and clinical evidence.
When should we update the risk file?
At design or process changes, new hazards, complaint trends, field actions, or new science; also at planned intervals tied to PMS/PMCF.