Updated October 2026. Scope: medical device risk management under ISO 14971, the EU MDR, and the FDA QMSR. For a closer look at the analysis step itself, see the guide on how to analyze risk under ISO 14971.
Key takeaways
- Common failure mode: in practice, a risk file written after the design is fixed, which documents decisions instead of driving them. The regulation expects the opposite.
- The process: medical device risk management runs for the whole life of a device. You plan, identify hazards, estimate and evaluate risks, control them, judge what is left, and feed post-market information back in.
- The standard: ISO 14971:2019 sets out the method but does not tell you what level of risk is acceptable. You define those criteria for your device.
- EU and U.S.: the EU MDR makes a risk management system a legal requirement and fixes the order of risk controls. The FDA QMSR does not incorporate ISO 14971, but it does incorporate ISO 13485, which requires documented risk management processes and records.
What medical device risk management is
The MDR defines risk as “the combination of the probability of occurrence of harm and the severity of that harm.” Risk management is the discipline of finding those risks, deciding which ones are acceptable, and reducing the rest, then keeping that judgment current as the device meets real users.
The reference standard is ISO 14971:2019, Medical devices: Application of risk management to medical devices. It is the third edition, and ISO reviewed and confirmed it in 2025, so it remains current. It applies to medical devices generally, including software as a medical device and in vitro diagnostic devices, and covers the life cycle from concept through decommissioning.
One point is often misunderstood. ISO 14971 requires you to set objective criteria for risk acceptability, but it does not specify acceptable risk levels. Acceptability depends on the device, its intended use, and its benefits, so the criteria are yours to define, justify, and apply consistently.
How ISO 14971 structures the process
ISO 14971:2019 organises the process into a sequence of clauses:
| Clause | Stage |
|---|---|
| 4 | General requirements: the risk management process, management responsibilities, competence, the risk management plan, and the risk management file |
| 5 | Risk analysis: intended use and reasonably foreseeable misuse, characteristics related to safety, hazards and hazardous situations, risk estimation |
| 6 | Risk evaluation |
| 7 | Risk control: option analysis, implementation, residual risk, benefit-risk analysis, risks arising from controls, completeness |
| 8 | Evaluation of overall residual risk |
| 9 | Risk management review |
| 10 | Production and post-production activities |
The MDR describes the same arc in Annex I, Section 3. Manufacturers must establish and document a risk management plan for each device, identify and analyse known and foreseeable hazards, estimate and evaluate risks during intended use and reasonably foreseeable misuse, eliminate or control those risks, evaluate the impact of production and post-market surveillance information, and amend control measures where needed. The regulation calls this “a continuous iterative process throughout the entire lifecycle of a device, requiring regular systematic updating.”
Risk control: the order of priority
The MDR sets a baseline in Annex I, Section 4. Risk control measures must conform to safety principles, taking account of the generally acknowledged state of the art, and both the residual risk of each hazard and the overall residual risk must be judged acceptable. In selecting controls, manufacturers must follow this order of priority:
- Safe design and manufacture. Eliminate or reduce risks as far as possible through the design itself.
- Protection measures. Where appropriate, take adequate protection measures, including alarms if necessary, for risks that cannot be eliminated.
- Information for safety. Provide warnings, precautions, and contra-indications, and training where appropriate.
Manufacturers must also inform users of any residual risks. “As far as possible” has a defined meaning: Annex I, Section 2 states it means reducing risks as far as possible without adversely affecting the benefit-risk ratio.
ISO 14971 (clause 7.1) uses the same priority order: inherently safe design and manufacture, then protective measures, then information for safety and training. Where risk reduction is not practicable, the standard moves you to a benefit-risk analysis of the residual risk.
In practice, a warning in the instructions for use is the last line of defence, not the first. Relying on labelling to manage a risk that a design change could remove is a common and avoidable finding.
The risk management file
Everything above has to be evidenced. Under ISO 14971 (clause 4.5), the risk management file must provide traceability for each identified hazard to its risk analysis, its risk evaluation, the implementation and verification of its risk control measures, and the evaluation of its residual risk. A note to that clause explains that the file does not have to hold every record physically; it can point to records kept elsewhere in the quality system, as long as the information can be assembled in a timely manner.
A file that holds up to review lets a reader follow a single hazard from end to end:
- Hazard: the hazard and the hazardous situation it can lead to.
- Initial estimate: the risk before control, using the criteria in your risk management plan.
- Control: the measure chosen, and why a higher-priority option was not used.
- Verification: evidence that the control was implemented and is effective.
- Residual risk: the remaining risk and its acceptability.
- Post-market update: any production or field information that has since changed the picture.
How the EU and the U.S. treat risk management
EU MDR. Article 10(2) requires manufacturers to “establish, document, implement and maintain a system for risk management as described in Section 3 of Annex I,” and Article 10(9), point (e), lists risk management among the aspects the quality management system must address. Risk management is also built into the General Safety and Performance Requirements themselves, which is why it sits at the centre of the technical documentation (Annex II, Section 5).
U.S. FDA. Since 2 February 2026, the Quality Management System Regulation incorporates ISO 13485:2016 by reference (21 CFR 820.7 and 820.10). ISO 13485, in clause 7.1, requires the organisation to document one or more processes for risk management in product realization and to maintain records of risk management activities; a note to that clause points to ISO 14971 for further information.
In the QMSR final rule, FDA stated that it does not incorporate ISO 14971 into the regulation, while acknowledging that such standards “may be helpful in understanding application of ISO 13485.” FDA also rejected the view that ISO 13485 does not require a complete risk management system, explaining that an effective quality system should systematically identify, analyze, evaluate, control, and monitor risk throughout the product life cycle.
The U.S. requirement is therefore not compliance with ISO 14971 as such. It is a documented quality system that manages risk throughout the product life cycle. As industry practice rather than a regulatory requirement, most manufacturers use ISO 14971 as the method for doing that.
Where risk management connects to the rest of the system
Risk management is not a standalone document. It feeds and is fed by:
- Design and development: design inputs, verification, and validation all trace back to hazards and controls.
- Clinical evaluation: under MDR Article 61(1), the evaluation of the acceptability of the benefit-risk ratio must be based on clinical data, and under Annex XIV, Part B, Section 6.2(d), the PMCF plan must reference the risk management described in Annex I, Section 3.
- Post-market surveillance: complaints, trends, and field data are the evidence that confirms or corrects your risk estimates, and Annex I, Section 3 requires that information to be evaluated; Article 83(3)(a) also requires post-market surveillance data to be used to improve the risk management.
- Labelling: information for safety is a risk control, so the instructions for use and the risk file have to agree.
Common gaps
The following is practitioner observation, not a regulatory requirement. Weaknesses that reviewers and auditors commonly raise include:
- Late risk file: written after the design was fixed, so it documents decisions rather than driving them.
- Missing criteria: acceptability criteria that are absent, vague, or applied inconsistently between hazards.
- Warnings first: labelling used as the primary control without showing why design or protective measures were not possible.
- Broken feedback loop: complaint and post-market data collected but never fed back into risk estimates.
- No overall view: residual risk judged hazard by hazard, but the overall residual risk never evaluated as a whole.
Frequently asked questions
What is medical device risk management?
A continuous process, running through the whole life of a device, to identify hazards, estimate and evaluate the associated risks, control them, judge whether the remaining risk is acceptable against the benefits, and update that judgment with production and post-market information. ISO 14971:2019 is the international standard for it.
Does the FDA require ISO 14971?
Not directly. The QMSR incorporates ISO 13485, which requires documented risk management processes in product realization and records of risk management activities. FDA stated in the QMSR final rule that it does not incorporate ISO 14971, although such standards may be helpful in understanding application of ISO 13485. As industry practice, not a regulatory requirement, ISO 14971 is the method most manufacturers use to structure that risk management.
What order must risk controls follow under the EU MDR?
Annex I, Section 4 sets the priority: first eliminate or reduce risks through safe design and manufacture, then, where appropriate, take protection measures such as alarms, and only then provide information for safety such as warnings and training. Users must be informed of residual risks. ISO 14971 clause 7.1 uses the same order.
What is a risk management file?
Under ISO 14971 clause 4.5, the file that provides traceability for each identified hazard to its risk analysis, risk evaluation, the implementation and verification of its controls, and the evaluation of its residual risk. It can reference records held elsewhere in the quality system and must be kept current.
How does post-market data feed risk management?
The MDR requires manufacturers to evaluate how production and post-market surveillance information affects hazards, risk estimates, overall risk, and the benefit-risk ratio, and to amend control measures where needed. Complaints and trend data are the evidence that confirms or corrects the original risk estimates.
Related guides and services
- Quality management support from CENIT Consulting: building a risk management process and file that drive design decisions and stay current with post-market data.
- Regulatory Affairs support: aligning the risk file with the General Safety and Performance Requirements and the technical documentation.
For how ISO 14971 sits alongside ISO 13485 and the MDR, see the EU MDR, ISO 13485 and ISO 14971 crosswalk. For the requirements risk management serves, see the guide to the General Safety and Performance Requirements.
This article is for general information only and is not legal or regulatory advice. Teams remain responsible for regulatory decisions and staying current with applicable regulations and guidance.
Talk to CENIT Consulting about your risk management process and file: book a 30-minute consult.