_1762866128417-DS2_OO1j.png)
What ISO 14971 covers
ISO 14971 describes how manufacturers manage the risks of their medical devices – including software and in vitro diagnostics – across the entire lifecycle. The standard requires a systematic process: identify hazards, estimate and evaluate risks, implement controls, verify their effectiveness and continuously evaluate information from production and the market.
The current edition is ISO 14971:2019. Additional guidance on application is provided in technical report ISO/TR 24971:2020. In Europe the standard is harmonised as EN ISO 14971 under the EU MDR. ISO 13485 requires documented risk management in product realisation in clause 7.1 – in practice ISO 14971 is applied for this.
The risk management process
- 1
Risk management plan (4.4)
Define scope, lifecycle phases, responsibilities, criteria for risk acceptability and verification activities.
- 2
Risk analysis (5)
Describe the intended use and reasonably foreseeable misuse, identify safety-related characteristics, hazards and hazardous situations, and estimate risks.
- 3
Risk evaluation (6)
Compare each estimated risk with the acceptability criteria.
- 4
Risk control (7)
Select controls in a fixed order of priority: inherently safe design, protective measures, information for safety. Verify implementation and effectiveness, evaluate residual risks.
- 5
Evaluation of overall residual risk (8)
Weigh the combined residual risks against the benefit.
- 6
Risk management review (9)
Before commercial release, check that the plan has been implemented and the overall residual risk is acceptable.
- 7
Production and post-production activities (10)
Collect and review information from production, complaints, the market and literature, and feed it back into the risk management file.
The risk management file
All results of the process are brought together in the risk management file. It does not have to be a single document – what matters is traceability from each hazard through risk estimation and controls to evidence of their effectiveness.
| Component | Content |
|---|---|
| Risk management plan | Scope, responsibilities, acceptability criteria, verification |
| Risk analysis | Intended use, characteristics, hazards, hazardous situations, estimation |
| Risk controls and verification | Selected controls, implementation and effectiveness evidence |
| Residual risk evaluation | Individual residual risks and overall residual risk with benefit-risk analysis |
| Risk management report | Result of the review before release |
| Post-production information | Evaluation of complaints, incidents and market data |
How docxpert supports your risk management
Risk analysis methods
ISO 14971 does not prescribe a specific method. ISO/TR 24971 lists several techniques that are often combined:
| Method | Typical use |
|---|---|
| Preliminary hazard analysis (PHA) | Early development, overview of hazards |
| FMEA (design, process, use) | Systematic review of failure modes and their effects |
| Fault tree analysis (FTA) | Chains of causes for an undesired event |
| Usability analysis | Use errors per IEC 62366-1 |
| HAZOP | Deviations in processes and workflows |
Embedding risk management in the organisation
ISO 14971 requires not just a risk analysis per product but a defined process with clear responsibilities. Top management sets a policy for the criteria for risk acceptability, provides qualified personnel and reviews the suitability of the process at planned intervals.
- 1
Policy and responsibilities
Define and approve the criteria for risk acceptability and the roles in risk management.
- 2
Document the procedure
Describe the process as a procedure, including methods and interfaces with design, production and complaint handling.
- 3
Qualify personnel
Train participants in methods and product knowledge and record their competence.
- 4
Review regularly
Evaluate the suitability of the process in the management review and implement improvements.
Practical tips
- Set acceptability criteria early: without clear criteria in the plan, no evaluation can be justified traceably.
- Follow the order of priority: safety information in the instructions for use is the last option, not the first.
- Prove effectiveness: every risk control needs verification evidence, such as a test report or a usability study.
- Use market data: regularly check complaints and incidents against the risk analysis and adjust assumptions.
Frequently asked questions
Is ISO 14971 mandatory for medical devices?
The MDR does not explicitly mandate the standard but requires a risk management system in Annex I. As a harmonised standard, EN ISO 14971 is the usual way to demonstrate this and is expected by notified bodies.
Does ISO 14971 apply to software as a medical device?
Yes. The standard applies to all medical devices including software. IEC 62304 for software and IEC 62366-1 for usability are often applied alongside it.
What is the difference between a hazard and a hazardous situation?
A hazard is a potential source of harm, such as electrical energy. A hazardous situation arises when people are exposed to that hazard, such as touching a damaged housing. Risks are estimated for hazardous situations.
Can I keep FMEA tables in docxpert?
You can create and version tables in controlled documents. docxpert does not currently offer a specialised FMEA tool with automatic risk calculation.
How often must the risk management file be updated?
Whenever new information becomes available – for example from complaints, incidents, design changes or the literature – and as part of regular post-market surveillance.
Is there an automatic gap analysis for ISO 14971?
There is currently no dedicated requirement catalogue for ISO 14971. The gap analysis for ISO 13485 does cover the requirements for risk management in product realisation.
When should a medical device risk management file be updated?
Review the file in response to events, not only on a fixed calendar date. A new intended purpose, design change, supplier change, complaint, unexpected event or new surveillance information may affect the assessment. Check whether hazards, hazardous situations, probability estimates, severity and the effectiveness of existing controls remain valid. Link changes to the affected product configurations and record which data triggered the reassessment. Updating the file does not mean every risk must be recalculated; document why an existing assessment remains unchanged when that is the conclusion. Define owners and escalation routes so information from production, service and market monitoring reaches the file promptly. This keeps it a lifecycle record rather than a project document created once and forgotten.