ISO 14971: risk management for medical devices
ISO 14971:2019 is the international standard for risk management of medical devices. The standard is published by ISO and is available in the Netherlands via NEN . ISO 13485 explicitly refers to ISO 14971 for its risk management requirements. You cannot conform to ISO 13485 if your risk control does not align with 14971.
The risk management file is also a mandatory part of your technical documentation under the EU MDR 2017/745 . The two standards complement each other: ISO 13485 secures the system, ISO 14971 secures the product. See also how the requirements of ISO 13485 position risk management as part of product realisation.
ISO 14971:2019 is the third edition of the standard. The update places extra emphasis on embedding risk management strategically and operationally across the whole product lifecycle, including post-market surveillance.
ISO 14971 and ISO 13485 at a glance
| Aspect | ISO 14971 | ISO 13485 |
|---|---|---|
| Purpose | Control the risks of the device | Secure quality processes |
| Scope | Product-specific (per device) | Organisation-wide (QMS) |
| Output | Risk management file per product | Quality system as a whole |
| Mandatory under | MDR Annex I (GSPR), ISO 13485 clause 7.1 | ISO 13485 certification |
| Auditor | Notified body (product conformity) and certification body (QMS) | Certification body |
The ISO 14971 risk management process step by step
Draw up a risk management plan
For each device, draw up a plan that records the scope, responsibilities, methods and acceptance criteria. This plan is the basis of your file.
Identify hazards
Map out all possible hazards linked to the device: use, misuse, environmental factors, interaction with other devices. Use structured methods such as Preliminary Hazard Analysis (PHA) or FMEA.
Estimate risk
Assess each hazard for severity (how serious the harm would be) and probability (how likely it is to occur). Combine them into a risk score. ISO 14971 does not prescribe a fixed method, but you must document your approach.
Control risk
Take measures in order of priority:
- Safe by design (inherently safe design).
- Protective measures (alarms, guards).
- Information for safety (labels, instructions for use).
Evaluate residual risk
Assess the residual risk after measures have been taken. Is it acceptable? Sometimes the benefit of the device outweighs the residual risk, but this must be demonstrably justified.
Analyse risk-benefit
If residual risks remain, you show that the benefits for the patient outweigh the risks. This is mandatory under ISO 14971 and the MDR.
Keep the risk management file up to date
The file is a living document. Every product change, complaint or CAPA outcome can be a reason to revise it. Link it to your CAPA system and post-market surveillance.
Example risk assessment (simplified)
| Hazard | Scenario | Severity (1-5) | Probability before measure (1-5) | Measure | Probability after measure (1-5) | Residual risk acceptable? |
|---|---|---|---|---|---|---|
| Incorrect use of wireless monitor | Wrong alarm limit set by the user | 4 | 3 | Mandatory confirmation step in the interface and a warning in the IFU | 1 | Yes |
| Electromagnetic interference | Device does not function in an intensive care (IC) environment | 5 | 2 | EMC testing according to IEC 60601-1-2, stated in the usage restrictions | 1 | Yes |
| Incorrect calibration after maintenance | Deviating measurement value, wrong clinical decision | 4 | 2 | Calibration procedure and training requirement in service documentation | 1 | Yes |
Relationship with post-market surveillance and CAPA
ISO 14971 requires you to keep managing risk until the end of the product lifecycle. Post-market surveillance (PMS) provides new data that can affect your risk file:
- Complaints and side effects can reveal new hazards.
- Trends in your complaint records can be a reason to review the risk.
- A field safety corrective action (FSCA, a recall) always requires a review of the risk management file.
You follow up on these through your CAPA process. New risk data must also be recorded in your technical documentation.
Common mistakes when implementing ISO 14971
| Mistake | Why it is a problem | Better approach |
|---|---|---|
| Treating the risk management file as a one-off project | The file goes out of date and no longer matches the product | Plan periodic reviews and link them to change management |
| Defining hazards too broadly | Measures then become vague and cannot be tested | Describe each hazard specifically and per use scenario |
| Acceptance criteria missing from the plan | The auditor cannot judge whether residual risks are acceptable | Record them in the risk management plan before the analysis starts |
| PMS data not fed back | New risk insights are missed | Define an explicit process linking PMS and complaints to the risk file |
A risk management file without a link to PMS and CAPA is an audit finding at the notified body and at your ISO 13485 certification body.