Overview

The risk management standard for medical devices, specifying the process manufacturers use to identify hazards, estimate and evaluate risks, control them and monitor the effectiveness of controls across the device life cycle. Third edition, published 2019.

ISO 14971:2019, Medical devices — Application of risk management to medical devices, is the third edition and replaces ISO 14971:2007. It specifies a process for manufacturers to identify hazards associated with a medical device, estimate and evaluate the associated risks, control those risks, and monitor the effectiveness of the controls. It applies across the whole life cycle, and covers software as a medical device and in vitro diagnostic medical devices as well as physical devices.

The process it defines has a fixed shape. The manufacturer establishes a risk management plan and criteria for risk acceptability, identifies the intended use and reasonably foreseeable misuse, identifies the characteristics related to safety, identifies hazards and hazardous situations, estimates risk for each hazardous situation, evaluates it against the acceptability criteria, implements risk control measures, evaluates residual risk, evaluates overall residual risk, and reviews the whole thing before release. All of this is recorded in a risk management file.

Risk control follows a defined priority order: inherently safe design and manufacture first, then protective measures in the device itself or in manufacturing, and only then information for safety — labelling, instructions for use and training. Information for safety is the weakest control and cannot be used to justify an unacceptable design. The standard also requires the manufacturer to consider whether risk control measures introduce new hazards or affect existing risk estimates.

The 2019 edition made several substantive changes. Definitions of benefit, reasonably foreseeable misuse and state of the art were introduced. More attention is given to the benefits expected from use of the device, which matters because benefit-risk analysis is what permits residual risks that cannot be reduced further. Requirements for production and post-production activities were clarified and restructured, with more detail on the information to be collected once the device is on the market, how it is reviewed, and what actions follow when the information is relevant to safety. Much of the explanatory and guidance content that used to sit in annexes moved into the separate guidance document.

That guidance document is ISO/TR 24971:2020, Medical devices — Guidance on the application of ISO 14971. It is not a requirements document but is effectively indispensable: it explains how to apply the process, gives worked approaches to hazard identification and risk estimation, and covers particular areas such as risk management for software and for in vitro diagnostic devices. Work has also been undertaken on guidance for machine learning in artificial intelligence within this family.

ISO 14971 is not a certifiable standard in its own right. There is no ISO 14971 certificate. Conformity is assessed as part of a wider assessment: ISO 13485 requires risk management in accordance with ISO 14971 throughout product realization, so risk management files are examined during ISO 13485 certification audits, and notified bodies and regulators examine them during conformity assessment and premarket review. In the European Union the harmonized version, EN ISO 14971, carries annexes addressing the relationship between the standard's clauses and the requirements of the EU regulations.

In practice ISO 14971 is the hub that connects the other medical device standards. IEC 62304 requires software risk management consistent with it, IEC 62366-1 feeds use-related hazardous situations into it, the ISO 10993 series feeds biological risk into it, and IEC 60601-1 draws on it for electrical medical equipment. A device programme that treats these as separate exercises rather than inputs to a single risk management file tends to produce inconsistent conclusions.

Purpose

To specify terminology, principles and a process for risk management of medical devices, including software as a medical device and in vitro diagnostic medical devices, covering the whole life cycle from concept through post-production.

Key Benefits

• Provides the internationally accepted risk management process for medical devices
• Required in practice by EU MDR and IVDR conformity assessment and by other regulators
• Structures hazard identification, risk estimation, control and residual risk evaluation consistently
• Enforces a control priority order that puts safe design ahead of warnings and labelling
• Handles benefit-risk analysis explicitly, allowing justified acceptance of unavoidable residual risk
• Extends risk management into production and post-production information and field feedback
• Applies to software as a medical device and in vitro diagnostics, not only physical devices
• Acts as the integrating framework for usability, software, biocompatibility and electrical safety inputs
• Supported by ISO/TR 24971 guidance for practical application

Key Requirements

• Establish, document and maintain a risk management process across the device life cycle
• Define management responsibilities, competence of personnel and a risk management plan
• Define criteria for risk acceptability, including the policy for acceptable risk
• Identify the intended use and reasonably foreseeable misuse of the device
• Identify characteristics related to safety
• Identify hazards and hazardous situations, including those arising in normal and fault conditions
• Estimate the risk for each hazardous situation
• Evaluate estimated risks against the acceptability criteria
• Implement risk control measures in priority order: inherently safe design, protective measures, information for safety
• Verify implementation and effectiveness of each risk control measure
• Evaluate residual risk for each hazardous situation and any new risks introduced by control measures
• Conduct benefit-risk analysis where residual risk is not acceptable and reduction is not practicable
• Evaluate overall residual risk against the criteria in the risk management plan
• Review the risk management process and results before release and record the conclusion
• Collect and review production and post-production information, including from the market and similar devices
• Take action where post-production information affects the risk management results
• Maintain a risk management file containing or referencing all records and results

Who Needs This Standard?

Medical device and in vitro diagnostic manufacturers of all classes, developers of software as a medical device, contract design and development organizations, and their regulatory affairs, quality, systems engineering, software and clinical functions. It is also used by notified bodies, regulators and auditors assessing device safety, and by component and subsystem suppliers whose parts contribute to device risk.

Related Standards