Updated: 24th June 2026
Reviewed by: David Small BSc (Hons), MSc, MTOPRA (Founder & CEO)
What is ISO 14971 Risk Management?
Every medical device and in vitro diagnostic (IVD) medical device placed on the market carries some degree of risk. Whether developing a simple Class I medical device, an AI-powered Software as a Medical Device (SaMD), an implantable device or a complex in vitro diagnostic system, manufacturers must systematically identify potential hazards, evaluate associated risks, implement appropriate risk control measures and continually monitor product safety throughout the product’s lifetime.
ISO 14971:2019, Medical devices — Application of risk management to medical devices, is the internationally recognised standard for performing risk management within the medical device industry. Rather than treating risk management as a one-off exercise during product development, ISO 14971 establishes a structured lifecycle approach that begins during concept and design, continues throughout verification, validation and production, and extends into post-market surveillance and continual improvement once the device has been placed on the market.
Effective risk management is far more than a regulatory requirement. It provides manufacturers with a systematic framework for designing safer products, reducing the likelihood of patient harm, demonstrating compliance with applicable legislation and supporting robust design decisions throughout the product lifecycle. The principles of ISO 14971 also underpin many other regulatory activities, including Clinical Evaluation, Performance Evaluation, Biological Evaluation, Usability Engineering, Software Lifecycle Processes, Post-Market Surveillance and Technical Documentation.
Under both the European Medical Devices Regulation (EU) 2017/745 (EU MDR) and the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (EU IVDR), manufacturers are required to establish, document, implement and maintain a comprehensive risk management system. Similar expectations apply under the UK Medical Devices Regulations 2002 (as amended), making ISO 14971 the recognised framework for demonstrating that risks have been appropriately identified, controlled and continuously reviewed.
This comprehensive guide explains the requirements of ISO 14971:2019, the key stages of the risk management process, how the standard integrates with ISO 13485 and other international standards, and how manufacturers can develop and maintain a compliant Risk Management File that supports CE marking, UKCA marking and ongoing regulatory compliance. Whether you are developing a medical device or an IVD, this guide will help you understand how effective risk management contributes to safer products, stronger technical documentation and successful market access.
New to the EU MDR?
ISO 14971 is one of the key standards supporting compliance with Regulation (EU) 2017/745. If you're looking for a complete introduction to the EU MDR, including manufacturer obligations, device classification, General Safety and Performance Requirements (GSPRs), Clinical Evaluation, Technical Documentation, UDI, EUDAMED and CE marking, read our EU MDR for Beginners Guide.
Manufacturing an In Vitro Diagnostic (IVD)?
ISO 14971 is equally important for manufacturers of in vitro diagnostic medical devices and forms a key part of demonstrating compliance with Regulation (EU) 2017/746. If you're looking for a complete introduction to the EU IVDR, including IVD classification, Performance Evaluation, Technical Documentation, Notified Body requirements, UDI and post-market obligations, explore our IVDR for Beginners Guide.
Understanding ISO 14971
ISO 14971:2019, Medical devices — Application of risk management to medical devices, is the internationally recognised standard that specifies how manufacturers should identify, evaluate, control and monitor risks associated with medical devices and in vitro diagnostic (IVD) medical devices throughout their entire lifecycle.
Unlike many international standards that prescribe specific technical requirements, ISO 14971 provides a structured framework for making informed, evidence-based decisions about product safety. It enables manufacturers to determine which hazards may arise, assess the likelihood and severity of harm, implement appropriate risk control measures and continually review whether those controls remain effective once the device is on the market.
The standard applies to virtually every type of medical device, regardless of its classification or technology. This includes simple Class I devices, sterile and measuring devices, implantable products, active medical devices, Software as a Medical Device (SaMD), artificial intelligence (AI) enabled technologies, reusable surgical instruments and in vitro diagnostic medical devices regulated under the IVDR.
One of the most important principles within ISO 14971 is that risk management is not a one-time activity completed during product development. Instead, it is a continuous process that begins when a device is first conceived and continues throughout design, manufacturing, verification, validation, production, distribution, post-market surveillance and eventual product retirement. Information gathered throughout the device’s lifecycle must continually feed back into the Risk Management File to ensure that new hazards, emerging risks and real-world performance are properly evaluated.
Manufacturers implementing ISO 14971 typically produce and maintain a series of interconnected documents that together demonstrate their risk management activities. These commonly include:
- A Risk Management Plan defining the scope, responsibilities and methodology.
- Risk Analysis documenting identified hazards and hazardous situations.
- Risk Evaluation assessing whether identified risks are acceptable.
- Risk Control documentation describing implemented risk reduction measures.
- Residual Risk Evaluation confirming remaining risks are acceptable.
- Benefit-Risk Analysis where necessary to justify residual risks.
- Production and Post-Production Information summarising feedback from complaints, vigilance, literature reviews, trend analysis and Post-Market Surveillance.
- A Risk Management Report confirming that the overall process has been completed and remains appropriate for the device.
Collectively, these records form the manufacturer’s Risk Management File, one of the core components of Technical Documentation under both the EU MDR and EU IVDR.
ISO 14971 at a Glance
| Topic | Summary |
|---|---|
| Standard | ISO 14971:2019 – Application of risk management to medical devices |
| Applies to | Medical devices and in vitro diagnostic medical devices |
| Purpose | Identify hazards, estimate and evaluate risks, implement controls and monitor ongoing safety |
| Lifecycle | Design, development, manufacturing, distribution, post-market surveillance and product retirement |
| Main Output | Risk Management File |
| Supports Compliance With | EU MDR, EU IVDR, UK Medical Devices Regulations, ISO 13485 and other international standards |
| Key Principle | Risk management is a continuous lifecycle activity, not a one-off exercise |
By following ISO 14971, manufacturers can demonstrate that safety has been systematically considered throughout product development and beyond. More importantly, they establish a repeatable process for continually improving product safety, supporting regulatory compliance and protecting patients, users and other stakeholders throughout the lifetime of their devices.
Why Risk Management Matters
Medical devices and in vitro diagnostic (IVD) medical devices are intended to improve patient outcomes, diagnose disease, support clinical decision-making or assist healthcare professionals in delivering treatment. However, every device also introduces potential hazards that could result in harm if they are not adequately identified and controlled. Effective risk management ensures that these risks are systematically assessed, reduced where possible and continually monitored throughout the product’s lifetime.
Risk management is therefore much more than a regulatory exercise. It is a fundamental design and business process that helps manufacturers develop safer products, improve product quality, reduce costly design changes, minimise recalls and protect both patients and the organisation’s reputation.
Rather than asking whether a device is completely safe—which is rarely achievable—ISO 14971 requires manufacturers to determine whether the remaining (residual) risks are acceptable when weighed against the expected clinical benefits of the device. This balanced approach allows manufacturers to make evidence-based decisions while continually seeking opportunities to improve safety through design, protective measures and information supplied to users.
Effective implementation of ISO 14971 provides benefits throughout the entire product lifecycle. During product development it helps engineers identify hazards early, allowing risks to be eliminated before they become expensive design problems. During regulatory submissions it provides objective evidence that risks have been systematically assessed and controlled. Once products are placed on the market, the Risk Management File continues to evolve by incorporating complaints, vigilance reports, Post-Market Surveillance (PMS), Post-Market Clinical Follow-up (PMCF), Post-Market Performance Follow-up (PMPF), literature reviews and trend analysis to ensure that new or changing risks are promptly identified.
From a regulatory perspective, risk management underpins almost every aspect of medical device compliance. It directly influences:
- Device design and development.
- General Safety and Performance Requirements (GSPRs).
- Clinical Evaluation and Performance Evaluation.
- Biological Evaluation under ISO 10993.
- Software development under IEC 62304.
- Usability Engineering under IEC 62366-1.
- Verification and validation activities.
- Technical Documentation.
- Post-Market Surveillance and Vigilance.
- Design changes throughout the product lifecycle.
For manufacturers operating under the EU MDR, EU IVDR or UK Medical Devices Regulations, maintaining an effective Risk Management File is not optional. It forms one of the central elements of Technical Documentation and is routinely reviewed by Notified Bodies, Approved Bodies and Competent Authorities during conformity assessment, audits and regulatory inspections.
Why ISO 14971 Is Important
| Benefit | Why It Matters |
|---|---|
| Improves patient safety | Identifies hazards before they result in harm. |
| Supports regulatory compliance | Demonstrates conformity with the EU MDR, EU IVDR and UK regulations. |
| Strengthens product design | Encourages safer design decisions from the earliest development stages. |
| Reduces business risk | Helps minimise recalls, complaints, corrective actions and liability. |
| Supports Technical Documentation | Provides documented evidence of systematic risk analysis and control. |
| Enables continual improvement | Incorporates post-market data to ensure risks remain acceptable throughout the device lifecycle. |
Ultimately, ISO 14971 provides manufacturers with a structured, repeatable methodology for making informed safety decisions. By embedding risk management into every stage of the product lifecycle, organisations can demonstrate regulatory compliance while delivering safer, more reliable medical devices and IVDs that inspire confidence among regulators, healthcare professionals and patients.
The ISO 14971 Risk Management Process
ISO 14971 establishes a structured and repeatable process for managing risks throughout the lifecycle of a medical device or in vitro diagnostic (IVD) medical device. Rather than focusing on individual hazards in isolation, the standard requires manufacturers to build an integrated risk management system that continually identifies new risks, evaluates existing controls and incorporates post-market information as products evolve.
Although every manufacturer may implement the process slightly differently depending on the complexity of their products and Quality Management System (QMS), the core principles remain the same. Each stage builds upon the previous one, ensuring that risks are identified early, appropriate control measures are implemented and product safety continues to improve throughout the device lifecycle.
1. Risk Management Planning
Every project begins with a Risk Management Plan that defines how risk management activities will be performed. This document establishes the scope of the process, identifies responsibilities, defines risk acceptability criteria and specifies the methods that will be used to identify, analyse and control risks.
The plan should be prepared before detailed design activities begin and should be reviewed whenever significant changes occur to the device or its intended purpose.
2. Hazard Identification
Manufacturers must systematically identify all reasonably foreseeable hazards associated with the device throughout its entire lifecycle.
Hazards may arise from numerous sources, including:
- Device design.
- Materials and biocompatibility.
- Electrical or mechanical failures.
- Software defects.
- Cybersecurity vulnerabilities.
- Manufacturing processes.
- Transport and storage.
- User errors and foreseeable misuse.
- Cleaning, maintenance and servicing.
- Disposal at the end of the device’s lifecycle.
The objective is to identify not only obvious hazards but also reasonably foreseeable situations that could ultimately result in harm.
3. Risk Analysis
Once hazards have been identified, manufacturers estimate the associated risks by considering:
- The severity of potential harm.
- The probability that harm may occur.
- The sequence of events that could lead to the hazardous situation.
Risk analysis should be supported by objective evidence wherever possible, including clinical literature, biological evaluation, software testing, usability studies, historical complaint data and published safety information.
4. Risk Evaluation
The estimated risks are then compared against the manufacturer’s predefined risk acceptability criteria established within the Risk Management Plan.
Risks that fall within acceptable limits may require no further action, while unacceptable risks must be reduced through appropriate risk control measures.
Importantly, ISO 14971 requires manufacturers to apply consistent and documented decision-making rather than relying on subjective judgement.
5. Risk Control
Where risks are not acceptable, manufacturers must implement appropriate risk control measures.
ISO 14971 establishes a preferred hierarchy of controls:
- Eliminate or reduce risks through inherently safe design.
- Introduce protective measures such as alarms, guards or automatic safety features.
- Provide safety information, warnings or Instructions for Use (IFU) where residual risks remain.
The standard makes clear that information supplied to users should not be the primary method of reducing risks where safer design solutions are reasonably achievable.
6. Evaluation of Residual Risk
Following implementation of risk control measures, manufacturers reassess the remaining (residual) risks to determine whether they have been reduced to an acceptable level.
If residual risks remain unacceptable, additional risk controls or design modifications may be required before the device can proceed further in development or be placed on the market.
7. Benefit-Risk Analysis
In some situations, residual risks cannot be completely eliminated without adversely affecting the intended purpose or clinical performance of the device.
Where this occurs, manufacturers must determine whether the expected clinical or diagnostic benefits outweigh the remaining risks. This assessment should be supported by objective clinical evidence and clearly documented within the Risk Management File.
If residual risks remain unacceptable, additional risk controls or design modifications may be required before the device can proceed further in development or be placed on the market.
8. Production and Post-Production Activities
Risk management does not end once a device has been placed on the market.
Manufacturers must continually collect and evaluate information from:
- Complaints.
- Vigilance reporting.
- Post-Market Surveillance (PMS).
- Post-Market Clinical Follow-up (PMCF).
- Post-Market Performance Follow-up (PMPF) for IVDs.
- Customer feedback.
- Literature reviews.
- Trend analysis.
- Field Safety Corrective Actions (FSCAs).
- Manufacturing and quality data.
This information should be used to determine whether new hazards have emerged, whether existing risks remain acceptable and whether additional risk control measures are required.
Ultimately, ISO 14971 views risk management as a continuous cycle of learning and improvement rather than a one-off regulatory exercise. By feeding real-world performance data back into the Risk Management File, manufacturers can continually strengthen product safety, demonstrate ongoing regulatory compliance and ensure that their devices continue to meet the expectations of regulators, healthcare professionals and patients throughout their lifecycle.
Key Risk Management Terminology Explained
Understanding the terminology used within ISO 14971 is essential for implementing an effective risk management system. Many of the concepts are closely related, but each has a specific meaning within the standard. Confusing these definitions can lead to poorly structured Risk Management Files, inconsistent risk assessments and difficulties during regulatory reviews.
The terms below form the foundation of every risk analysis performed under ISO 14971.
Hazard
A hazard is a potential source of harm.
A hazard does not necessarily cause injury by itself, but it has the potential to do so under certain circumstances.
Examples of hazards include:
- Electrical energy.
- Heat.
- Sharp edges.
- Software malfunction.
- Toxic materials.
- Radiation.
- Biological contamination.
- Incorrect diagnostic algorithms.
A hazard simply exists—it becomes significant when people or property are exposed to it.
Hazardous Situation
A hazardous situation occurs when a person, property or the environment is exposed to one or more hazards.
For example:
- A software error causes incorrect insulin dose calculations.
- A surgical instrument loses sterility before use.
- An IVD produces an incorrect positive test result.
- A battery overheats during charging.
The hazardous situation represents the circumstances that could ultimately lead to harm.
Harm
Harm is the actual injury or damage that results from a hazardous situation.
Harm may include:
- Patient injury.
- Delayed diagnosis.
- Misdiagnosis.
- Infection.
- Burns.
- Tissue damage.
- Death.
- Damage to property.
- Environmental damage.
ISO 14971 focuses on preventing harm by identifying hazards before they can progress to this stage.
Risk
Within ISO 14971, risk is defined as the combination of:
- the probability that harm will occur; and
- the severity of that harm.
This means that a highly severe event occurring very rarely may require similar attention to a less severe event that occurs frequently.
Manufacturers must evaluate both factors when determining whether a risk is acceptable.
Risk Control
Risk control refers to any action taken to eliminate a hazard or reduce an associated risk.
ISO 14971 establishes a preferred hierarchy:
- Eliminate the hazard through inherently safe design.
- Introduce protective measures.
- Provide information for safety, warnings or Instructions for Use (IFU).
Wherever possible, manufacturers should prioritise design improvements over reliance on user warnings.
Residual Risk
Residual risk is the level of risk that remains after all appropriate risk control measures have been implemented.
Because it is rarely possible to eliminate every risk entirely, manufacturers must determine whether the remaining risks are acceptable in light of the device’s intended benefits.
Residual risks should be continually reviewed using post-market information throughout the product lifecycle.
Benefit-Risk Analysis
When residual risks cannot be reduced any further, manufacturers must determine whether the expected clinical or diagnostic benefits outweigh those remaining risks.
Benefit-risk analysis should be based on objective evidence, including:
- Clinical Evaluation.
- Performance Evaluation.
- Scientific literature.
- Post-Market Surveillance data.
- Published clinical experience.
This analysis is particularly important for higher-risk devices where some level of residual risk may be unavoidable.
Risk Management File
The Risk Management File is the collection of records demonstrating that ISO 14971 has been properly implemented.
Rather than being a single document, it typically includes:
- Risk Management Plan.
- Hazard identification records.
- Risk Analysis.
- Risk Evaluation.
- Risk Control documentation.
- Verification of risk control measures.
- Residual Risk Evaluation.
- Benefit-Risk Analysis.
- Production and Post-Production information.
- Risk Management Report.
This file forms an integral part of the manufacturer’s Technical Documentation and provides objective evidence that risks have been systematically identified, evaluated, controlled and continually monitored throughout the product lifecycle.
ISO 14971 Terminology at a Glance
| Term | Definition | Example |
|---|---|---|
| Hazard | Potential source of harm | Electrical energy, software defect |
| Hazardous Situation | Circumstance where exposure to a hazard occurs | Incorrect software output reaching a clinician |
| Harm | Injury or damage | Misdiagnosis, infection, patient injury |
| Risk | Combination of probability and severity of harm | Likelihood of a false negative leading to delayed treatment |
| Risk Control | Measures implemented to reduce risk | Design improvements, alarms, protective barriers |
| Residual Risk | Remaining risk after controls have been applied | Small risk of incorrect measurement despite design controls |
| Benefit-Risk Analysis | Assessment of whether benefits outweigh remaining risks | Implantable device providing life-saving therapy despite known complications |
| Risk Management File | Collection of all documented risk management activities | Part of the Technical Documentation submitted for regulatory compliance |
Applying ISO 14971 Throughout the Medical Device Lifecycle
One of the defining characteristics of ISO 14971 is that risk management is not a standalone activity or a document completed solely for regulatory submissions. Instead, it is an integral part of every stage of the medical device and in vitro diagnostic (IVD) lifecycle, supporting safer product development, regulatory compliance and continual product improvement.
As new information becomes available, manufacturers are expected to review existing risks, identify emerging hazards and update their Risk Management File accordingly. This continuous approach ensures that safety remains central to every design decision throughout the lifetime of the device.
Product Design and Development
Risk management begins during the earliest stages of product development, often before detailed design work has started.
During design and development, manufacturers should:
- Identify foreseeable hazards associated with the intended purpose.
- Consider reasonably foreseeable misuse.
- Evaluate alternative design solutions.
- Incorporate inherently safe design principles wherever possible.
- Define design inputs based on risk reduction objectives.
- Verify that design outputs adequately address identified risks.
By identifying hazards early, manufacturers can often eliminate risks through design rather than relying on warnings or user training later in the development process.
Verification and Validation
Risk management plays a central role in determining which verification and validation activities are required.
Testing should demonstrate that:
- Risk control measures perform as intended.
- Safety features function reliably.
- Design changes have not introduced new hazards.
- The device continues to meet its intended performance requirements.
Examples include:
- Electrical safety testing.
- Mechanical performance testing.
- Software verification and validation.
- Biocompatibility testing.
- Sterility validation.
- Packaging validation.
- Shelf-life studies.
- Transportation testing.
Each activity provides objective evidence that identified risks have been appropriately controlled.
Clinical and Performance Evaluation
Clinical evidence is closely linked with risk management.
For medical devices, Clinical Evaluation helps determine whether the device achieves its intended clinical benefits while supporting benefit-risk conclusions.
For IVDs, Performance Evaluation demonstrates that analytical performance, scientific validity and clinical performance justify the residual risks associated with the device.
Clinical and performance data should continually feed back into the Risk Management File, particularly where new evidence changes the understanding of product safety.
Manufacturing and Quality Management
Risk management continues during production.
Manufacturers should monitor:
- Manufacturing processes.
- Process validation.
- Supplier performance.
- Incoming inspection.
- Non-conforming products.
- Corrective and Preventive Actions (CAPA).
- Change control.
- Internal audits.
A robust Quality Management System (QMS), such as one implemented in accordance with ISO 13485, helps ensure that manufacturing risks remain controlled and that any quality issues are systematically investigated.
Post-Market Surveillance
Risk management continues long after a device has been placed on the market.
Manufacturers should routinely review information from:
- Customer complaints.
- Vigilance reports.
- Field Safety Corrective Actions (FSCAs).
- Post-Market Surveillance (PMS).
- Post-Market Clinical Follow-up (PMCF).
- Post-Market Performance Follow-up (PMPF) for IVDs.
- Scientific literature.
- Trend analysis.
- Customer feedback.
- Internal quality data.
This information enables manufacturers to identify previously unknown hazards, assess whether residual risks remain acceptable and determine whether additional corrective actions are necessary.
Design Changes and Product Updates
Every significant design change should trigger a review of the Risk Management File.
Examples include:
- New materials.
- Software updates.
- Changes to manufacturing processes.
- New suppliers.
- Updated intended purpose.
- Expanded clinical indications.
- Packaging modifications.
- New sterilisation methods.
Manufacturers should assess whether these changes introduce new hazards or alter previously evaluated risks before implementing them.
Continual Improvement
ISO 14971 promotes continual improvement throughout the product lifecycle.
Rather than simply maintaining compliance, manufacturers should use information gathered from development, production and post-market activities to:
- Improve product safety.
- Reduce residual risks.
- Enhance product performance.
- Strengthen Technical Documentation.
- Improve future product designs.
- Increase user confidence.
- Support ongoing regulatory compliance.
This continual feedback loop is one of the reasons ISO 14971 is recognised as the international benchmark for medical device risk management.
Risk Management Across the Product Lifecycle
| Product Lifecycle Stage | How ISO 14971 Supports It |
|---|---|
| Product concept | Identifies hazards and defines the overall risk management strategy. |
| Design and development | Drives safer design decisions and risk reduction measures. |
| Verification and validation | Confirms that risk controls perform as intended. |
| Manufacturing | Controls production risks and monitors process quality. |
| Market approval | Supports Technical Documentation and regulatory submissions. |
| Post-market surveillance | Identifies new hazards and validates ongoing safety. |
| Product changes | Ensures modifications are assessed before implementation. |
| Product retirement | Reviews final safety information and supports lifecycle learning. |
By integrating risk management into every stage of the product lifecycle, manufacturers create a continuous process of evaluation, learning and improvement. This not only helps demonstrate compliance with the EU MDR, EU IVDR and UK Medical Devices Regulations but also supports the development of safer, higher-quality medical devices and IVDs that continue to meet the needs of patients, users and healthcare professionals.
Explore Risk Management Across the Device Lifecycle
ISO 14971 risk management should continue throughout the entire medical device lifecycle, from initial concept and design through manufacturing, Post-Market Surveillance and eventual product retirement. Learn how lifecycle information should continually feed back into the Risk Management File in our guide to the role of risk management in the medical device lifecycle.
How ISO 14971 Supports MDR and IVDR Compliance
While ISO 14971 is a voluntary harmonised standard rather than legislation, it has become the internationally recognised framework for demonstrating that manufacturers have systematically managed risks associated with their medical devices and in vitro diagnostic (IVD) medical devices. Applying the principles of ISO 14971 helps manufacturers meet many of the risk management expectations contained within the European Medical Devices Regulation (EU) 2017/745 (EU MDR), the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (EU IVDR) and the UK Medical Devices Regulations 2002 (as amended).
Rather than treating risk management as a separate activity, both the MDR and IVDR integrate risk management throughout the regulatory lifecycle. Manufacturers are expected to consider risk during device design, conformity assessment, clinical or performance evaluation, post-market surveillance and whenever significant changes are made to the device.
Risk Management Under the EU MDR
The EU MDR places risk management at the heart of the conformity assessment process. Manufacturers must establish, implement, document and maintain a comprehensive risk management system for every medical device placed on the European market.
Risk management directly supports compliance with several key MDR requirements, including:
- Demonstrating conformity with the General Safety and Performance Requirements (GSPRs) set out in Annex I.
- Supporting Clinical Evaluation by assessing whether the clinical benefits outweigh the residual risks.
- Justifying design decisions and implemented risk control measures.
- Providing objective evidence within the Technical Documentation.
- Continuously reviewing safety through Post-Market Surveillance (PMS) and Post-Market Clinical Follow-up (PMCF).
Notified Bodies will routinely review the Risk Management File as part of conformity assessment for devices requiring third-party certification.
Risk Management Under the EU IVDR
The principles of ISO 14971 are equally applicable to manufacturers of in vitro diagnostic medical devices.
Under the IVDR, risk management supports:
- Compliance with the General Safety and Performance Requirements.
- Performance Evaluation, including Scientific Validity, Analytical Performance and Clinical Performance.
- Demonstrating that the benefits of the IVD outweigh any residual risks.
- Ongoing Post-Market Performance Follow-up (PMPF).
- Continuous review of real-world performance data throughout the product lifecycle.
Although IVDs often present different types of risks compared with therapeutic medical devices, the structured approach defined by ISO 14971 remains the recognised methodology for evaluating and controlling those risks.
Integration with Technical Documentation
The Risk Management File is one of the most important components of a manufacturer’s Technical Documentation.
It provides evidence that:
- Hazards have been systematically identified.
- Risks have been estimated and evaluated.
- Appropriate risk control measures have been implemented.
- Residual risks are acceptable.
- Benefit-risk conclusions have been documented.
- Post-market information is continually reviewed.
Many other documents within the Technical Documentation either reference, or are directly supported by, the Risk Management File, making it one of the central documents reviewed during regulatory assessments.
Supporting Other Regulatory Activities
ISO 14971 also supports compliance across numerous related regulatory processes.
These include:
- Clinical Evaluation.
- Performance Evaluation.
- Biological Evaluation.
- Usability Engineering (IEC 62366-1).
- Medical device software development (IEC 62304).
- Verification and validation testing.
- Design and Development.
- Change control.
- Complaint handling.
- Vigilance reporting.
- Corrective and Preventive Action (CAPA).
- Post-Market Surveillance (PMS).
Rather than existing in isolation, effective risk management acts as the common thread that links these activities together, ensuring that safety considerations are consistently incorporated throughout the lifecycle of the device.
How ISO 14971 Supports Regulatory Compliance
| Regulatory Requirement | How ISO 14971 Contributes |
|---|---|
| EU MDR Annex I (GSPRs) | Demonstrates that risks have been identified, evaluated and controlled in accordance with the General Safety and Performance Requirements. |
| EU IVDR Annex I (GSPRs) | Supports systematic risk management for in vitro diagnostic medical devices throughout their lifecycle. |
| Clinical Evaluation | Provides the framework for assessing whether clinical benefits outweigh residual risks. |
| Performance Evaluation | Supports benefit-risk conclusions using scientific validity, analytical performance and clinical performance evidence. |
| Technical Documentation | Supplies objective evidence through the Risk Management File and supporting records. |
| Post-Market Surveillance | Ensures complaints, vigilance data and real-world evidence continually inform risk management activities. |
By integrating ISO 14971 into every stage of product development and regulatory compliance, manufacturers establish a robust, evidence-based approach to safety that aligns with the expectations of the EU MDR, EU IVDR and UK Medical Devices Regulations. Rather than being viewed as a standalone standard, ISO 14971 should be considered the foundation upon which many other regulatory activities are built, supporting safer devices, stronger Technical Documentation and more successful conformity assessments.
See How ISO 14971 and ISO 13485 Work Together
Risk management and quality management are closely connected. ISO 14971 provides the framework for identifying and controlling product risks, while ISO 13485 embeds those activities throughout your Quality Management System. Discover how the two standards complement each other in our guide to ISO 14971 and ISO 13485: How Risk and Quality Intersect.
Building and Maintaining a Risk Management File
One of the primary outputs of implementing ISO 14971 is the Risk Management File. This file provides documented evidence that the manufacturer has systematically applied risk management throughout the entire lifecycle of the medical device or in vitro diagnostic (IVD) medical device.
Contrary to popular belief, the Risk Management File is not a single document. Instead, it is a collection of interrelated records that demonstrate how hazards have been identified, risks have been analysed and evaluated, appropriate control measures have been implemented and the safety of the device continues to be monitored after it has been placed on the market.
The Risk Management File forms a key part of the Technical Documentation required under both the EU MDR and EU IVDR. During conformity assessments, Notified Bodies frequently review the file to verify that manufacturers have followed a structured, evidence-based approach to risk management and that all identified risks have been reduced as far as possible before considering whether any residual risks are acceptable.
What Should a Risk Management File Include?
Although the exact contents will vary depending on the complexity and classification of the device, a comprehensive Risk Management File will typically include:
- Risk Management Plan.
- Intended purpose and intended user profile.
- Device description.
- Hazard identification records.
- Risk Analysis.
- Risk Evaluation.
- Risk acceptability criteria.
- Risk control measures.
- Verification of implemented risk controls.
- Residual Risk Evaluation.
- Benefit-Risk Analysis (where required).
- Overall Residual Risk Evaluation.
- Production and Post-Production information.
- Risk Management Report.
These documents should be maintained under document control within the manufacturer’s Quality Management System (QMS) and updated whenever significant new information becomes available.
The Risk Management File Is a Living Document
One of the most common misconceptions is that the Risk Management File is completed during product development and then archived.
In reality, ISO 14971 requires manufacturers to continually review and update the file throughout the lifetime of the device.
Events that should trigger a review include:
- Design modifications.
- Software updates.
- Changes to the intended purpose.
- New clinical evidence.
- Performance Evaluation updates.
- Customer complaints.
- Vigilance reports.
- Field Safety Corrective Actions (FSCAs).
- Supplier changes.
- Manufacturing process changes.
- New hazards identified through Post-Market Surveillance.
- Updates to applicable standards or regulatory requirements.
Keeping the Risk Management File current ensures that it accurately reflects the latest understanding of the device’s safety profile and supports informed decision-making throughout the product lifecycle.
Integrating the Risk Management File with Technical Documentation
The Risk Management File does not exist in isolation. It supports, and is supported by, many other elements of the Technical Documentation.
For example:
- Clinical Evaluation provides evidence for benefit-risk conclusions.
- Biological Evaluation identifies and assesses biological hazards.
- Verification and validation reports demonstrate that risk controls perform as intended.
- Usability Engineering identifies use-related hazards.
- Software documentation supports the assessment of software-related risks.
- Post-Market Surveillance provides real-world evidence on whether residual risks remain acceptable.
- Design and Development records document how risk management influenced product decisions.
By maintaining clear links between these documents, manufacturers create a coherent Technical Documentation package that demonstrates a systematic and well-controlled approach to product safety.
Common Mistakes When Maintaining a Risk Management File
Manufacturers frequently encounter compliance issues because their Risk Management File is incomplete or no longer reflects the current state of the device.
Some of the most common deficiencies include:
- Treating the file as a one-off regulatory document.
- Failing to update the file following design changes.
- Missing links between identified hazards and implemented risk controls.
- Inconsistent risk acceptability criteria.
- Insufficient evidence supporting benefit-risk conclusions.
- Poor integration with Clinical Evaluation, Biological Evaluation or Post-Market Surveillance.
- Failure to incorporate complaint handling and vigilance data.
- Missing verification records confirming that risk control measures are effective.
Regular internal reviews, supported by an effective ISO 13485 Quality Management System, can help identify these issues before regulatory inspections or Notified Body assessments.
Typical Contents of a Risk Management File
| Section | Purpose |
|---|---|
| Risk Management Plan | Defines the overall strategy, responsibilities and acceptance criteria. |
| Hazard Identification | Records all known and reasonably foreseeable hazards. |
| Risk Analysis | Estimates the probability and severity of potential harm. |
| Risk Evaluation | Determines whether identified risks are acceptable. |
| Risk Control | Documents measures implemented to eliminate or reduce risks. |
| Verification of Controls | Demonstrates that risk control measures are effective. |
| Residual Risk Evaluation | Assesses risks remaining after controls have been implemented. |
| Benefit-Risk Analysis | Justifies residual risks where further reduction is not possible. |
| Production and Post-Production Information | Incorporates complaints, vigilance and Post-Market Surveillance data. |
| Risk Management Report | Confirms that the overall risk management process has been completed appropriately. |
A well-maintained Risk Management File is far more than a regulatory requirement—it is the central record demonstrating how safety has been considered, documented and continually improved throughout the lifecycle of a medical device or IVD. By keeping the file accurate, current and fully integrated with the wider Technical Documentation, manufacturers can support regulatory compliance while providing clear evidence that patient safety remains at the heart of product development.
Ready to Implement ISO 14971?
Understanding the requirements of ISO 14971 is only the first step. Successfully implementing risk management requires documented processes, hazard identification, risk analysis, risk control, verification activities and ongoing lifecycle monitoring. Follow our practical ISO 14971 Risk Management Implementation Guide for step-by-step advice on building a compliant Risk Management File and integrating risk management into your Quality Management System.
Common ISO 14971 Risk Management Mistakes
Although ISO 14971 provides a well-defined framework for medical device risk management, manufacturers frequently encounter the same issues when developing or maintaining their Risk Management Files. These deficiencies can lead to delays during regulatory submissions, findings during Notified Body or Approved Body audits, increased development costs and, most importantly, gaps in product safety.
Understanding these common pitfalls can help manufacturers build a more robust risk management system and avoid unnecessary compliance issues.
Treating Risk Management as a One-Off Activity
One of the most common mistakes is viewing risk management as a document that is completed during product development and then archived.
ISO 14971 requires risk management to continue throughout the entire product lifecycle. As new information becomes available through Post-Market Surveillance (PMS), complaints, vigilance reporting, software updates or design changes, the Risk Management File should be reviewed and updated accordingly.
Manufacturers that fail to maintain their documentation risk creating a disconnect between the device currently on the market and the supporting Technical Documentation.
Relying Too Heavily on Warnings and Instructions for Use
Risk control measures should always follow the hierarchy established by ISO 14971.
Manufacturers should first attempt to eliminate risks through inherently safe design. Where this is not possible, protective measures should be implemented before relying on warnings, labels or Instructions for Use (IFU).
Simply adding additional warnings rarely satisfies regulatory expectations if safer design solutions are reasonably achievable.
Incomplete Hazard Identification
Risk analysis is only as good as the hazards that have been identified.
Manufacturers sometimes focus solely on technical failures while overlooking hazards associated with:
- Foreseeable misuse.
- Human factors.
- Cybersecurity.
- Manufacturing variability.
- Environmental conditions.
- Transportation and storage.
- Cleaning and maintenance.
- End-of-life disposal.
A comprehensive hazard identification process should consider the entire lifecycle of the device.
Poor Traceability Between Documents
A recurring issue identified during regulatory assessments is poor traceability between the Risk Management File and other elements of the Technical Documentation.
For example:
- Clinical Evaluation identifies new risks that are not reflected within the Risk Management File.
- Verification reports demonstrate successful testing, but no link is made to the corresponding risk control measure.
- Post-Market Surveillance identifies emerging issues without triggering updates to the risk analysis.
Maintaining clear links between documents demonstrates that risk management has been integrated throughout the Quality Management System rather than treated as a standalone exercise.
Failing to Define Risk Acceptability Criteria
ISO 14971 requires manufacturers to establish documented criteria for determining whether identified risks are acceptable.
Without predefined criteria, risk evaluation becomes subjective and inconsistent, making it difficult to justify why one risk was accepted while another required additional control measures.
Clearly defined acceptance criteria improve consistency and provide objective evidence during regulatory reviews.
Not Updating the Risk Management File Following Changes
Every significant change should trigger a review of the Risk Management File.
Examples include:
- Software releases.
- New materials.
- Supplier changes.
- Manufacturing process changes.
- Expanded intended purpose.
- Updated clinical evidence.
- Corrective and Preventive Actions (CAPA).
- Design modifications.
Failure to reassess risks following these changes is a common finding during audits and conformity assessments.
Common Findings During Regulatory Assessments
Notified Bodies and Approved Bodies frequently identify similar deficiencies during Technical Documentation reviews.
These include:
- Missing or incomplete Risk Management Plans.
- Inconsistent risk scoring methods.
- Unsupported benefit-risk conclusions.
- Poor justification for residual risk acceptance.
- Missing verification of implemented risk controls.
- Failure to incorporate Post-Market Surveillance data.
- Outdated Risk Management Files.
- Weak traceability between risk management and supporting evidence.
Addressing these issues before submission significantly improves the quality of the Technical Documentation and reduces the likelihood of regulatory delays.
Avoiding Common ISO 14971 Mistakes
| Common Mistake | Best Practice |
|---|---|
| Treating risk management as a one-off exercise | Review and update the Risk Management File throughout the product lifecycle. |
| Relying primarily on warnings | Prioritise inherently safe design and protective measures before information for safety. |
| Incomplete hazard identification | Consider technical, biological, software, usability, manufacturing and post-market hazards. |
| Poor document traceability | Maintain clear links between risk management, Clinical Evaluation, testing and Post-Market Surveillance. |
| Undefined risk acceptance criteria | Establish objective, documented acceptance criteria within the Risk Management Plan. |
| Failure to update documentation | Review the Risk Management File following every significant product or process change. |
By avoiding these common mistakes, manufacturers can develop a more robust and defensible Risk Management File while demonstrating a systematic approach to patient safety and regulatory compliance. More importantly, embedding risk management into everyday product development supports continual improvement and helps ensure that medical devices and IVDs remain safe and effective throughout their entire lifecycle.
ISO 14971 and Other Medical Device Standards
Risk management does not operate in isolation. While ISO 14971 provides the framework for identifying, evaluating and controlling risks, it is closely integrated with many other international standards that support the design, development, manufacture and ongoing monitoring of medical devices and in vitro diagnostic (IVD) medical devices.
Rather than viewing these standards as separate compliance activities, manufacturers should consider them as components of a single quality and regulatory system. Information generated by one process often provides essential inputs to another, creating a continuous cycle of evidence-based decision-making that supports both regulatory compliance and patient safety.
ISO 13485 – Quality Management Systems
ISO 13485 establishes the Quality Management System (QMS) that supports the implementation of ISO 14971.
While ISO 14971 explains how risks should be managed, ISO 13485 ensures that appropriate procedures, responsibilities, document control, supplier management, change control and continual improvement processes are in place to consistently apply those principles throughout the organisation.
Together, these standards provide the foundation of an effective medical device quality system.
New to ISO 13485?
ISO 14971 provides the framework for managing product risks, but those activities must be embedded within a compliant Quality Management System. Discover how ISO 13485 supports medical device and IVD manufacturers by establishing the processes, documentation and controls needed to achieve regulatory compliance in our complete guide to ISO 13485.
IEC 62304 – Medical Device Software
For software and Software as a Medical Device (SaMD), risk management is embedded throughout the software lifecycle.
IEC 62304 requires manufacturers to consider software-related hazards during software development, verification, maintenance and change management. Risk management activities performed under ISO 14971 directly influence software safety classification, testing strategies and software architecture.
Developing Medical Device Software?
For devices containing software or Software as a Medical Device (SaMD), ISO 14971 works alongside IEC 62304 to ensure software risks are identified, controlled and monitored throughout the software lifecycle. Learn how software safety classification, development planning, verification, validation and maintenance fit into regulatory compliance in our complete guide to IEC 62304.
IEC 62366-1 – Usability Engineering
Many medical device incidents result from use errors rather than technical failures.
IEC 62366-1 focuses on identifying and reducing use-related risks through usability engineering. Findings from usability studies feed directly into the Risk Management File, helping manufacturers identify hazardous situations associated with normal use, foreseeable misuse and human factors.
Learn About IEC 62366-1 Usability Engineering
Many medical device risks arise from the way users interact with a product rather than from technical failures alone. IEC 62366-1 complements ISO 14971 by providing a structured usability engineering process to identify, evaluate and reduce use-related risks throughout the device lifecycle. Explore our complete guide to IEC 62366-1 usability engineering to learn how human factors support safer medical device design and regulatory compliance.
ISO 10993 – Biological Evaluation
Where devices come into direct or indirect contact with the human body, biological safety forms an essential part of the overall risk management process.
ISO 10993 supports the identification and assessment of biological hazards, including cytotoxicity, sensitisation, irritation and systemic toxicity. The results of Biological Evaluation contribute directly to the manufacturer’s overall risk assessment and benefit-risk conclusions.
Understanding Biological Evaluation?
Biological safety is a key component of medical device risk management. ISO 10993 works alongside ISO 14971 to identify, assess and control biological risks arising from materials, patient contact and device use. Learn how Biological Evaluation Plans (BEPs), Biological Evaluation Reports (BERs) and biocompatibility assessments support regulatory compliance in our complete guide to Biological Evaluation of Medical Devices.
Clinical and Performance Evaluation
Clinical Evaluation (for medical devices) and Performance Evaluation (for IVDs) provide objective evidence that a device achieves its intended purpose while maintaining an acceptable benefit-risk profile.
These activities help confirm that:
- Clinical benefits outweigh residual risks.
- Risk control measures remain effective.
- New hazards have not emerged.
- Real-world evidence supports continued market access.
Their conclusions should continually inform and update the Risk Management File throughout the product lifecycle.
Learn More About Clinical Evaluation
Clinical Evaluation and ISO 14971 work hand in hand to demonstrate that a medical device is both safe and achieves its intended clinical purpose. Clinical evidence helps verify that risk control measures are effective, confirms that the benefits outweigh any residual risks and provides ongoing evidence throughout the device lifecycle. Discover the complete process in our guide to Medical Device Clinical Evaluation.
Post-Market Surveillance
Risk management continues after a device has been placed on the market.
Post-Market Surveillance provides valuable real-world information that enables manufacturers to:
- Monitor product performance.
- Detect emerging safety signals.
- Identify previously unknown hazards.
- Evaluate whether residual risks remain acceptable.
- Improve future product designs.
This continual feedback loop is one of the core principles of ISO 14971 and helps ensure that risk management remains an active process rather than a historical record.
Explore Post-Market Surveillance (PMS)
Risk management doesn't end when a medical device is placed on the market. Post-Market Surveillance provides the real-world safety and performance data needed to identify emerging hazards, evaluate residual risks and continually update your Risk Management File throughout the device lifecycle. Learn more in our complete guide to Post-Market Surveillance for Medical Devices.
How ISO 14971 Integrates with Other Standards
| Standard | Relationship with ISO 14971 |
|---|---|
| ISO 13485 | Provides the Quality Management System that supports implementation of risk management. |
| IEC 62304 | Applies risk management principles throughout the software lifecycle. |
| IEC 62366-1 | Identifies and reduces use-related risks through usability engineering. |
| ISO 10993 | Evaluates biological hazards and supports biological risk assessment. |
| Clinical Evaluation | Demonstrates that clinical benefits outweigh residual risks. |
| Performance Evaluation | Confirms analytical and clinical performance while supporting benefit-risk conclusions for IVDs. |
| Post-Market Surveillance | Continuously monitors real-world safety and feeds new information back into the Risk Management File. |
No single standard can ensure the safety of a medical device or IVD in isolation. ISO 14971 provides the common framework that connects quality management, design and development, software engineering, biological evaluation, clinical evidence and post-market activities into a single, coherent risk management system. By integrating these processes, manufacturers can demonstrate compliance with the EU MDR, EU IVDR and UK Medical Devices Regulations while continually improving the safety and performance of their products throughout their lifecycle.
Regulating Medical Devices in the UK
Understanding ISO 14971 is an important part of UK medical device compliance, but it's only one element of the wider regulatory framework. Learn how device classification, MHRA registration, UKCA marking, Approved Bodies and ongoing regulatory obligations fit together in our complete guide to regulating medical devices in the UK.
Conclusion
ISO 14971 has become the internationally recognised standard for managing risks associated with medical devices and in vitro diagnostic (IVD) medical devices. By providing a structured framework for identifying hazards, evaluating risks, implementing effective risk control measures and continually monitoring product safety, the standard helps manufacturers develop safer products while demonstrating compliance with global regulatory requirements.
However, successful implementation of ISO 14971 extends far beyond creating a Risk Management File. Effective risk management should influence every stage of the product lifecycle, from initial concept and design through to manufacturing, regulatory submissions, Post-Market Surveillance and eventual product retirement. As new information becomes available, manufacturers are expected to continually reassess risks, review the effectiveness of existing controls and update their documentation to reflect the latest understanding of product safety.
Risk management also forms the foundation of many other regulatory activities. Clinical Evaluation, Performance Evaluation, Biological Evaluation, Usability Engineering, software development, verification and validation, Quality Management Systems and Technical Documentation all rely on the principles established by ISO 14971. When these processes are effectively integrated, manufacturers create a robust regulatory framework that supports both compliance and continual product improvement.
Whether you are developing a simple Class I medical device, a complex implantable device, Software as a Medical Device (SaMD) or an in vitro diagnostic medical device, applying the principles of ISO 14971 helps ensure that safety remains central to every design decision. More importantly, it provides objective evidence that risks have been systematically identified, evaluated and reduced as far as possible before being balanced against the expected benefits of the device.
Ultimately, ISO 14971 is more than a regulatory requirement—it is a lifecycle approach to patient safety. By embedding risk management into every stage of product development and continually learning from real-world experience, manufacturers can build safer medical technologies, strengthen their Technical Documentation and demonstrate ongoing compliance with the EU MDR, EU IVDR and UK Medical Devices Regulations.
How Can Patient Guard Help?
Patient Guard supports manufacturers with:
- ISO 14971 implementation
- Risk Management Files
- FMEA development
- MDR and IVDR compliance
- Clinical risk-benefit assessments
- Post-market risk management
- Technical documentation support
- Quality Management System integration
Our team can help manufacturers establish robust risk management processes that meet the requirements of ISO 14971 and applicable medical device regulations.
Contact Patient Guard to discuss your medical device risk management requirements.
Frequently Asked Questions About ISO 14971 and the Risk Management of Medical Devices
ISO 14971 is the international standard for the application of risk management to medical devices and in vitro diagnostic (IVD) medical devices. It provides a structured framework for identifying hazards, estimating and evaluating risks, implementing risk control measures and monitoring product safety throughout the entire device lifecycle.
ISO 14971 itself is a voluntary standard. However, the EU MDR, EU IVDR and UK Medical Devices Regulations require manufacturers to implement comprehensive risk management systems. Applying ISO 14971 is the internationally recognised method of demonstrating that these regulatory requirements have been met.
The current edition is ISO 14971:2019 – Medical devices — Application of risk management to medical devices. It is supported by ISO/TR 24971, which provides practical guidance on implementing the standard.
Yes. ISO 14971 applies to both medical devices and in vitro diagnostic medical devices. Under the EU IVDR, manufacturers are expected to apply systematic risk management throughout the entire lifecycle of their IVDs.
A Risk Management File is the collection of records demonstrating that a manufacturer has systematically identified hazards, evaluated risks, implemented risk controls and continually monitored product safety throughout the lifecycle of a device. It forms a key part of the Technical Documentation required under the EU MDR and EU IVDR.
A hazard is a potential source of harm, whereas risk is the combination of the probability that harm will occur and the severity of that harm. ISO 14971 requires manufacturers to evaluate both when assessing product safety.
A typical Risk Management File includes a Risk Management Plan, hazard identification records, Risk Analysis, Risk Evaluation, risk control documentation, verification records, Residual Risk Evaluation, Benefit-Risk Analysis where required, Production and Post-Production information, and a Risk Management Report.
ISO 13485 establishes the Quality Management System used by medical device manufacturers, while ISO 14971 provides the methodology for managing product risks. The two standards are closely integrated and are typically implemented together.
A Risk Management File should be reviewed whenever significant new information becomes available, including design changes, software updates, supplier changes, customer complaints, Post-Market Surveillance findings, vigilance reports or new clinical evidence.
Yes. ISO 14971 applies to software-based medical devices, including Software as a Medical Device (SaMD). It works alongside IEC 62304 to identify, evaluate and control software-related risks throughout the software lifecycle.
Residual risk is the level of risk that remains after all appropriate risk control measures have been implemented. Manufacturers must determine whether the remaining risks are acceptable when compared with the expected clinical or diagnostic benefits of the device.
A Benefit-Risk Analysis demonstrates that the expected medical or diagnostic benefits of a device outweigh any residual risks that cannot reasonably be eliminated. It is particularly important for higher-risk medical devices and IVDs.
Post-Market Surveillance provides real-world safety and performance information that helps manufacturers identify new hazards, evaluate the effectiveness of existing risk controls and update the Risk Management File throughout the product lifecycle.
Common issues include treating risk management as a one-off exercise, failing to update the Risk Management File after design changes, relying too heavily on warnings instead of inherently safe design, poor traceability between documents and inadequate integration with Clinical Evaluation or Post-Market Surveillance.
ISO 14971 provides the recognised framework for demonstrating that risks have been systematically identified, evaluated and controlled. A well-maintained Risk Management File supports compliance with the EU MDR, EU IVDR and UK Medical Devices Regulations and forms a key component of the Technical Documentation reviewed during conformity assessment.
References
This guide is based on the following legislation, international standards and official regulatory guidance relating to medical device risk management and ISO 14971.
| Organisation | Reference | Why it's relevant |
|---|---|---|
| International Organization for Standardization (ISO) | ISO 14971:2019 – Medical Devices – Application of Risk Management to Medical Devices | Defines the internationally recognised framework for identifying hazards, estimating and evaluating risks, implementing risk controls, evaluating residual risk and monitoring production and post-production information throughout the medical device lifecycle. |
| European Union | Regulation (EU) 2017/745 on Medical Devices (MDR) | Requires manufacturers to implement risk management throughout the entire lifecycle of a medical device and demonstrates how ISO 14971 supports compliance with the General Safety and Performance Requirements. |
| European Union | Regulation (EU) 2017/746 on In Vitro Diagnostic Medical Devices (IVDR) | Requires risk management for in vitro diagnostic medical devices and aligns with the principles established in ISO 14971 for demonstrating device safety and performance. |
| International Organization for Standardization (ISO) | ISO 13485:2016 – Medical Devices – Quality Management Systems – Requirements for Regulatory Purposes | Defines the Quality Management System requirements that integrate with ISO 14971, ensuring that risk management activities are embedded throughout design, manufacture, production and post-market surveillance. |
| U.S. Food and Drug Administration (FDA) | FDA Recognized Consensus Standard – ISO 14971:2019 | Confirms that the FDA recognises ISO 14971:2019 as a consensus standard for medical device risk management, supporting its use within U.S. regulatory submissions and quality systems. |
| European Commission | MDCG Endorsed Documents and Other Guidance | Provides official Medical Device Coordination Group guidance supporting implementation of MDR and IVDR requirements, many of which rely upon robust risk management processes based on ISO 14971. |
Risk management requirements continue to evolve through legislation, recognised standards and regulatory guidance. Manufacturers should always consult the latest published legislation, international standards and official guidance when implementing, maintaining and continually improving their risk management processes throughout the medical device lifecycle.
Patient Guards Recent Posts
IVDR Performance Evaluation Explained: A Complete Guide for Manufacturers
Performance Evaluation is one of the most important requirements under the EU In Vitro Diagnostic Regulation (IVDR). Every manufacturer must demonstrate that their in vitro diagnostic medical device achieves its intended purpose through robust scientific validity, analytical performance and clinical performance evidence. This guide explains every stage of IVDR Performance Evaluation, including Performance Evaluation Plans (PEPs), Performance Evaluation Reports (PERs), Post-Market Performance Follow-up (PMPF) and how Performance Evaluation supports successful CE marking under Regulation (EU) 2017/746.
IVDR Classification Explained: A Complete Guide to Class A, B, C and D IVDs
Understanding how your in vitro diagnostic device is classified under the EU IVDR is one of the first and most important steps towards regulatory compliance. This guide explains the IVDR classification rules, the differences between Class A, B, C and D IVDs, how Annex VIII is applied, and how classification affects conformity assessment, technical documentation and Notified Body involvement.
When Do You Need New Biocompatibility Testing for a Medical Device?
A material change, supplier switch, manufacturing transfer or design modification does not automatically require new ISO 10993 biocompatibility testing. Learn how manufacturers use Biological Evaluation Plans (BEPs), chemical characterisation, toxicological risk assessments and Biological Evaluation Reports (BERs) to determine whether existing biological evidence remains valid or whether additional testing is required under ISO 10993-1, the EU MDR and FDA expectations.
Patient Guards Regulatory Tools
Need Training?
Do you need training on Quality Management Systems or EU MDR/ EU IVDR? then check out our training courses.
