ISO 14971

ISO 14971 is the risk-management standard for medical devices, and unlike a project-stage activity it runs across the entire lifecycle — design, production, post-production surveillance, and change. The process is a defined sequence: establish a risk management plan, identify hazards and hazardous situations, estimate and evaluate the associated risks, implement risk controls, evaluate residual risk, and then feed production and post-production information back into the analysis.

The control hierarchy is mandatory in order, and this is where implementations most often go wrong. Risk must first be reduced by inherently safe design; only where that is not practicable may protective measures in the device or manufacturing be used; and only then information for safety — labelling, warnings, instructions. A warning in the instructions for use is the weakest control and cannot substitute for a design change that was feasible.

The 2019 revision sharpened several points: benefit-risk analysis is required where residual risk is not acceptable, the overall residual risk must be evaluated as a whole rather than only risk by risk, and the standard aligns more closely with EU MDR expectations. Notably it removed the concept of reducing risk “as far as possible” being satisfied purely by economic considerations — cost alone is not a justification for accepting a controllable risk.

• —Lifecycle process: plan → identify hazards → estimate and evaluate → control → residual risk → post-production feedback.
• —Control hierarchy in order: inherently safe design → protective measures → information for safety.
• —A warning is the weakest control and cannot replace a feasible design fix.
• —Overall residual risk is evaluated as a whole, not only risk by risk (2019 revision).
• —Benefit-risk analysis is required where residual risk is not acceptable.
• —Post-production information must feed back and can reopen the analysis.

ISO 14971:2019 (Application of risk management to medical devices), with ISO/TR 24971 as guidance; harmonised for EU MDR (Regulation (EU) 2017/745) and IVDR; referenced by ISO 13485:2016 and expected under 21 CFR 820 / the FDA QMSR.