Medical Devices — Application of Risk Management to Medical Devices
The international standard specifying a process for medical-device manufacturers to identify hazards, estimate and evaluate risks, control them, and monitor the effectiveness of controls across the device lifecycle. The 2019 edition strengthened benefit-risk analysis and production/post-production feedback.
What this does not cover
stated in the document's own scope- Defines the risk-management process; it does not set acceptable-risk levels or a required risk matrix — the manufacturer establishes acceptability criteria in its plan.
- Covers device risk management, not the wider quality management system, which is ISO 13485.
- Provides the process, not detailed application examples and rationale — those are in the companion technical report ISO/TR 24971.
- Addresses risk to safety, not the usability-engineering process itself, which is specified in IEC 62366-1 (and feeds ISO 14971).
Always verify against the current published text before relying on it for a submission or inspection.
Overview
ISO 14971:2019 specifies a process by which a medical-device manufacturer identifies hazards associated with a device (including in-vitro diagnostics), estimates and evaluates the associated risks, controls those risks, and monitors the effectiveness of the controls across the whole product lifecycle. It requires a documented risk-management plan and a risk-management file, and it structures the work as risk analysis, risk evaluation, risk control, evaluation of overall residual risk, review, and production and post-production activities. The 2019 edition sharpened the treatment of benefit-risk analysis, of overall residual-risk evaluation, and of the feedback loop from production and post-production information back into the risk assessment.
Scope & applicability
Medical-device and IVD manufacturers. Harmonised under the EU MDR/IVDR and referenced alongside ISO 13485 quality systems.
Legal basis & how it acquires force
ISO 14971 is a voluntary international consensus standard; it does not itself impose legal duties. It acquires force by adoption and reference: it is the risk-management process ISO 13485 points to, and it is recognised or harmonised across the major jurisdictions — a harmonised standard supporting the EU MDR/IVDR, an FDA-recognised consensus standard, and adopted nationally (for example as EN ISO 14971 in Europe, whose "Z-annexes" map clauses to the MDR/IVDR requirements). Meeting the applicable device regulation is the obligation; ISO 14971 is the harmonised method regulators expect that obligation to be met by.
Document structure
| Part | Covers |
|---|---|
| Clause 4 — General requirements | The risk-management process, management responsibilities, competence, and the risk-management plan and file |
| Clause 5 — Risk analysis | Intended use, identification of characteristics related to safety, identification of hazards and hazardous situations, and risk estimation |
| Clause 6 — Risk evaluation | Deciding, against the plan’s criteria, whether risk reduction is required |
| Clause 7 — Risk control | Analysis and implementation of control options, residual-risk evaluation, benefit-risk analysis, and new-risk review |
| Clause 8 — Overall residual risk | Evaluation of the overall residual risk against the plan’s acceptability criteria |
| Clauses 9–10 — Review and production/post-production | The risk-management review and the system for collecting and acting on production and post-production information |
Key requirements
- Maintain a risk management file across the device lifecycle
- Evaluate overall residual risk and benefit-risk
- Feed production and post-production data back into risk management
Implementation tips
- Close the loop from post-market surveillance into the risk management file — a frequent MDR finding
Revision notes
The 2019 edition strengthened benefit-risk analysis and production/post-production information; ISO/TR 24971:2020 provides guidance.
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
ISO 14971 is the risk-management process referenced by ISO 13485 and required through the EU MDR/IVDR (as EN ISO 14971) and recognised by FDA. Its application guidance lives in the companion ISO/TR 24971. It interfaces with usability engineering (IEC 62366-1), software life-cycle risk work (IEC 62304), and electrical-equipment risk (IEC 60601-1), which each rely on the ISO 14971 process for their risk-management activities.
ISO 14971:2019: frequently asked questions
Quick answers to common questions about ISO 14971:2019.
What changed in ISO 14971:2019?
The 2019 edition strengthened benefit-risk analysis, clarified evaluation of overall residual risk, and reinforced the production and post-production feedback loop so information gathered after release flows back into the risk assessment. Much of the former guidance content moved to the companion ISO/TR 24971.
Is ISO 14971 legally required?
The standard is voluntary, but it is the risk-management method regulators expect. It is harmonised under the EU MDR/IVDR (as EN ISO 14971) and is an FDA-recognised consensus standard, and ISO 13485 references it for the risk-management process.
What is the relationship between ISO 14971 and ISO/TR 24971?
ISO 14971 specifies the risk-management process; ISO/TR 24971 is the companion technical report that provides guidance, worked examples, and rationale on applying it. They are used together.
Does ISO 14971 set an acceptable level of risk?
No. It requires the manufacturer to define risk-acceptability criteria in the risk-management plan and to apply them consistently; it does not prescribe a universal threshold or a mandatory risk matrix.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.