ISO 14971:2019 provides the framework medical device manufacturers need to systematically identify hazards, evaluate risks, and implement controls throughout the product lifecycle. This guide explains the standard’s requirements and delivers practical guidance for implementation.
What You’ll Learn:
- The core components of ISO 14971:2019 and its regulatory significance
- How to conduct hazard identification and risk evaluation
- Documentation requirements for risk management files
- Post-production monitoring obligations
What ISO 14971:2019 Requires
ISO 14971:2019 is the international standard that specifies terminology, principles, and processes for risk management of medical devices. The standard covers software as a medical device and in vitro diagnostic medical devices.
The standard establishes a systematic framework for identifying hazards, estimating risks, controlling them, and monitoring the effectiveness of controls throughout the device lifecycle. Published in December 2019, this third edition introduced enhanced focus on benefit-risk analysis and expanded requirements for production and post-production activities.
The FDA recognizes ISO 14971:2019 as a consensus standard, meaning manufacturers can declare conformity to meet certain regulatory expectations. In the European Union, EN ISO 14971:2019+A11:2021 is harmonized with the Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR).
Hazard Identification and Risk Analysis
Risk analysis under ISO 14971:2019 requires manufacturers to document three elements:
| Element | Requirements |
|---|---|
| Intended Use and Misuse | Document intended use and reasonably foreseeable misuse, including all safety-relevant device characteristics. |
| Hazard Identification | Identify known and foreseeable hazards, including hazardous situations from sequences or combinations of events. |
| Risk Estimation | Estimate risk for each hazard based on the probability of occurrence and the severity of potential harm. |
The standard defines a hazard as “a potential source of harm” and harm as “injury or damage to the health of people, or damage to property or the environment.” The 2019 version removed the word “physical” from the definition of harm, expanding its scope beyond physical injuries.
Common hazard analysis techniques that support ISO 14971 implementation include Failure Mode and Effects Analysis (FMEA), Fault Tree Analysis (FTA), Preliminary Hazard Analysis (PHA), and Hazard and Operability Study (HAZOP). ISO/TR 24971:2020 provides guidance that these techniques are complementary, and manufacturers may need to use more than one for thorough risk analysis.
Risk Evaluation and Acceptability Criteria
Risk evaluation determines whether risk reduction is required for a particular hazard. Manufacturers must establish objective criteria for risk acceptability in their risk management policy.
ISO 14971:2019 emphasizes that manufacturers define acceptability criteria as part of their risk management policy rather than relying solely on a risk matrix. The standard does not specify acceptable risk levels because risk acceptability depends on the specific device context and intended use.
When establishing criteria, manufacturers weigh the probability that a hazard occurs against its severity. Risk evaluation matrices help visualize this relationship, but should be the output of the risk management policy, not the policy itself.
Risk Control Measures
When a hazard poses an unacceptable risk level, manufacturers must implement risk control measures in accordance with state-of-the-art best practices for similar devices.
ISO 14971:2019 requires risk control options in this order of priority:
- Inherent safety by design and manufacture
- Protective measures built into the device or manufacturing process
- Safety information provided to users, including training where appropriate
After implementing risk controls, manufacturers must perform benefit-risk analysis. When the benefit outweighs the residual risk, manufacturers must determine what safety information to disclose.
Risk control activities connect to other essential standards. IEC 60601-1 requires formal risk management in accordance with ISO 14971 methodology, particularly for evaluating risk control measures under single-fault conditions. Related standards that reference ISO 14971:2019 include ISO 13485 (quality management systems), IEC 62366 (usability of medical devices), and IEC 62304 (medical device software).
Risk Management File Documentation
ISO 14971 defines the risk management file as “a set of records and other documents that are produced by risk management.” The standard treats the risk management file as a living document that manufacturers must compile and maintain throughout the entire product lifecycle.
| Required Documentation | Description |
|---|---|
| Risk Management Plan | Policy for establishing risk acceptability criteria and a system for categorizing probability and severity. |
| Risk Analysis Records | Includes intended use documentation, hazard identification, and risk estimations. |
| Risk Control Documentation | Documents implemented risk control measures, verification, residual risk evaluation, and benefit-risk analysis. |
| Traceability Records | Links hazards to risk analysis, evaluations, controls, and verification, ensuring completeness of risk controls. |
| Post-Production Information | Captures review results of post-production data and resulting decisions. |
The risk management file establishes traceability between each identified risk and its corresponding manufacturing processes. This traceability enables companies to evaluate the completeness of the process and efficacy of risk management procedures.
Production and Post-Production Monitoring
ISO 14971:2019 expanded requirements for production and post-production activities. Manufacturers must perform a full review of the risk management process prior to commercial distribution.
The pre-distribution review must ensure:
- The risk management plan has been appropriately implemented
- Overall risk is acceptable
- Procedures are in place to gather and maintain risk data during production and post-production
Post-production requirements align closely with ISO 13485:2016 Section 8 requirements for feedback, data analysis, and corrective and preventive action (CAPA). Information collected and reported should include newly identified hazards, changes affecting risk analysis calculations, and results of regular risk management file reviews.
Post-market surveillance within the ISO 14971 framework enables manufacturers to identify unforeseen risks or issues that arise during real-world use. This ongoing monitoring creates a holistic risk management system that extends beyond initial device approval.
Management Responsibilities
Medical device manufacturers demonstrating compliance with ISO 14971:2019 must have management teams dedicated to supporting the risk management system. Management must ensure adequate resources are assigned and that personnel are qualified for their responsibilities.
Beyond enabling the implementation and maintenance of the risk management system, management is responsible for periodically reviewing the system to ensure its continued effectiveness. This oversight ensures the organization maintains risk management as a company-wide practice involving input from all departments throughout the product lifecycle.
Partner With MiCOM Labs for Medical Device Testing
ISO 14971:2019 risk management connects directly to comprehensive safety testing. IEC 60601-1 requires formal risk management in accordance with ISO 14971 methodology, and manufacturers must validate that risk control measures function as intended through testing.
MiCOM Labs maintains A2LA accreditation (Certificate #2381.01) under ISO/IEC 17025 for medical device testing. Our engineers evaluate electrical safety, electromagnetic compatibility, and wireless compliance across global markets.
Ready to validate your risk control measures? Contact MiCOM Labs today for a custom testing proposal.