ISO 14971 is the international standard for the application of risk management to medical devices. It defines a process for identifying hazards, estimating and evaluating the associated risks, controlling those risks and monitoring the effectiveness of the controls across the whole product lifecycle. The current edition is ISO 14971:2019, supported by the guidance in ISO/TR 24971.
It is arguably the most influential standard in medical device development, because almost every other requirement connects back to it. Design decisions, usability work, software safety classification, clinical evaluation and post-market surveillance all draw on, or feed into, the risk management file.
Controls must be applied in order. First, inherent safety by design, which removes the hazard altogether. Second, protective measures in the device or the manufacturing process, such as alarms, interlocks or forcing functions. Third, and only where risk remains, information for safety: labelling, warnings and training. Relying on a warning where a design change was practicable is a common audit finding.
No device is risk free, so the standard requires that residual risk be weighed against clinical benefit. A significant residual risk can be acceptable if the benefit is correspondingly large and clearly evidenced. That judgment must be documented, must draw on the clinical evaluation, and must be revisited when post-market data changes the picture.
.svg)
