What Is ISO 14971? A Guide to Medical Device Risk Management

What is ISO 14971, and why does it matter to medical device companies? ISO 14971:2019 is the international standard that defines a systematic process for identifying hazards associated with medical devices, evaluating and controlling related risks, and monitoring whether those controls remain effective throughout the product lifecycle.

The standard applies to medical devices, including in vitro diagnostic products and Software as a Medical Device (SaMD). It does not set product-specific safety limits. Instead, it provides a framework for making, documenting, and revisiting risk decisions.

That lifecycle begins with early concept work and continues through design, production, postmarket surveillance, changes, and eventual device retirement.

For medical device manufacturers, ISO 14971 is more than a compliance checklist. A well-run medical device risk management process can shape safer requirements, reduce late changes, and make product decisions easier for reviewers and auditors to follow.

What Does ISO 14971 Cover?

ISO 14971:2019 is the third edition of the standard. It was published in 2019 and confirmed as current in 2025. ISO/TR 24971:2020 provides complementary, nonmandatory guidance for applying the standard in practice.

ISO 14971 defines risk as the combination of the probability that harm will occur and the severity of that harm. Several related concepts must remain distinct:

• A hazard is a potential source of harm.
• A hazardous situation is a circumstance in which a person, property, or the environment is exposed to one or more hazards.
• Harm is injury or damage to health, property, or the environment.
• Residual risk is the risk remaining after controls have been implemented.

The analysis covers normal use and reasonably foreseeable misuse. Teams should consider use errors and behaviors that can reasonably be anticipated based on the device, users, environment, and available information.

Why Is Medical Device Risk Management Important?

Medical devices interact with patients, clinicians, data, infrastructure, and increasingly complex software ecosystems. A failure may delay a diagnosis, provide an incorrect result, interrupt therapy, expose a patient to energy or medication, or make an essential function unavailable.

Structured risk management identifies these possibilities while design choices can still change. It creates a traceable path from hazards to controls and verification evidence, supporting patient safety, design reviews, audits, and submissions.

Early risk work also has a commercial benefit. Discovering during validation that an architecture cannot control a critical hazard is more expensive than recognizing the issue during concept development.

Is ISO 14971 Required?

ISO 14971 is a voluntary consensus standard, not a standalone certification requirement. A company does not receive an “ISO 14971 certificate.” Nevertheless, documented risk management is expected in major medical device markets, and regulators may recognize or rely on the standard as an accepted framework.

FDA recognizes ISO 14971:2019 in full. Conformity may support appropriate portions of a premarket submission, although the required evidence still depends on the device and pathway.

The EU Medical Device Regulation requires a documented risk management system throughout the device lifecycle. ISO 14971 commonly structures that work, but companies must still evaluate market-specific requirements and applicable standards.

What Is the Difference Between ISO 13485 and ISO 14971?

ISO 13485 and ISO 14971 serve connected purposes. ISO 13485 establishes requirements for a medical device quality management system, covering areas such as document control, suppliers, design, production, corrective action, and management responsibility.

ISO 14971 focuses on product risk management. Its outputs should connect with design, change control, complaints, corrective action, and postmarket processes governed by the QMS.

In the United States, FDA’s Quality Management System Regulation incorporates ISO 13485:2016 by reference and became effective on February 2, 2026. Risk management should therefore be integrated into the manufacturer’s QMS rather than maintained as an isolated regulatory file.

What Are the Requirements for a Medical Device Risk Management Plan?

A risk management plan should be established for the device being evaluated and remain current as development and lifecycle conditions change. Under ISO 14971, the plan should address:

• The scope of planned risk management activities and the device lifecycle phases covered
• Assigned responsibilities and authority
• Requirements for reviewing risk management activities
• Criteria for accepting risk, based on the manufacturer’s policy for determining acceptable risk, including when the probability of harm cannot be estimated
• A method for evaluating overall residual risk and the criteria for accepting it
• Activities for verifying the implementation and effectiveness of risk controls
• Methods for collecting and reviewing relevant production and post-production information

The plan should be proportional to the device. A simple nonsoftware product and a cloud-connected diagnostic platform need different analytical depth, but both require defined responsibilities, criteria, reviews, and lifecycle monitoring.

The ISO 14971 Risk Management Process

The risk management process is iterative. New information may require a team to revisit earlier conclusions. In practical terms, the workflow can be organized into seven working stages.

1. Establish the Plan and Risk Policy

Management must define a policy for establishing risk acceptability criteria. It should reflect applicable regulations, relevant standards, the generally acknowledged state of the art, and stakeholder concerns. The product plan applies that policy and assigns qualified personnel.

Cross-functional participation matters. Engineering, clinical, human-factors, quality, regulatory, software, and security contributors provide different risk information.

2. Conduct Risk Analysis

Risk analysis starts with the intended use, reasonably foreseeable misuse, safety-related characteristics, and known or foreseeable hazards. The team then develops sequences of events that could lead to hazardous situations and harm.

Estimate each associated risk using the defined method. Evidence may include data, modeling, testing, literature, or justified expert judgment. Unsupported numbers create an appearance of precision without a defensible basis.

3. Perform Risk Evaluation

Compare each estimated risk with the plan’s acceptance criteria to determine whether additional control is required. Apply criteria consistently and record each rationale.

ISO 14971 does not define universal acceptable risk values. It also does not require a particular risk matrix. A matrix can support consistency, but colors or scores cannot replace evaluation of the underlying severity, probability, uncertainty, and clinical context.

4. Identify and Implement Risk Controls

Evaluate controls in order of priority: inherently safe design and manufacture, protective measures, and then information for safety such as warnings, training, or limitations.

Labeling should not replace a feasible design measure. Verify implementation and, where appropriate, effectiveness. Determine whether each control creates new hazards or changes existing risks.

5. Evaluate Residual Risk and Benefit

After controls are applied, evaluate the remaining risk against the established criteria. When an individual residual risk is not acceptable and further control is not practicable, a benefit-risk analysis may determine whether the medical benefits of the intended use outweigh that residual risk.

The analysis should use relevant evidence and explain why benefits outweigh the remaining risk. Also evaluate overall residual risk rather than viewing every hazard in isolation.

6. Complete the Risk Management Review

Before distribution, confirm that the plan was implemented, overall residual risk is acceptable, post-production methods exist, and required records are present.

Document the results in a risk management report that identifies the reviewers, approval date, and conclusions.

7. Monitor Production and Post-Production Information

After release, review information from production, complaints, service, nonconformities, adverse events, literature, suppliers, cybersecurity sources, and similar devices.

Determine whether new information changes hazards, estimates, overall risk, or control effectiveness. Update the file, product, labeling, surveillance, or corrective actions when needed.

What Are the Five Levels of Risk Severity?

ISO 14971 does not prescribe five severity levels or mandatory names for them. Manufacturers define a scale appropriate for the device and apply it consistently.

A five-level system might use negligible, minor, serious, critical, and catastrophic. Each level needs an objective definition tied to potential harm. A different number of levels may produce clearer decisions.

Severity does not decrease because harm is unlikely. Probability and severity are separate inputs; a rare event can still involve catastrophic harm.

What Is the ISO 14971 Risk Management File?

The risk management file is the collection of records that documents how a manufacturer manages device risk throughout the product lifecycle. It should provide a clear, traceable path from each identified hazard through risk analysis and evaluation, risk controls, verification, and residual-risk conclusions.

The file does not need to be a single physical document. It can reference controlled records stored in an eQMS, requirements platform, test repository, cybersecurity file, or complaint system, provided the evidence remains retrievable and version-specific.

Typical records include the risk management plan; hazard, failure, and use-related analyses; benefit-risk analyses; risk-control verification evidence; the risk management report; and production and post-production reviews.

To keep the file current, assign an owner to each record and define review triggers, such as design changes, new suppliers, software releases, complaint trends, cybersecurity vulnerabilities, labeling updates, or changes to intended use.

At each review, confirm that hazard analyses, control requirements, verification results, and residual-risk conclusions remain aligned. Document the evidence reviewed, the decision, and any follow-up actions. This approach prevents the file from becoming a static archive and demonstrates that risk management remains connected to product performance, postmarket information, and controlled lifecycle decisions.

How Does ISO 14971 Apply to SaMD, AI, and Cybersecurity?

SaMD hazards may involve incorrect calculations, unavailable functions, delayed outputs, interoperability, data, interfaces, or inappropriate reliance on results. Assess software changes and unresolved anomalies for risk impact.

AI-enabled functions add dataset quality, subgroup performance, bias, drift, automation bias, and use outside validated conditions. Controls may include data requirements, thresholds, human oversight, labeling, monitoring, or use limitations. Model and dataset changes require documented assessment.

Cybersecurity risk also connects to patient safety. Unauthorized access, loss of availability, altered data, or compromised updates may lead to hazardous situations. Traditional probability-of-harm methods do not always fit deliberate attacks, so security teams may evaluate exploitability while linking cybersecurity events to safety harms. Threat models, security controls, testing, vulnerability monitoring, and the Software Bill of Materials should remain traceable to the broader risk evidence where applicable.

How Is ISO 14971 Used in Regulatory Submissions?

For a 510(k), risk documentation can explain how differences from the predicate were evaluated and how controls support substantial equivalence. Content depends on the device and applicable FDA guidance.

A PMA generally requires more extensive independent evidence supporting reasonable assurance of safety and effectiveness. The risk file should align with design, nonclinical, clinical, manufacturing, and postmarket evidence.

For EU MDR technical documentation, risk management should connect to the General Safety and Performance Requirements, design evidence, clinical evaluation, usability, verification and validation, labeling, and postmarket surveillance. Across markets, a traceability matrix can help reviewers follow the relationship among hazards, requirements, controls, and objective evidence.

Common ISO 14971 Implementation Gaps

Frequent weaknesses include:

• An incomplete intended-use or foreseeable-misuse analysis
• Risk criteria created after results are known
• Probability estimates without supporting evidence or rationale
• Missing links between hazards, controls, and verification
• Labeling used before safer design options are evaluated
• Failure to assess risks introduced by a control or product change
• A benefit-risk conclusion without adequate clinical evidence
• Inconsistent safety, usability, software, and cybersecurity files
• Postmarket data that never feeds back into the risk assessment

A focused gap assessment can identify whether the problem is missing evidence, inconsistent terminology, weak traceability, or an underlying product issue. The response should correct the actual gap rather than produce generic documentation.

How Quality Commercial Consultants Can Help

Quality Commercial Consultants helps software-enabled medical device, SaMD, and health-technology companies organize technical work into clear, review-ready regulatory compliance evidence. Support may include ISO 14971 gap assessments, risk management planning, traceability and documentation reviews, alignment of safety and cybersecurity risk files, and readiness assessments for FDA and EU MDR submissions.

Our approach is tailored to the device, development stage, regulatory pathway, and documentation already available. The objective is a practical risk management system that teams can maintain, not a one-time file created shortly before submission.

Contact Us Today

Effective medical device risk management begins early and continues throughout the product lifecycle. Contact Quality Commercial Consultants to discuss your device, risk documentation, submission plans, and current readiness.