Overview
CEN ISO/TR 24971:2020 - Medical devices - Guidance on the application of ISO 14971 - is a technical report that explains how to develop, implement and maintain a risk management system for medical devices in accordance with ISO 14971:2019. It provides practical guidance on creating a risk management plan and file, performing risk analysis and evaluation, implementing risk control, and handling production and post‑production information. The document complements quality systems such as ISO 13485:2016 by clarifying how some QMS requirements relate to device risk management.
Key topics and requirements
This guidance document expands on the main elements of ISO 14971 and includes:
- Risk management system structure: roles, top management responsibilities, competence, and the risk management plan and file.
- Risk analysis: identification of intended use, reasonably foreseeable misuse, characteristics related to safety, hazards, hazardous situations (including faults, random/systematic faults, and security vulnerabilities).
- Risk estimation and evaluation: probability, severity, and approaches when probability cannot be estimated; criteria for risk acceptability.
- Risk control: option analysis, implementation of design and manufacturing controls, verification, and evaluation of residual risk.
- Benefit‑risk analysis: methods to compare residual risk with clinical benefit.
- Production and post‑production activities: information collection, review, and corrective actions (post‑market surveillance input to risk management).
- Informative annexes: practical techniques for risk analysis, role of standards, guidance for security risks, IVD-specific guidance, and components not designed using ISO 14971.
Practical applications and users
CEN ISO/TR 24971:2020 is intended for organizations involved in the lifecycle of medical devices who need to apply ISO 14971 effectively:
- Medical device manufacturers (design, engineering, manufacturing)
- Quality and regulatory affairs teams integrating risk management with ISO 13485 QMS
- Risk managers and clinical safety officers documenting risk management files and plans
- Notified bodies, auditors, and conformity assessment personnel assessing compliance
- Developers of in‑vitro diagnostic (IVD) devices and suppliers of device components
Practical use cases include preparing risk management plans, performing structured hazard analyses, documenting residual risk and benefit‑risk decisions, and feeding post‑market surveillance data back into risk assessments.
Related standards
- ISO 14971:2019 - Application of risk management to medical devices (primary standard)
- ISO 13485:2016 - Medical devices - Quality management systems (interfaces with risk management)
- Relevant IEC/ISO standards and normative references cited in the annexes for safety, usability, and cybersecurity guidance
Keywords: ISO/TR 24971:2020, ISO 14971, medical device risk management, risk analysis, residual risk, ISO 13485, post‑market surveillance.
