Overview
ISO 14971:2007 - Medical devices - Application of risk management to medical devices - defines a systematic process for identifying hazards, estimating and evaluating risks, implementing risk controls, and monitoring control effectiveness across the entire life-cycle of a medical device. Developed by ISO with input from IEC/SC 62A, the standard covers in vitro diagnostic (IVD) devices and accessories and is intended primarily for medical device manufacturers. It does not set acceptable risk levels or apply to clinical decision making, nor does it require a formal quality management system (though it can be integrated into one).
Key topics and requirements
ISO 14971:2007 structures risk management into defined activities and documented outputs. Core technical topics include:
- Risk management process: establishment of a formal process covering all life-cycle stages (design, production, post-production, decommissioning).
- Risk analysis: identification of hazards, hazardous situations, and estimation of probability and severity of harm.
- Risk evaluation: criteria and methods for determining risk acceptability.
- Risk control: selection, implementation and verification of risk reduction measures; analysis of risk control options.
- Residual risk assessment: evaluation of remaining risk and performance of risk/benefit analysis where necessary.
- Documentation: preparation and maintenance of a risk management plan, risk management file, and risk management report.
- Post-production surveillance: collection and use of production and post-production information to update risk assessments.
- Informative annexes provide guidance (e.g., Annex H on IVD devices, Annex E examples of hazards, Annex G techniques).
Practical applications
ISO 14971 is used to:
- Guide risk-based design and verification activities for medical device development.
- Demonstrate to regulators and notified bodies that a structured risk management process is in place.
- Support product labeling, warnings, and instructions by identifying residual risks.
- Inform post-market surveillance and corrective actions by linking field data to risk controls.
Keywords: ISO 14971, medical device risk management, risk analysis, risk control, residual risk, IVD risk guidance, risk management plan, post-production surveillance.
Who should use it
- Medical device manufacturers (design engineers, regulatory affairs, quality managers)
- Risk managers and safety engineers
- Notified bodies and regulatory reviewers (for conformity assessment)
- Suppliers and developers of accessories and IVD products seeking harmonized risk management guidance
Related standards
ISO 14971 is complementary to product- and sector-specific standards (for example ISO 13485 for quality management) and may be used alongside IEC/ISO standards addressing particular device safety requirements.
