Home / EU MDR / Risk Management
ISO 14971:2019 · EU MDR Annex I · FDA

ISO 14971 Risk Management for Medical Devices

We build and maintain your ISO 14971 risk management file, from risk management plan and hazard analysis to risk controls, benefit-risk and post-production review, so it meets EU MDR Annex I and stands up to Notified Body and FDA review.

Get a free risk file review See the process
7stages in the ISO 14971 process
3risk control options, in priority order
1risk file for the whole device lifecycle
The basics

What is ISO 14971 risk management?

ISO 14971:2019 is the international standard for applying risk management to medical devices. It sets out how manufacturers identify hazards, estimate and evaluate risks, control them and monitor how well the controls work throughout the device lifecycle.

Under EU MDR, Annex I requires a documented risk management system and risks reduced as far as possible without harming the benefit-risk ratio. The harmonised version, EN ISO 14971:2019+A11:2021, is how most manufacturers show they meet this.

Required for every classFrom Class I to Class III, and for IVDs too.
Links the whole fileDrives design inputs, testing, labelling, clinical evaluation and PMS.
Accepted in the EU and USHarmonised under MDR and recognised by the FDA.
How it works

The ISO 14971 risk management process

We follow the standard clause by clause, so your file maps directly to what reviewers expect.

  1. 1

    Risk management plan

    Clause 4

    We define scope, responsibilities, risk acceptability criteria and verification activities for your device.

  2. 2

    Risk analysis

    Clause 5

    We document intended use and foreseeable misuse, identify hazards and hazardous situations and estimate each risk.

  3. 3

    Risk evaluation

    Clause 6

    We compare each risk against your acceptance criteria to decide what needs reducing.

  4. 4

    Risk control

    Clause 7

    We apply controls in the required order (inherently safe design, protective measures, information for safety) and verify they work.

  5. 5

    Overall residual risk

    Clause 8

    We evaluate the combined residual risk and weigh it against the medical benefits.

  6. 6

    Risk management review

    Clause 9

    We confirm the plan was carried out and prepare the risk management report.

  7. 7

    Production & post-production

    Clause 10

    We set up the feedback loop from complaints, PMS and PMCF so the risk file stays current.

ISO 14971 and MDR

What EU MDR expects from your risk management

ISO 14971 gives you the process. MDR Annex I adds requirements your file must clearly address.

TopicISO 14971:2019EU MDR Annex I
Risk reductionReduce risks to an acceptable level, per the manufacturer's criteriaReduce risks as far as possible without adversely affecting the benefit-risk ratio (GSPR 2)
Risk control orderDesign, then protective measures, then information for safetySame order, required by GSPR 4
Residual risksDisclose significant residual risksInform users of all residual risks in labels and IFU (GSPR 4)
Benefit-riskWeigh overall residual risk against benefitsEach risk and overall residual risk must be acceptable against benefit (GSPR 1 and 8)
Post-market linkProduction and post-production information (Clause 10)PMS, PMCF and PSUR findings must update the risk file (Article 83)
The file

What goes into a risk management file?

01
Risk management planScope, roles, acceptance criteria and review points.
02
Hazard identificationHazards and hazardous situations, guided by ISO/TR 24971.
03
FMEA & other analysesDesign, process and use FMEA, fault tree or PHA as needed.
04
Risk evaluationSeverity and probability ratings against your matrix.
05
Risk controls & verificationEach control traced to evidence that it works.
06
Benefit-risk analysisJustification that benefits outweigh residual risks.
07
Risk management reportSummary review before release to market.
08
Post-production reviewComplaints, PMS and PMCF data fed back into the file.
Avoid findings

Common risk management gaps

01
No clear acceptance criteriaCriteria missing from the plan or not linked to a risk policy.
02
FMEA as the only toolNormal-use hazards and use errors left out.
03
Controls not verifiedRisk controls listed with no evidence they are effective.
04
Labelling not tracedResidual risks missing from warnings and IFU.
05
Weak benefit-riskBenefits stated but not supported by clinical data.
06
File never updatedComplaints and PMS findings not fed back into the risk file.
Our service

Our risk management services

Risk management fileComplete ISO 14971 file built from scratch.
Gap analysis & remediationUpgrading existing files to ISO 14971:2019 and MDR.
FMEA facilitationDesign, process and use FMEA workshops with your team.
Benefit-risk analysisEvidence-based justification aligned with your CER.
Risk procedure (SOP)ISO 14971 procedure for your ISO 13485 QMS.
Notified Body query responsesClear answers to risk management findings.

Related MDR services

MDR CE Marking MDR Classification Technical Documentation Biological Evaluation European Authorised Representative UKCA Marking for Medical Devices UK Responsible Person Service
FAQ

ISO 14971 risk management FAQs

Is ISO 14971 mandatory under EU MDR?

MDR Annex I requires a documented risk management system but does not name a standard. In practice, EN ISO 14971:2019+A11:2021 is the harmonised standard that gives presumption of conformity, and Notified Bodies expect it.

What is the difference between ISO 14971 and ISO/TR 24971?

ISO 14971 sets the requirements for the risk management process. ISO/TR 24971:2020 is the companion guidance that explains how to apply them, with examples of hazards and risk analysis techniques.

Is an FMEA enough for ISO 14971?

No. An FMEA is a useful risk analysis tool, but it does not cover every hazard, such as normal-use hazards or use errors. ISO 14971 also needs a risk management plan, acceptance criteria, benefit-risk analysis, a risk management report and post-production review.

What goes into a risk management file?

The risk management plan, hazard identification, risk analysis and evaluation, risk control measures with verification of their effectiveness, overall residual risk and benefit-risk evaluation, the risk management report and records of production and post-production review.

How does risk management link to clinical evaluation and PMS?

The risk file, CER and PMS documents must tell the same story. Clinical data confirms benefits and residual risks, and post-market data from PMS and PMCF must be fed back to update the risk file.

Does the FDA accept ISO 14971?

Yes. The FDA recognises ISO 14971:2019 as a consensus standard, so one well-built risk management file can support both EU MDR and US submissions.

Is your risk file ready for Notified Body review?

Send us your device details using the form below and we'll review your risk management file at no cost.

Get a free quote

Read our Privacy Policy.