Risk Management (ISO 14971)
Overview
Risk management is mandatory for all medical devices under MedDO Annex I §§ 1–9. ISO 14971:2019 is the harmonised standard providing the accepted methodology. Risk management is a lifecycle activity — not a one-time exercise performed before market placement. It is continuous and integrated throughout design, production, and post-market phases.
Risk Management File (RMF)
The RMF documents all risk management activities for a specific device. It must be updated when: new hazards are identified post-market; the device design or intended purpose changes; new clinical evidence affects the known risk profile; an FSCA or serious incident reveals a previously unrecognised risk.
The Five-Stage ISO 14971:2019 Process
- Risk analysis — Define intended use and reasonably foreseeable misuse; identify hazards and hazardous situations; estimate probability and severity of harm
- Risk evaluation — Determine acceptability of each estimated risk against the risk acceptance criteria
- Risk control — Apply risk reduction measures in priority order: inherently safe design → protective measures → information for safety. Verify effectiveness and absence of new risks
- Benefit-risk analysis — Where residual risks remain, weigh against clinical benefit; overall residual risk must be acceptable
- Production and post-production — Collect and review post-market data; update RMF accordingly
Integration
Risk management integrates with: IEC 62304 (software lifecycle); ISO 10993 (biological hazards); GSPR compliance matrix; clinical evaluation; post-market surveillance.