Glossary · ISO and IEC standards for MedTech and pharma

ISO 14971

Also known as: ISO 14971:2019, EN ISO 14971:2019+A11:2021, ISO/TR 24971:2020, Medical device risk management

ISO 14971 is the international standard for applying risk management to medical devices, including software and in vitro diagnostic devices. It defines a lifecycle process of risk analysis, risk evaluation, risk control, evaluation of overall residual risk against benefits, and the collection of production and post-production information.

Standards
MDR
IVDR

In one sentence

ISO 14971:2019 defines the risk management process for medical devices and IVDs, from risk analysis to benefit-risk and post-production review.

Example

A manufacturer of a blood glucose meter documents a risk management plan, a hazard analysis including incorrect readings, risk control measures such as a range check, and a risk management report that judges the overall residual risk acceptable against the clinical benefit.

How it applies

Legal hook: Annex I MDR and IVDR requires a documented risk management system over the whole lifecycle and risks reduced as far as possible without adversely affecting the benefit-risk ratio. EN ISO 14971:2019+A11:2021 is harmonized; its Annex Z maps the standard to these requirements.
Process: Risk management plan, risk analysis based on intended use and reasonably foreseeable misuse, risk evaluation against the manufacturer's criteria, risk control, and evaluation of the overall residual risk.
Order of risk control: Inherently safe design and manufacture first, then protective measures in the device or the manufacturing process, then information for safety and, where appropriate, training. Information alone is the weakest option.
Lifecycle: The standard doesn't stop at release. Production and post-production information must be collected and reviewed, which ties risk management to post-market surveillance. Guidance is in ISO/TR 24971:2020.
Technical documentation: The risk management file holds the plan, analyses, control measures, verification of their effectiveness and the risk management report. Software (IEC 62304) and usability (IEC 62366-1) files refer back to it.

ISO 14971 vs. ISO 12100

ISO 12100 serves machinery and weighs risk reduction through its three-step method, with the aim of adequate risk reduction. ISO 14971 serves medical devices and adds the benefit-risk judgment: residual risk is accepted only if the medical benefit outweighs it. A device with machine-like hazards, such as a surgical robot, may need both perspectives, but the MDR is satisfied through the ISO 14971 process.