Glossary · ISO and IEC standards for MedTech and pharma
ISO 14971
Also known as: ISO 14971:2019, EN ISO 14971:2019+A11:2021, ISO/TR 24971:2020, Medical device risk management
ISO 14971 is the international standard for applying risk management to medical devices, including software and in vitro diagnostic devices. It defines a lifecycle process of risk analysis, risk evaluation, risk control, evaluation of overall residual risk against benefits, and the collection of production and post-production information.
- Standards
- MDR
- IVDR
In one sentence
ISO 14971:2019 defines the risk management process for medical devices and IVDs, from risk analysis to benefit-risk and post-production review.
Example
A manufacturer of a blood glucose meter documents a risk management plan, a hazard analysis including incorrect readings, risk control measures such as a range check, and a risk management report that judges the overall residual risk acceptable against the clinical benefit.
How it applies
- Legal hook: Annex I MDR and IVDR requires a documented risk management system over the whole lifecycle and risks reduced as far as possible without adversely affecting the benefit-risk ratio. EN ISO 14971:2019+A11:2021 is harmonized; its Annex Z maps the standard to these requirements.
- Process: Risk management plan, risk analysis based on intended use and reasonably foreseeable misuse, risk evaluation against the manufacturer's criteria, risk control, and evaluation of the overall residual risk.
- Order of risk control: Inherently safe design and manufacture first, then protective measures in the device or the manufacturing process, then information for safety and, where appropriate, training. Information alone is the weakest option.
- Lifecycle: The standard doesn't stop at release. Production and post-production information must be collected and reviewed, which ties risk management to post-market surveillance. Guidance is in ISO/TR 24971:2020.
- Technical documentation: The risk management file holds the plan, analyses, control measures, verification of their effectiveness and the risk management report. Software (IEC 62304) and usability (IEC 62366-1) files refer back to it.
ISO 14971 vs. ISO 12100
ISO 12100 serves machinery and weighs risk reduction through its three-step method, with the aim of adequate risk reduction. ISO 14971 serves medical devices and adds the benefit-risk judgment: residual risk is accepted only if the medical benefit outweighs it. A device with machine-like hazards, such as a surgical robot, may need both perspectives, but the MDR is satisfied through the ISO 14971 process.