Medical Device Risk Management

Regulatory Compliance and Product Safety - EN ISO 14971

Risk Management is a cornerstone of Medical Device regulation in the European Union. Under the Medical Device Regulation (EU) 2017/745 (MDR), all manufacturers are required to establish, apply, and maintain a Risk Management System as part of their Technical D ocumentation. This requirement applies to all Medical Devices, regardless of risk class or intended purpose.

The related risk documentation is more than a single risk analysis. It starts with a systematic hazard analysis, moves through risk evaluation and the defined risk control measures, and ends with the final Risk Management Report. All of this evidence comes together in the Risk Management File.

With the Commission Implementing Decision EN ISO 14971:2019/A11:2021 was harmonized and is thus the requirement for implementing the Risk Management Process.

EU MDR Risk Management Plan

Under MDR Article 10 and Annex I, Section 3, the Risk Management System is an iterative process that runs across the entire product life cycle, from design and production through post-market monitoring. Iterative means it does not end with the first assessment: new information, for example from post-market surveillance, feeds back into the file continuously.

The purpose of the risk management process includes:

Identifying and assessing hazardous situations that arise from the product or are associated with it.
Identifying and assessing all reasonably foreseeable misuse of the Medical Device in question.
Reducing the risks of the identified hazardous situations to make the device as safe as possible for users, patients, third parties, and the environment.

What EN ISO 14971 Requires from Manufacturers

Under EN ISO 14971:2019/A11:2021, risk is defined as the combination of the probability of a hazard occurring and the severity of its effect. That definition is the basis of every risk evaluation: probability and severity together produce the risk, which is then checked against the defined acceptance criteria.

Further steps include assessing and verifying the risk control measures taken, along with a final evaluation of each hazardous situation, including the benefit-risk determination and an analysis of any residual risks that may remain despite the measures implemented.

The Risk Management Process, Step by Step

A defensible risk analysis for a Medical Device it follows a defined sequence. EN ISO 14971 sets the structure:

Define the risk policy: set acceptance criteria for individual risks, overall residual risk, and the benefit-risk ratio.
Run the hazard analysis: capture all known and reasonably product-specific foreseeable hazardous situations and misuse.
Analyze and evaluate risks: estimate probability and severity for each hazard and check them against the acceptance criteria.
Define and implement risk control measures: follow the required order of priority, inherently safe design first, then protective measures, then information for safety.
Verify effectiveness: show that the measures actually reduce the risks, and check for any new risks they introduce.
Evaluate residual risk and weigh overall benefit-risk: set the remaining risk against the medical benefit.
Write the Risk Management Report: close out the process and present the results so an auditor or Notified Body can follow them.

Because the process is iterative, these steps repeat across the product life cycle whenever new information becomes available.

Structure and Contents of the Risk Management File

Guidance on how to build a Risk Management File is found in EN ISO 14971:2019/A11:2021 and ISO/TR 24971:2020. The standard and the guideline describe how the file must be structured and which elements and records it must contain to demonstrate conformity with the General Safety and Performance Requirements under Annex I of the MDR, in particular Section 3. Because of its iterative nature, the Risk Management File must be reviewed and updated at regular intervals.

At minimum, a Risk Management File must contain the following documents:

Risk Management Process Description
Risk Management Plan
Risk Analysis
Risk Evaluation and Control Measures
Verification of Effectiveness
Risk Management Report

Important elements that should be included in the Risk Management File are the definition of a Risk Policy on the basis of which the acceptance criteria for the benefit-risk ratio and the residual risk are defined. Furthermore, the definition of acceptable risks, as well as a listing and evaluation of all known and foreseeable hazardous situations, and a final evaluation of the risk analysis carried out, are necessary. For all activities within the Risk Management Process, it is important that the persons involved can demonstrate appropriate knowledge of the respective process steps and the product life cycle of the Medical Device.

Checklist: Is Your Risk Management File Complete?

A Risk Management File under EN ISO 14971 must contain at least six elements to hold up in an audit. Check in a minute whether your risk documentation is complete.

0 of 6 in place

Risk Management Process DescriptionA defined, iterative process across the product life cycle.
Risk Management PlanRisk policy, acceptance criteria, responsibilities.
Risk AnalysisHazardous situations and foreseeable misuse.
Risk Evaluation & Control MeasuresEvaluation per hazard, defined control measures.
Verification of EffectivenessEvidence that the measures actually work.
Risk Management ReportFinal assessment incl. benefit-risk determination.

Nothing checked yet. Tick off what your file already contains.

Not sure your Risk Management File holds up to what an audit expects? Let's take a look together.

Schedule a call

Our Consulting Services on Risk Management according to ISO 14971

We consult you on risk documentation throughout the entire product lifecycle, from the initial risk analysis to the audit.
Specifically, we cover the following areas:

Building the Risk Management File

We prepare the Risk Management Plan, hazard and risk analysis, risk evaluation, and Risk Management Report to EN ISO 14971.

Revising existing documentation

We review your existing risk documentation against the current EN ISO 14971:2019/A11:2021 requirements and close the gaps.

Preparing for upcoming audits

We get your Risk Management File audit-ready and review it the way a Notified Body would.

Handling risk-related non-conformities

When non-conformities or additional requests relate to risk management, we support root-cause analysis, corrective actions, and the evidence for them.
> More on handling non-conformities

Risk Management • EN ISO 14971

Set up risk management to ISO 14971

We ensure your risk management documentation is audit-ready throughout the entire product lifecycle. We prepare risk management plans, risk analyses, and risk management reports in accordance with EN ISO 14971.

Frequently Asked Questions

Risk Management for Medical Devices EN 14971

What is EN ISO 14971 and why is it important for Medical Devices in the EU?

EN ISO 14971 is the harmonized standard under the MDR for Risk Management in Medical Devices. It outlines the systematic process manufacturers must follow to identify, evaluate, control and monitor risks throughout the product lifecycle. Compliance with this standard demonstrates conformity with EU safety and performance requirements.

Is a Risk Management System required for all Medical Devices under the MDR?

Yes, according to Article 10 and Annex I Section 3 of the MDR, every Medical Device manufacturer must establish, document, implement and maintain a Risk Management System. This applies to all Device Classes, including Class I.

What documents must be included in a Risk Management File?

At minimum, the Risk Management File must include:

Risk Management Process Description
Risk Management Plan
Risk Analysis (including Hazard Identification)
Risk Evaluation with defined control measures
Verification of effectiveness
Risk Management Report

What is the role of the Risk Management Plan?

The Risk Management Plan sets out how risks will be identified, evaluated, and controlled, including the risk policy and acceptance criteria, and assigns responsibilities across the product life cycle.

How does Risk Management relate to the CE Marking Process?

Risk management is a critical part of the Technical Documentation required for CE marking. Without a properly documented and implemented Risk Management System, a Medical Device cannot lawfully be placed on the EU market.

How do I build the Risk Management File?

The Risk Management File is built along the risk management process in EN ISO 14971: define the risk policy and acceptance criteria, identify hazardous situations, analyze and evaluate the risks, implement risk control measures and verify their effectiveness, then evaluate residual risk. These steps are planned in the Risk Management Plan and closed out in the Risk Management Report. Because the process is iterative, the file is maintained across the entire product life cycle.

FMEA vs. EN ISO 14971?

An FMEA is a recognized method for analyzing failure causes and their effects. It is not the same as risk management under EN ISO 14971: the standard requires an end-to-end process from hazard identification through the benefit-risk determination to residual-risk evaluation. An FMEA can be part of that process, it replaces neither the risk policy nor the Risk Management Report.

References

European Parliament & Council of the EU: Regulation (EU) 2017/745 on Medical Devices (MDR), Official Journal of the European Union, May 5, 2017 – eur-lex.europa.eu
European Parliament & Council of the EU: Regulation (EU) 2017/746 on In Vitro Diagnostic Medical Devices (IVDR) – eur-lex.europa.eu
DIN Media: DIN EN ISO 14971:2022-04 (standard subject to a fee) – dinmedia.de
DIN Media: ISO/TR 24971:2020-06 (standard available for a fee) – dinmedia.de