Risk Management for Medical Devices

Regulatory Compliance and Product Safety - EN ISO 14971

Risk Management is a cornerstone of Medical Device regulation in the European Union. Under the Medical Device Regulation (EU) 2017/745 (MDR), all manufacturers are required to establish, apply, and maintain a Risk Management System as part of their Technical Documentation. This requirement applies to all Medical Devices, regardless of risk class or intended purpose.

With the Commission Implementing Decision (EU) 2022/757 in May 2022, EN ISO 14971:2019/A11:2021 was harmonized and is thus the requirement for implementing the Risk Management Process.

Risk Management in the medical device sector

MDR Requirements on Risk Management

According to MDR Article 10 and Annex I, Section 3, manufacturers must implement a risk-based approach across the entire product life cycle — from design and production through to post-market monitoring.

The purpose of the risk management process include the following:

  • Identifying and assessing hazardous situations that arise from the product or are associated with the product
  • Identifying and assessing all reasonably foreseeable misuse of the Medical Device in question
  • Reducing oft he risks of the identified hazardous situations in order to make the Medical Device as safe as possible for the user, patient, third persons and also for the environment

According to EN ISO 14971:2019/A11:2021, risk is defined as the combination of the probability of occurrence of a hazard and the severity of the effect of an occurred hazard. Further steps that must be implemented as part of the Risk Management Process are the assessment and verification of the risk reduction measures taken, as well as a final assessment of the respective hazard situation, including the benefit-risk ratio and any residual risks that may remain despite the risk reduction measures implemented as far as possible.

Risk Management File

Details on how to implement this and practical help in creating a Risk Management File can be found in EN ISO 14971:2019/A11:2021 and ISO/TR 24971:2020. The standard and the guideline describe how a Risk Management File is to be structured and which elements and documents it must contain in order to demonstrate conformity with the General Safety and Performance Requirements according to Appendix I of the MDR, in particular Section 3. Due to its iterative character, the Risk Management File must be checked and updated at regular intervals.

Summarized, the Risk Management File must consist of at least the following documents:

  • Risk Management Process Description
  • Risk Management Plan
  • Risk Analysis
  • Risk Evaluation and Control Measures
  • Verification of Effectiveness
  • Risk Management Report

Important elements that should be included in the Risk Management File are the definition of a Risk Policy on the basis of which the acceptance criteria for the benefit-risk ratio and the residual risk are defined. Furthermore, the definition of acceptable risks, as well as a listing and evaluation of all known and foreseeable hazardous situations, and a final evaluation of the risk analysis carried out, are necessary. For all activities within the Risk Management Process, it is important that the persons involved can demonstrate appropriate knowledge of the respective process steps and the product life cycle of the Medical Device.

Our team of experts is happy to support you in Risk Management. Contact us for a free, no-obligation consultation.

Frequently Asked Questions

EN ISO 14971 is the harmonized standard under the MDR for Risk Management in Medical Devices. It outlines the systematic process manufacturers must follow to identify, evaluate, control and monitor risks throughout the product lifecycle. Compliance with this standard demonstrates conformity with EU safety and performance requirements.

Yes, according to Article 10 and Annex I Section 3 of the MDR, every Medical Device manufacturer must establish, document, implement and maintain a Risk Management System. This applies to all Device Classes, including Class I.

At minimum, the Risk Management File must include:

  • Risk Management Process Description
  • Risk Management Plan
  • Risk Analysis (including Hazard Identification)
  • Risk Management Report

The purpose of the Risk Management System is to identify and assess all hazardous situations that arise from the product or are associated with the product, as well as all reasonably foreseeable misuse of the Medical Device in question.

Risk Management is a critical part of the Technical Documentation needed for CE Marking. Without a properly documented and implemented Risk Management System, a Medical Device cannot lawfully be placed on the EU Market.

Need more information?

WQS provides you with detailed information on your subject.
You can also explore our FAQ page and other resources for further insight
– or simply contact us for direct support.