ISO 14971:2019

Overview

ISO 14971:2019 - Medical devices - Application of risk management to medical devices - defines a systematic process for identifying, evaluating, controlling and monitoring risks associated with medical devices throughout their entire life cycle. The standard explicitly includes software as a medical device (SaMD) and in vitro diagnostic (IVD) medical devices, and addresses risks such as biocompatibility, data and systems security (cybersecurity), electricity, moving parts, radiation, and usability. ISO 14971:2019 requires manufacturers to set objective criteria for risk acceptability but does not prescribe specific acceptable risk levels. Guidance on applying the standard is available in ISO/TR 24971.

Key topics and requirements

• Risk management process: structured steps for risk analysis, risk evaluation, risk control, and continuous monitoring across all life-cycle phases.
• Risk management plan and file: documentation requirements that define methods, responsibilities, and record-keeping for traceability.
• Risk analysis: identify intended use, reasonably foreseeable misuse, device characteristics impacting safety, hazards and hazardous situations.
• Risk estimation and evaluation: assess probability and severity to determine risk levels and compare to predefined acceptability criteria.
• Risk control: select and implement control measures, analyze control options, and evaluate residual risk including risks introduced by controls.
• Benefit–risk analysis: weigh medical benefits against residual risks when risks cannot be eliminated.
• Residual risk disclosure: consolidated requirement to disclose residual risks after overall residual risk acceptability is evaluated.
• Production and post-production activities: collect, review and act on information from production, post-market surveillance, complaints and literature to update risk decisions.
• Competence and management responsibilities: ensure qualified personnel and top-management oversight for effective risk management.
• Annexes and guidance: informative annexes (e.g., IVD guidance, biological hazards) and cross-reference to ISO/TR 24971 for application details.

Practical applications

ISO 14971:2019 is used to:

• Design and develop safer medical devices and SaMD by integrating risk thinking into product development.
• Demonstrate regulatory compliance and support technical documentation for market submission.
• Implement post-market surveillance loops that feed back into risk controls and product updates.
• Guide suppliers and partners on risk expectations within the medical device supply chain.

Who should use this standard

• Medical device and SaMD manufacturers
• Design and regulatory affairs teams
• Quality and safety engineers
• Risk managers, clinical safety officers, and post-market surveillance teams
• Suppliers and contract manufacturers involved in the device life cycle

Related standards

• ISO/TR 24971 (guidance on applying ISO 14971)
• Other relevant standards for product safety, usability and cybersecurity (refer to normative references in ISO 14971:2019)

Keywords: ISO 14971, risk management for medical devices, SaMD, IVD, residual risk, benefit-risk analysis, post-market surveillance, medical device safety.