Documentation Standard

ISO 14971

The risk management standard for medical devices: one process for finding hazards, deciding which risks are acceptable, and showing that the controls work.

Full title: Medical devices — Application of risk management to medical devices
Current edition: ISO 14971:2019 (third edition), confirmed in ISO’s 2025 review
Guidance: ISO/TR 24971:2020 explains how to apply it
Applies to: All medical devices, including software as a medical device and in vitro diagnostics, across the whole life cycle
Used by: FDA-recognized. Harmonised in the EU as EN ISO 14971:2019+A11:2021. Required by IEC 62304, IEC 60601-1 and ISO 13485

In short

Risk is the combination of the probability that harm occurs and the severity of that harm. The standard requires a manufacturer to define in advance what level of risk is acceptable, then work through every hazard systematically and keep the evidence in a risk management file. It does not set the acceptable levels. The manufacturer does, and has to justify them.

The process

Risk management plan. Scope, responsibilities, the criteria for risk acceptability, how controls will be verified, and how information will be collected after release.
Risk analysis. Intended use and reasonably foreseeable misuse; the characteristics that affect safety; hazards, the sequences of events that lead to hazardous situations, and the harm that could follow; an estimate of each risk.
Risk evaluation. Each estimated risk is compared with the acceptability criteria.
Risk control. Options are taken in a fixed order of priority: inherently safe design first, then protective measures, then information for safety. Each control is verified as implemented and as effective, and checked for new risks it might introduce.
Residual risk. Each remaining risk is evaluated, with a benefit-risk analysis where a risk is not acceptable and cannot practicably be reduced further. The overall residual risk is then evaluated as a whole.
Risk management review. Before release: the plan was carried out, the overall residual risk is acceptable, and the means to collect post-production information are in place.
Production and post-production. Complaints, field data, literature and changes in the state of the art are reviewed and fed back into the file.

Key terms

Hazard. A potential source of harm.
Hazardous situation. A circumstance in which people, property or the environment are exposed to a hazard.
Harm. Injury or damage to health, or damage to property or the environment.
Risk control measure. Anything done to reduce a risk or hold it at a set level.

On a software project

Software is a cause, not a hazard. It contributes to hazardous situations through wrong output, late output, missing output or unauthorised access. Those causes are analysed as part of the sequence of events.
Do not estimate software failure rates. There is no sound way to do it, so the convention in IEC 62304 and IEC/TR 80002-1 is to assume the failure happens and concentrate on severity and on the rest of the chain.
Risk controls in software become requirements. Each needs a traceable test showing it is implemented and that it works.
The file is a living record. Every change request needs a risk impact assessment, and field problems feed back into the analysis.
Neighbouring risks have their own standards. IEC 62366-1 covers use-related risk; security risk is covered by documents such as AAMI TIR57 and IEC 81001-5-1. Their results feed the same file.

Worth knowing

An FMEA is a useful tool, but it is not a complete risk analysis. It starts from failures, and the standard also requires hazards that arise when everything works as designed.
The 2019 edition moved most guidance into ISO/TR 24971, added a definition of benefit, and put more weight on overall residual risk and on post-production information.
The EU regulations require risks to be reduced as far as possible without adversely affecting the benefit-risk ratio. The European annexes added by amendment A11:2021 map the standard to those requirements.

Official sources

A summary for orientation. It is not regulatory or legal advice, and it is no substitute for the standard or regulation itself. Requirements change: confirm the current edition before relying on anything here. Last reviewed November 2026.