Introduction
Getting a medical device to market requires more than proving it works — you have to prove the risks are worth it. ISO 14971 is the international standard that specifies the terminology, principles, and process manufacturers must apply to identify hazards, estimate risks, implement controls, and monitor their effectiveness across the full product lifecycle.
FDA, EU competent authorities, Health Canada, and MHLW Japan all recognize ISO 14971 as the definitive framework for medical device risk management. For quality engineers, regulatory affairs professionals, and quality managers, that means it's not optional — it's the audit standard you'll be measured against.
FDA's QMSR (21 CFR Part 820), effective February 2026, incorporates ISO 13485 by reference, which in turn requires a documented risk management process. Non-compliance isn't just a citation — it can stall clearance, trigger warning letters, or block market access entirely.
This guide walks through what ISO 14971 requires, how each stage of the process works, where teams consistently go wrong, and how documentation needs to be structured to survive an audit.
Key Takeaways
- ISO 14971:2019 defines risk as probability of harm × severity — the standard aims to ensure benefits outweigh residual risks, not eliminate risk entirely
- The process has six stages: risk management plan → risk analysis → risk evaluation → risk controls → residual risk evaluation → risk management review
- The risk management file is a living document — it must be updated throughout the commercial life of the device, not archived after market launch
- Any ISO 13485-compliant QMS must document a risk management process (Clause 7.1) — making ISO 14971 a direct compliance requirement, not optional guidance
- Auditors flag teams that recorded risk thinking in a file but can't demonstrate it was applied operationally
What Is ISO 14971 Risk Management?
ISO 14971:2019 is the medical device-specific standard for risk management. It provides a structured framework covering four activities: identifying hazards, estimating and evaluating risks, implementing controls, and monitoring those controls throughout the device lifecycle. The Third Edition replaced ISO 14971:2007 and the withdrawn EN ISO 14971:2012.
The process targets one outcome: ensuring that the clinical benefits to patients outweigh the remaining residual risks, and that this determination is documented before market release.
Three scope boundaries matter here:
- ISO 14971 does not govern business or project risk management
- It does not specify acceptable numerical risk levels — manufacturers must define their own acceptability criteria based on current medical knowledge and industry standards
- It applies to all stages of the device lifecycle, including production and post-production — not just design and development
The ISO 14971:2019 standard explicitly includes software as a medical device (SaMD) and in vitro diagnostic devices within its scope — a direct consideration for teams developing connected health products or AI-driven diagnostics.
Why ISO 14971Is Critical for Medical Device Manufacturers
The Regulatory Landscape
ISO 14971:2019 is recognized by every major regulatory body overseeing medical devices:
- FDA: Accepted as consensus standard 5-125, effective December 23, 2019
- EU: Harmonized through EN ISO 14971:2019/A11:2021 under Commission Implementing Decision (EU) 2022/757
- Health Canada: Formally recognized
- Japan: Implemented as JIS T 14971:2020
The FDA QMSR connection raises the stakes. The amended 21 CFR Part 820, effective February 2026, incorporates ISO 13485:2016 by reference. ISO 13485 Clause 7.1 requires documented risk management processes throughout product realization.
FDA does not incorporate ISO 14971 directly by name, but investigators reviewing design controls will expect to see a functioning ISO 14971-aligned system in practice.
The Complexity Problem
Modern devices — SaMD, AI-driven diagnostics, connected health products — introduce hazard categories that generic quality processes cannot adequately address. Algorithmic bias, data drift, cybersecurity vulnerabilities, and unintended AI outputs require systematic, documented hazard analysis. ISO 14971 provides the disciplined framework for doing this in a way that holds up to audit scrutiny.
What Happens Without It
Without a structured ISO 14971 process, teams typically:
- Conduct risk analysis once pre-launch and never revisit it
- Fail to update the risk management file after post-market complaints or design changes
- Cannot demonstrate traceability between identified hazards and implemented controls
FDA enforcement shows the pattern clearly. A November 2025 warning letter to Envoy Medical cited hazards identified in CAPA that were absent from risk documentation, inconsistent severity ratings, and an omitted endotoxin hazard. A January 2026 warning letter to Unomedical Device found that a design risk assessment failed to evaluate patient effects from defective distributed products.
These are not edge cases — they represent the predictable result of treating the risk management file as a pre-market checkbox rather than a living operational record.
The ISO 14971 Risk Management Process: Step by Step
ISO 14971 defines a continuous, iterative loop — not a linear checklist. Outputs from production and post-market surveillance feed back into the risk analysis and update the risk management file throughout the device's commercial life.
Step 1: Risk Management Planning
The risk management plan is written before the risk analysis begins. It must define:
- Scope: device identity, intended use, intended users, use environment, and lifecycle phases covered
- Roles and responsibilities by job title (not individual names)
- Risk acceptability criteria using a probability-severity matrix
- Which risk analysis methods will be used (FMEA, fault tree analysis, hazard analysis, etc.)
- How post-production data feeds back into the risk management file
Auditors will check whether the plan was approved before analysis started. If the dates don't align, that's a finding.
Step 2: Risk Analysis
Risk analysis starts with the documented intended use — including reasonably foreseeable misuse. From there, it requires identifying all hazards, tracing each through foreseeable event sequences to hazardous situations, and estimating risk using severity and probability of occurrence.
One critical nuance: FMEA alone does not satisfy ISO 14971. FMEA assumes single-fault failures — it cannot catch hazards that arise when a device functions exactly as designed. ISO 14971 requires both.
Step 3: Risk Evaluation
Risk evaluation compares each estimated risk against the acceptability criteria defined in the risk management plan. Risks above the acceptable threshold require reduction before the device can proceed.
For EU MDR submissions, this evaluation must demonstrate that risks have been reduced as far as possible — a stricter standard than simply reaching an "acceptable" zone under the manufacturer's own criteria.
Step 4: Risk Controls
ISO 14971 requires manufacturers to consider controls in priority order:
- Inherent safety by design — eliminate or reduce the hazard at the source
- Protective measures built into the device or manufacturing process
- Information for safety — labeling, warnings, and instructions for use
Labeling and user training are the least effective controls. They should not be the primary risk reduction strategy. Any new risk control must also be evaluated for whether it introduces new hazards.
Step 5: Evaluation of Residual Risk
After risk controls are implemented and verified, the remaining risk — residual risk — is re-evaluated against the same acceptability criteria.
If residual risk remains unacceptable and cannot be further reduced, a benefit-risk analysis must document that the medical benefits outweigh the remaining risks. That analysis must be objective. ISO 14971 excludes business-risk management from its scope entirely.
Step 6: Risk Management Review and Post-Production Monitoring
Before market release, a risk management report summarizes that the plan was followed, overall residual risk is acceptable, and methods are in place for collecting and reviewing post-production information.
Release is not the finish line. Each of the following must be evaluated for impact on the risk management file — and the file updated accordingly — throughout the device's commercial life:
- Customer complaints and adverse event reports
- CAPAs and field corrective actions
- Post-market surveillance data
- Trends identified during production monitoring
Key Documentation Under ISO 14971: Plan, File, and Report
The Three Core Documents
Many teams conflate these or attempt to combine them into one document. The result is a single document that satisfies neither requirement and creates traceability gaps auditors will find.
| Document | Role | When Created |
|---|---|---|
| Risk Management Plan | Defines strategy, scope, criteria, and methods before analysis begins | Pre-analysis |
| Risk Management File | Living collection of all risk records — hazard analysis, controls, residual risk evaluations | Throughout lifecycle |
| Risk Management Report | Pre-market summary signed by authorized personnel confirming overall residual risk acceptability | Pre-market release |
Traceability Requirements
Within the risk management file, each identified hazard must be traceable through:
- Its hazardous situation
- Estimated risk (probability × severity)
- Risk control measure
- Verification of control effectiveness
- Residual risk evaluation
This traceability is a primary audit checkpoint. If a post-market complaint surfaces, auditors will trace it back to the risk management file to confirm whether the hazard was previously identified and whether the actual occurrence rate aligns with the original probability estimate.
Integration with Design Controls
For devices subject to design controls, the risk management file is referenced in the Design History File (DHF) under FDA QMSR. Risk controls should be explicitly linked to design outputs, design verification activities, and design validation records. These linkages demonstrate that risk management drove design decisions rather than being completed after the fact.
ISO/TR 24971 as a Companion Resource
ISO/TR 24971:2020 is the companion guidance document that provides practical examples and worked scenarios, including annexes on hazard identification and probability estimation. Teams implementing ISO 14971 for the first time should use TR 24971 alongside the standard — it fills in the "how" behind the "what" requirements. Teams that need structured support applying both TR 24971 and the core standard can find that coverage in QMS Learning's Medical Device & Life Sciences QMS pathway, which addresses ISO 14971 alongside ISO 13485 and FDA 21 CFR Part 820, with AI Workbench support for building and maintaining the documentation. The pilot cohort opens Q3 2026.
How ISO 14971 Relates to ISO 13485 and FDA Regulations
The ISO 13485 Connection
ISO 13485 Clause 7.1 requires risk management throughout the product lifecycle. That makes ISO 14971 more than a standalone compliance exercise — it must be embedded within QMS procedures, design controls, CAPA processes, post-market surveillance activities, and supplier management practices.
The FDA QMSR Connection
FDA's QMSR (21 CFR Part 820), effective February 2026, incorporates ISO 13485:2016 by reference. FDA explicitly states that QMSR does not separately incorporate ISO 14971 by name. However, since ISO 13485 requires documented risk management processes, FDA investigators reviewing quality system records will expect a functioning risk management system aligned to ISO 14971 — even without a direct citation.
EU MDR Additional Obligations
EU MDR Annex I imposes requirements that go beyond ISO 14971:2019 itself:
- Risks must be reduced as far as possible without adversely affecting the benefit-risk ratio (not just to an internally defined "acceptable" level)
- Risk management must be a continuous, iterative process throughout the entire lifecycle
- A positive benefit-risk determination must appear in technical documentation
Manufacturers selling into European markets need to account for these stricter obligations when writing their risk management plans and defining acceptability criteria. Using EN ISO 14971:2019/A11:2021 (which includes Annex Z tables mapping to MDR requirements) helps, but presumption of conformity covers only the mapped requirements. It does not equal blanket MDR compliance.
Common Mistakes Teams Make with ISO 14971
Mistake 1: Writing the Plan After the Analysis
The risk management plan must be approved before risk analysis begins. Auditors will check the dates. If the plan was written after analysis was already complete, the fundamental purpose of establishing acceptability criteria and analysis methods in advance has been defeated — and this becomes a finding.
Mistake 2: Treating the File as Static
The risk management file is not a pre-market deliverable. Post-market complaints, CAPAs, nonconformances, and design changes must all trigger a review of the file to determine whether:
- Hazard identification needs updating
- Probability estimates remain valid
- Risk control effectiveness holds
The Envoy Medical and Unomedical warning letters are direct examples of this exact failure — both traced back to risk files that stopped evolving after market release.
Mistake 3: Generic Acceptability Criteria
A static file is one failure mode. Generic acceptability criteria are another, and auditors treat them the same way.
Criteria copied from a template — without adaptation to the specific device type, patient population, or clinical context — will not survive audit scrutiny. Auditors will ask: "Why did you choose this probability threshold?" Acceptable answers reference clinical literature, regulatory guidance, or recognized industry standards. "That's what our template said" is not one of them.
To illustrate the difference:
- Weak rationale: "We set the probability threshold at 1-in-10,000 because it was the default in our template."
- Defensible rationale: "We set the threshold at 1-in-10,000 based on FDA guidance on acceptable residual risk for Class II implantable devices and corroborated by published post-market surveillance data for comparable products."
Frequently Asked Questions
What is the risk management process according to ISO 14971?
ISO 14971 defines a six-stage process: risk management plan, risk analysis, risk evaluation, risk controls, evaluation of residual risk, and risk management review. Post-production monitoring returns continuously to this cycle — the process does not end at market launch.
Is there an ISO standard for risk management for medical devices?
ISO 14971 is the ISO standard specifically governing risk management for medical devices. ISO 31000 addresses general enterprise risk management but does not satisfy medical device requirements. Regulators across the US (FDA), EU, Canada, and Japan (JIS T 14971:2020) formally recognize or harmonize ISO 14971.
What is the difference between ISO 14971 and ISO 13485?
ISO 13485 is the quality management system standard (covering document control, CAPA, supplier management, and QMS infrastructure). ISO 14971 is the specific risk management standard. ISO 13485 Clause 7.1 requires manufacturers to implement a risk management process — making ISO 14971 the method that satisfies that QMS requirement. In practice, auditors will check both: QMS structure under ISO 13485 and risk methodology under ISO 14971.
What documents does ISO 14971 require manufacturers to maintain?
Three primary documents are required:
- Risk management plan — defines strategy and acceptability criteria before analysis begins
- Risk management file — all records from hazard identification through residual risk evaluation, maintained throughout the lifecycle
- Risk management report — the pre-market summary signed off by authorized personnel confirming overall residual risk acceptability
Does ISO 14971 apply to software as a medical device?
Yes. ISO 14971:2019 explicitly includes SaMD and in vitro diagnostic devices within its scope. For SaMD, risk analysis must address software-specific hazard categories including data security vulnerabilities, algorithmic errors, data drift, and unintended consequences of AI-driven functionality.
What does "residual risk" mean under ISO 14971?
Residual risk is the risk remaining after all risk controls have been implemented and verified. It must be re-evaluated against the manufacturer's acceptability criteria. If residual risk cannot be reduced further and remains unacceptable under those criteria, a benefit-risk analysis must document that the medical benefits of the device outweigh the remaining risk.
