ISO 14971 FAQ

ISO 14971 is an international standard that specifies the requirements for the risk management process for medical devices. It covers requirements for the analysis, evaluation, control and management of risks related to the scope of a medical device product. Ultimately, it acts as a guide to best practice for the creation of risk management documentation, including a risk management plan and risk analysis reports.

ISO 14971 is important because it helps manufacturers standardise the way they identify hazards, evaluate risks, and control them to ensure the safety and effectiveness of medical devices. Implementing internationally accepted standards also makes compliance with regulatory requirements related to risk management easier.

Manufacturers of medical devices, including IVD medical devices and software medical devices, should comply with ISO 14971 to ensure their products meet regulatory and safety requirements

The main purpose of ISO 14971 is to specify processes for risk analysis, evaluation and management, which provide a systematic approach to hazard review and risk management for medical devices that can be applied to all medical devices.

ISO 14971 is commonly used in conjunction with other medical device standards, particularly ISO 13485, the standard which defines requirements for medical device quality management systems. ISO 14971-related processes and records can be included as part of a medical device QMS. Other standards which relate include IEC 62366, medical device usability engineering and IEC 62304, which includes provisions for identifying risks related to medical device software.

The ISO 14971 risk management process involves risk analysis, risk evaluation, risk control, and post-production monitoring. Risk management is handled through a cyclical approach, starting with risk assessment, where potential hazards are identified and their likelihood and severity are evaluated. After assessment, risk controls are established to reduce the severity or likelihood of hazards occurring; any remaining risks are reviewed against their associated clinical benefit. Finally, risk management data is collected during and after the production and release of a product; this data is reviewed as part of the next cycle of analysis.

Risk analysis in ISO 14971 involves identifying hazards, estimating the associated risks, and determining the impact and likelihood of those risks occurring. Hazards which may arise from both intended use and reasonably foreseeable misuse, and the analysis should also identify product characteristics which are required to make it safe. Once hazards are identified, their severity and likelihood are reviewed to determine acceptability, based on criteria defined by the organisation.

ISO 14971 should be reviewed regularly, particularly when changes are made to the medical device, or new information regarding risks becomes available.

Documentation required under ISO 14971 includes a risk management plan, risk assessment reports, and records of risk control measures taken.

Yes, ISO 14971 can be applied to software as a medical device, ensuring that software-related risks are adequately identified and managed throughout its lifecycle.

ISO 14971 risk management documentation should be reviewed regularly, particularly when changes are made to the medical device or new information regarding risks becomes available. Reports such as benefit-risk analyses should be reviewed as part of the post-market surveillance activities for the product, which may require reviews annually depending on the risk classification of the medical device.

Documentation required under ISO 14971 includes a risk management plan, risk assessment reports, risk-benefit analyses and records of risk control measures taken. These are referred to as a Risk Management File, which should be kept up to date. Other related records include competence records for clinical reviews and anyone involved in the risk management process.

Yes, ISO 14971 explicitly does apply to software as a medical device, ensuring that software-related risks are adequately identified and managed throughout its lifecycle.