ISO 14971:2019 Medical devices - Application of risk management to medical devices

ISO 14971:2019 is an international standard that specifies processes for managing risks associated with medical devices, including in vitro diagnostic (IVD) medical devices.

The International Organization for Standardization (ISO) publishes ISO 14971:2019.

ISO 14971:2019 was released on December 1, 2019.

Key changes include:

• Clarification of several requirements
• More detailed information on benefit-risk analysis
• Emphasis on post-production activities
• Alignment with ISO 13485:2016 (Medical devices — Quality management systems)

ISO 14971:2019 is intended for use by organizations involved in the design, development, production, installation, or servicing of medical devices and IVD medical devices.

Yes, it applies to software that is a medical device in its own right or that is an integral component of a medical device.

Yes, it applies to all stages, from initial conception to ultimate decommissioning and disposal.

ISO 14971:2019 is not a management system standard, so certification is not available. However, conformity to the standard can be assessed.

Implementation typically involves:

1. Understanding the standard's requirements
2. Developing a risk management plan
3. Identifying and analyzing hazards
4. Evaluating and controlling risks
5. Assessing overall residual risk
6. Conducting risk management review
7. Establishing post-production processes

Implementation time varies depending on the complexity of the medical device and the organization's existing risk management processes.

The standard is structured into several main sections:

• Scope
• Normative references
• Terms and definitions
• General requirements for risk management system
• Risk analysis
• Risk evaluation
• Risk control
• Evaluation of overall residual risk
• Risk management review
• Production and post-production activities

A risk management file is a set of records and other documents produced by risk management, as required by ISO 14971:2019.

The process includes:

1. Risk analysis
2. Risk evaluation
3. Risk control
4. Evaluation of overall residual risk
5. Risk management review
6. Production and post-production activities

Risk is defined as the combination of the probability of occurrence of harm and the severity of that harm.

Benefit-risk analysis involves evaluating if the medical benefits outweigh the residual risks for the intended use of the device

Risk evaluation involves deciding if risk reduction is required for each identified hazardous situation, based on predefined risk acceptability criteria.

Risk control measures should be implemented in the following order of priority:

1. Inherent safety by design
2. Protective measures in the device or manufacturing process
3. Information for safety (e.g., warnings, contraindications)

Post-production activities include collecting and reviewing information about the medical device after it has been released for distribution.

ISO 14971:2019 aligns with and complements ISO 13485:2016, which s

While ISO 14971:2019 is specific to medical devices, its principles can be used in conjunction with other risk management standards where appropriate.