ISO 14971: what it is, who needs it, and how risk management works

What is ISO 14971?

ISO 14971:2019 is the international standard for applying risk management to medical devices, from design to the information that comes back from the field. It defines a process for identifying hazards, estimating and evaluating risks, controlling them and accepting the residual risk. No body certifies against it. A manufacturer conforms to it, and the risk management file is the evidence.

The current edition is the third, published in December 2019. It is harmonised under the EU MDR as EN ISO 14971:2019 with amendment A11:2021, recognised by the FDA as a consensus standard and referenced by ISO 13485 at clause 7.1, where that standard asks for risk management in product realisation. The guidance on applying it is ISO/TR 24971:2020.

Who needs ISO 14971?

Manufacturers of every class of medical device, since ISO 13485 asks for risk management through product realisation and the EU MDR and the FDA's QMSR both expect the file

Developers of software as a medical device and of software inside a device, since IEC 62304 requires the software risk process to follow ISO 14971

Contract designers, suppliers and in vitro diagnostic manufacturers whose customers or notified body ask to see the risk management file before the design is signed off

The standard becomes urgent when the notified body asks for the risk management file, when a design change reopens the hazard analysis the week before a design review, or when a complaint describes a hazardous situation the file never listed.

What ISO 14971 asks for, clause by clause

Clauses 1 to 3 are scope, references and terms. The process runs from clause 4 to clause 10, and the records it produces make up the risk management file.

Clause 4, general requirements for a risk management system

A process across the life of the device, top management's responsibility and a policy for acceptable risk, competent people, a risk management plan for each device, and the file that holds every record the process produces

Clause 5, risk analysis

Intended use and reasonably foreseeable misuse, the characteristics related to safety, the hazards and the hazardous situations they lead to, and an estimate of the risk for each

Clause 6, risk evaluation

Each estimated risk judged against the acceptability criteria set in the plan, to decide whether it needs control

Clause 7, risk control

Options weighed in the standard's order (inherently safe design, protective measures, information for safety), measures implemented and verified, residual risk evaluated, benefit-risk analysis where a risk stays unacceptable, new risks the controls introduce, and a check that every hazardous situation has been considered

Clause 8, evaluation of overall residual risk

The device's residual risk as a whole judged by the method and criteria the plan set, with the benefits weighed where it is not acceptable

Clause 9, risk management review

Before release, a review that the plan was carried out, that overall residual risk is acceptable and that the methods for collecting information after release are in place, recorded in the risk management report

Clause 10, production and post-production activities

Information collected from manufacturing, users, the supply chain and the market, reviewed for new hazards or changed estimates, with action taken on the device and the file

How risk management under ISO 14971 works

1. Plan

Write the risk management plan for the device: scope, responsibilities, the criteria for acceptable risk and how overall residual risk will be judged, so that every evaluation later is against something set in advance.

2. Analyse

Define the intended use and the reasonably foreseeable misuse, list the hazards and the hazardous situations they lead to, and estimate the severity and probability of harm for each.

3. Evaluate and control

Judge each risk against the criteria, choose controls in the standard's order of preference, implement and verify them, and check for the new risks a control can introduce.

4. Review and report

Evaluate the overall residual risk, weigh benefit against risk where it is needed, and record the review in the risk management report before release, with the file compiled into the technical documentation.

5. Keep the file alive

Review complaints, field information and manufacturing data for hazards the analysis missed or estimates that have changed, and take the file back through the process when they do.

ISO 14971 IN QUALIO

Qualio links every hazard to its control and the test that verifies it, so the risk management file is current when the design review opens

Qualio holds the hazards, controls and tests, and rebuilds the traceability from each hazard to its control and the test that proves it as the design changes in Jira and TestRail. The risk management report is approved as a controlled document and compiled into the technical documentation at that version. Qualio maps ISO 14971 clause by clause to your risk procedure beside ISO 13485 and reassesses it on every change.

Every hazard traced to the control that answers it and the test that verifies the control, for clauses 5 and 7, with the links rebuilt as the work changes

The risk management plan and the risk procedure for clause 4 held as controlled documents, with training assigned on the effective date of each revision

The risk management report for clause 9 kept as a version with its approvals inside the compiled technical documentation, so the next submission starts from the last

ISO 14971 in the same library as ISO 13485 and the QMSR, so the risk management ISO 13485 asks for is assessed against the same records and answered once

Standards that apply alongside ISO 14971

Medical devicesISO 13485: Asks for risk management through product realisation and references ISO 14971 at clause 7.1, so the file is what the registrar reads for that clause
Medical devicesFDA QMSR: Inherits ISO 13485's risk requirements, so an FDA investigator reads the same file at inspection
Medical devicesEU MDR: Requires a risk management system in its general safety and performance requirements, with the file inside the technical documentation the notified body reviews
Medical devicesIEC 62304: Requires the software risk management process to follow ISO 14971, so software hazards sit in the same file as the device's
Product submissionsFDA 510(k): Takes its risk management section from the file, with the controls the performance testing verifies

Neufit

NeuFit is the Austin-based manufacturer of Neubie, a neuromuscular electrical stimulation medical device.

Read the Neufit story

“We're so streamlined now. It's amazing where we were, compared to where we are now. I hope we get the same auditor in future, so I can say, look how wonderful this is now.”

Ami AndersonDirector of Operations & Quality Management, NeuFit

Guides and checklists for ISO 14971

Toolkit

ISO 14971 toolkit

Checklist

ISO 14971 compliance checklist

Guide

ISO 14971 mastery guide

Questions about ISO 14971

What is ISO 14971?

ISO 14971:2019 is the international standard for applying risk management to medical devices across the life of the device. It sets out a process for identifying hazards, estimating and evaluating risks, controlling them and accepting the residual risk, and it records the whole of that process in a risk management file that regulators and auditors read.

Is there an ISO 14971 certificate?

No. ISO 14971 is a process standard with no certification scheme, and no body issues a certificate for it. A manufacturer conforms to it, and the risk management file is the evidence. The file is checked by the registrar at an ISO 13485 audit, by the notified body under the EU MDR and by the FDA at inspection.

Is ISO 14971 mandatory?

Not as a law by itself. In practice it is how ISO 13485 expects risk management done, it is harmonised under the EU MDR so conforming to it is the accepted way to meet the risk requirements, and the FDA recognises it as a consensus standard. A device company that does not conform has to show an equivalent process.

What is the difference between ISO 14971 and ISO 13485?

ISO 13485 is the standard for the whole quality management system at a medical device company, and a registrar certifies against it. ISO 14971 is the standard for one process inside that system, risk management, and nobody certifies against it. ISO 13485 asks for risk management wherever product is realised and references ISO 14971 at clause 7.1.

What is ISO/TR 24971?

ISO/TR 24971:2020 is the technical report that explains how to apply ISO 14971, with the guidance that used to sit in the standard's own annexes: the policy for acceptable risk, risk analysis techniques, the benefit-risk analysis and the information to collect after release. A second part, ISO/TS 24971-2, published in June 2026, covers machine learning.

Can we add ISO 14971 to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the risk procedure, plans and records you already hold against every clause, beside ISO 13485 if you run that too. The first assessment lists what is covered and what is new, and the hazards, controls and tests in your design controls are read as they are.

When is the next design review?

Bring the date and your hazard analysis. We will show you each hazard traced to its control and the test behind it, and the risk management report compiled into the technical documentation.

Book a demo Get the ISO 14971 toolkit

Less time on documentation. More time on the device.