What Is ISO 14971? Medical Device Risk Management Explained
ISO 14971 is the international standard for applying risk management to medical devices. It defines the process manufacturers must follow to identify the hazards associated with a device, estimate and evaluate the resulting risks, control those risks to acceptable levels, and monitor the controls throughout the device’s entire life cycle.
The current version is ISO 14971:2019 – the third edition, published in December 2019 and confirmed unchanged in ISO’s 2025 systematic review. It is recognized by regulatory authorities worldwide, including the FDA and the European Commission, and is referenced throughout ISO 13485:2016 – the quality management system standard for the medical device industry.
ISO 14971 is not a quality management system standard. It is a product risk management standard.
Together, ISO 13485 and ISO 14971 form the two pillars of medical device regulatory compliance: ISO 13485 governs how the organization is managed; ISO 14971 governs how product risks are identified, evaluated, and controlled.
On this page:
- What ISO 14971 actually requires
- The risk management process: step by step
- ISO 14971 and ISO 13485: how they fit together
- Regulatory recognition and requirements
- ISO/TR 24971: the companion guidance document
- Common compliance challenges
- How isoTracker helps
- What our customers say
- Useful resources
- Frequently asked questions
What ISO 14971 actually requires
ISO 14971 defines a systematic, documented process for managing risk across the full life cycle of a medical device, from early design through post-market surveillance. It applies to manufacturers of any medical device, regardless of size, type, or risk classification.
The process starts with a risk management system. Manufacturers integrate risk management into their organizational processes, assign responsibilities, define criteria for risk acceptability, and plan risk management activities for each device.
Risks are then analyzed and evaluated. Manufacturers identify all hazards associated with the device – including those arising from the intended use, foreseeable misuse, and the use environment – and estimate the probability and severity of harm for each hazardous situation. Each estimated risk is compared against the organization’s acceptability criteria. Risks that exceed acceptable levels must be reduced.
Risk control follows a defined hierarchy. First, eliminate or reduce risk through inherently safe design. Second, add protective measures. Third, provide information for safety, including labeling and instructions for use. Controls must be verified as effective – and checked to ensure they don’t introduce new risks.
Once all controls are in place, the manufacturer evaluates overall residual risk against the device’s expected benefits. If residual risk cannot be justified, the device should not be placed on the market. A risk management review before release confirms that the plan has been executed and residual risk is acceptable.
Risk management then continues in post-production. Manufacturers gather and review post-market information – complaint data, adverse event reports, literature – and feed it back into the risk management process to identify whether risks have changed in practice.
All of these activities must be documented in a risk management file for each device type. The file is the complete record of the risk management process, and regulators and notified bodies examine it as part of device approval and conformity assessment.
The risk management process: step by step
The ISO 14971 process is iterative and spans the whole device life cycle. The key stages:
Risk analysis. Identify the intended use and foreseeable misuse. Identify the characteristics that could affect safety, along with hazards and hazardous situations. Estimate each risk based on the probability of occurrence and the severity of potential harm.
Risk evaluation. Decide whether each estimated risk is acceptable using the organization’s predefined criteria. Risks exceeding acceptable levels require control.
Risk control. Identify and implement control measures, verify their effectiveness, and check whether the controls themselves introduce new hazards. Then evaluate residual risk and confirm it is acceptable.
Benefit-risk assessment. For any residual risk that cannot be reduced further, evaluate whether the medical benefit outweighs the remaining risk. This is a documented clinical judgment, not just a technical calculation.
Risk management review. Before the device is released, confirm that the risk management plan has been implemented as intended and that overall residual risk is acceptable.
Post-production information. Collect and analyze post-market data – adverse events, field safety corrective actions, complaints, literature – and feed findings back into the risk management file. If new hazards emerge or risk estimates change, the process must be updated.
ISO 14971 and ISO 13485: how they fit together
ISO 13485 and ISO 14971 are distinct standards serving different but complementary purposes. Both are essential for medical device manufacturers.
| ISO 13485:2016 | ISO 14971:2019 | |
| Type of standard | Quality management system standard | Product risk management standard |
| What it governs | How the organization is structured, managed, and controlled | How risks associated with a specific device are identified, evaluated, and controlled |
| Scope | The entire QMS – all processes, all products | Each individual device or device family |
| Documentation | Quality manual, procedures, records | Risk management file for each device |
| Certification / conformity | Third-party certification possible | No stand-alone certification – assessed as part of regulatory submissions and QMS audits |
ISO 13485 explicitly references ISO 14971 in multiple clauses. Risk management is not a separate activity that happens alongside the QMS – it is embedded within it. Design controls, purchasing controls, production controls, CAPA, and post-market surveillance all draw on the risk management process ISO 14971 defines.
In practice, this means a manufacturer’s QMS documentation, risk management files, design history files, and post-market surveillance records must all be coherent and mutually reinforcing. Gaps between them are a common source of findings in regulatory audits and inspections.
Regulatory recognition and requirements
United States (FDA). The FDA recognizes ISO 14971:2019 as a consensus standard for medical devices. Manufacturers who declare conformance in premarket submissions (510(k), PMA, De Novo) may be able to reduce the risk management documentation those submissions require.
Note that the FDA’s Quality Management System Regulation (QMSR), in force since February 2, 2026, does not incorporate ISO 14971 by reference. It incorporates ISO 13485:2016 – and because ISO 13485 draws on ISO 14971’s terms and principles throughout, a risk management process aligned with ISO 14971 is the expected way to meet the QMSR’s risk management requirements.
European Union. In the EU, the applicable version for regulatory purposes is EN ISO 14971:2019/A11:2021.
This version includes two annexes (ZA and ZB) mapping the standard’s requirements to the EU Medical Device Regulation (MDR 2017/745) and the In Vitro Diagnostic Medical Devices Regulation (IVDR 2017/746). Compliance with it gives manufacturers a presumption of conformity with the relevant risk management requirements.
Only this specific version – not ISO 14971:2019 alone – provides that presumption. Using a version not listed in the EU Official Journal means demonstrating conformity by other means.
Other markets. ISO 14971:2019 is recognized or required by regulatory authorities in Canada (Health Canada), Australia (TGA), Japan (PMDA), and many other jurisdictions. It also forms part of the Medical Device Single Audit Program (MDSAP) assessment criteria.
ISO/TR 24971: the companion guidance document
ISO/TR 24971:2020 is a technical report published alongside ISO 14971:2019. It is not a requirements standard – it provides expert guidance and worked examples to help manufacturers implement the risk management process effectively.
Topics covered include risk acceptability criteria, risk estimation methods, the benefit-risk analysis process, risk management for in vitro diagnostic devices, and frequently misunderstood aspects of the standard. It also contains many of the annexes that appeared in earlier editions of ISO 14971 but were removed from the normative standard in the 2019 revision.
For manufacturers implementing the standard for the first time, or working through difficult risk management scenarios, ISO/TR 24971 is an invaluable companion. It is available for purchase from ISO.
Common compliance challenges
ISO 14971 is one of the most frequently cited areas of weakness in medical device regulatory submissions and QMS audits. These are the issues that cause the most difficulty.
Defining meaningful risk acceptability criteria. Manufacturers must establish criteria for deciding whether a risk is acceptable. Many adopt generic risk matrices without ensuring their criteria are justified, clinically meaningful, and consistently applied. Criteria that cannot be defended under regulatory scrutiny are a significant vulnerability.
Incomplete hazard identification. A risk management process is only as good as the hazard identification that feeds it. It must consider the intended use, all reasonably foreseeable misuse, the user population, and the use environment. Common gaps: misuse scenarios, software and cybersecurity hazards, risks from device combination, and hazards specific to vulnerable populations.
Risk controls that don’t actually reduce risk. A warning label is a legitimate control of last resort under ISO 14971’s hierarchy – but it is frequently overused as a substitute for design-based risk reduction. Regulators and notified bodies are increasingly critical of risk files that lean on labeling to address risks that could have been designed out.
Disconnection between the risk management file and design documentation. The risk management file, design history file, and technical documentation must be coherent and mutually consistent. Risk controls must be traceable to design outputs; design changes must trigger a risk management review. Organizations that manage these as separate workstreams consistently produce inconsistent documentation.
Post-market surveillance that doesn’t feed back into risk management. Manufacturers must collect post-production information and update risk management files when new information affects risk estimates. Many have post-market surveillance procedures but don’t systematically route the findings back into the risk management process. This gap is increasingly scrutinized under the EU MDR.
Software and cybersecurity risks. Applying ISO 14971 to software – including standalone software as a medical device (SaMD) – and to cybersecurity risks is an area of active regulatory focus. Many manufacturers have not fully integrated software and cybersecurity risk assessment into their ISO 14971 process.
How isoTracker helps with ISO 14971 compliance
ISO 14971 risk management is documentation-intensive and spans the entire device life cycle. isoTracker’s quality management modules support the document control, audit, corrective action, complaints, nonconformance, and post-market surveillance infrastructure that a compliant process depends on.
Document control. isoTracker’s Document Control module provides centralized, version-controlled management of all risk management documentation: risk management plans, analysis and evaluation records, risk management reports, and the risk management file itself. Automated approval workflows and audit trails keep documents current, controlled, and linked to device design documentation. When designs change, the system supports a structured review to ensure risk management files are updated.
Risk management. isoTracker’s Risk Management module provides a structured platform for recording, assessing, and tracking risks. It supports the systematic identification, estimation, evaluation, and control process ISO 14971 requires, with automated workflows, notifications, and real-time dashboards to keep activities on track.
Nonconformance management. The Nonconformance module provides a central record of product nonconformances – an important data source for spotting risks that are materializing in practice. Nonconformance trends feed into the post-production information review required by clause 10.
Complaints management. Customer complaints are one of the primary sources of post-market safety information under ISO 14971. isoTracker’s Complaints Management module provides a structured workflow for logging, investigating, and resolving complaints, with integration into CAPA. Complaint data is captured and reviewed systematically – supporting post-production monitoring and the adverse event reporting obligations under the FDA QMSR and EU MDR.
CAPA. isoTracker’s CAPA module links identified risks and nonconformances to documented actions. When post-market information shows a risk has grown beyond acceptable levels, or a risk control has failed, CAPA provides the documented response: root cause investigation, action implementation, and effectiveness verification.
Audit management. The Audit Management module supports internal audits of both the QMS and the risk management process. Regularly reviewing whether risk management files remain current and complete is an important part of a functioning ISO 14971-compliant system.
Training management. isoTracker’s Training Management module tracks competence records for staff involved in risk management activities, and ensures training is updated when risk management procedures or guidance documents change.
All modules work together on a single integrated platform, or can be used stand-alone. Pricing is subscription-based – you pay only for the modules and users you need.
A free 60-day trial gives full access to all modules, with free email support included.
What our customers say
“isoTracker is a system that has brought order to our NCR process. It gives us instant access to incidents when we require it… I would recommend without hesitation.”
– Mark Holtman, Operations Director, Transformers & Rectifiers, UK
“isoTracker has provided us with an easy way to track documents that we need to control. We especially like the archived revision feature. The support from isoTracker Solutions has been excellent.”
– Stan Slonski, Managing Director, United Fire Protection Corp, USA
Useful resources
Authoritative sources:
Related isoTracker pages:
