ISO 14971 is the international standard that defines how medical device manufacturers must identify, evaluate, control, and monitor risks throughout a device's entire lifecycle. For any company selling medical devices into the US, EU, or most other regulated markets, a documented ISO 14971-compliant risk management process is a regulatory requirement, not a best practice.
This guide covers the standard's core requirements, explains how to implement a risk management process that satisfies both FDA QMSR and EU MDR expectations, and identifies the most common gaps that appear during audits and inspections.
<h2>What ISO 14971 requires</h2>
ISO 14971:2019 applies to all phases of a medical device's life: design, development, production, post-production, and eventual decommissioning. The standard requires manufacturers to:
<ul>
<li>Establish a risk management plan for each device</li>
<li>Identify hazards and hazardous situations associated with the device</li>
<li>Estimate and evaluate the associated risks</li>
<li>Implement risk controls</li>
<li>Evaluate residual risk and the overall residual risk</li>
<li>Maintain a risk management file</li>
<li>Collect and review post-production information</li>
</ul>
The standard does not prescribe specific risk analysis methods. It requires that you use methods appropriate to the device and the nature of the hazards. FMEA, fault tree analysis (FTA), and hazard analysis are all common approaches used in practice.
<h2>The ISO 14971 risk management process, step by step</h2>
<h3>Step 1: Establish your risk management plan</h3>
For each device (or device family), you need a risk management plan that defines:
<ul>
<li>The scope of the risk management activities</li>
<li>Who is responsible for each activity</li>
<li>The risk acceptability criteria your organization will apply</li>
<li>How risk management activities will connect to your development process</li>
<li>How post-production information will feed back into the risk management file</li>
</ul>
The risk acceptability criteria are often the most difficult part to establish. ISO 14971 requires you to apply a risk policy that defines acceptable and unacceptable risk levels, typically expressed as a risk matrix (severity x probability). Your criteria must be defensible and documented before the risk analysis begins.
<h3>Step 2: Conduct hazard identification</h3>
Hazard identification starts with the intended use of the device and works outward to all reasonably foreseeable misuse. Consider:
<ul>
<li>Energy hazards (electrical, mechanical, thermal, radiation)</li>
<li>Biological and chemical hazards</li>
<li>Hazards from software failure or malfunction</li>
<li>Hazards from use error, including user interface design issues</li>
<li>Hazards from manufacturing variability</li>
<li>Hazards from degradation over the device's intended service life</li>
</ul>
ISO 14971 Annex C provides a checklist of example hazards organized by category. This is a useful starting point, not a complete list for any specific device.
<h3>Step 3: Estimate and evaluate risk</h3>
For each hazard and associated hazardous situation, estimate:
<ul>
<li><strong>Severity</strong> — the magnitude of potential harm if the hazardous situation leads to harm</li>
<li><strong>Probability of occurrence</strong> — how likely it is that the sequence of events from hazard to harm will occur</li>
</ul>
Risk is typically expressed as the combination of severity and probability. Each risk is then evaluated against your risk acceptability criteria to determine whether risk control measures are required.
Note: ISO 14971:2019 removed the concept of "broadly acceptable" risk from the 2007 version. Under the 2019 standard, all risks must be reduced as far as possible, even if they initially fall below the unacceptable threshold.
<h3>Step 4: Implement and verify risk controls</h3>
ISO 14971 specifies a hierarchy of risk controls that must be applied in order:
<ol>
<li><strong>Inherent safety by design</strong> — eliminate or reduce the hazard through design changes</li>
<li><strong>Protective measures</strong> — add safeguards in the device or the manufacturing process</li>
<li><strong>Information for safety</strong> — address residual risks through labeling, warnings, and instructions for use</li>
</ol>
After implementing controls, you must verify that:
<ul>
<li>The risk controls were actually implemented as designed</li>
<li>The risk controls are effective (residual risk is at an acceptable level)</li>
<li>The risk controls did not introduce new hazards</li>
</ul>
This last check is one area where risk analysis files frequently have gaps. A design change that eliminates one hazard may introduce a new electrical hazard or increase the complexity of the user interface. Each introduced hazard must be added to the analysis and evaluated.
<h3>Step 5: Evaluate overall residual risk</h3>
After all individual risks have been addressed, ISO 14971 requires an evaluation of the overall residual risk. The question is not just whether each individual risk is acceptable, but whether the combination of all residual risks is acceptable given the medical benefits of the device.
This evaluation must be documented and referenced against your risk acceptance criteria. For higher-risk devices, this often requires clinical data or published literature to support the benefit-risk conclusion.
<h3>Step 6: Maintain the risk management file</h3>
The <a href="https://www.cloudtheapp.com/glossary-risk-register/">risk register</a> and the full risk management file must be maintained and updated throughout the device's lifecycle. This is not a documentation exercise that ends at design freeze.
Post-production information, including complaint data, post-market surveillance reports, adverse event reports, and changes in state-of-the-art knowledge, must feed back into the risk management process. If new hazards are identified post-market, the risk file must be updated and additional risk controls implemented if needed.
<h2>ISO 14971 and FDA QMSR</h2>
Under FDA's QMSR regulation, which became effective February 2, 2026, risk management requirements align closely with ISO 13485:2016, which in turn requires compliance with ISO 14971 principles for risk management. If you hold ISO 13485 certification, your risk management process already needs to satisfy ISO 14971 requirements.
FDA does not require explicit ISO 14971 certification, but the standard's framework directly informs what FDA investigators look for when reviewing design control documentation and risk-related activities during inspections.
One area of particular scrutiny: risk management files must show a clear connection between identified risks, implemented controls, and verification activities. An analysis that documents hazards but does not trace those hazards through to the design history file or validation protocols is incomplete.
<h2>ISO 14971 and EU MDR</h2>
Under EU MDR (Regulation 2017/745), Annex I General Safety and Performance Requirements explicitly require compliance with ISO 14971 or an equivalent approach. The harmonized standard status of ISO 14971 under EU MDR means that demonstrated compliance with the standard creates a presumption of conformity with the relevant GSPR requirements.
EU notified bodies scrutinize several areas in particular:
<ul>
<li>Whether risk acceptability criteria are justified and documented before analysis begins</li>
<li>Whether all reasonably foreseeable misuse scenarios were analyzed</li>
<li>Whether the benefit-risk evaluation is supported by clinical evidence</li>
<li>Whether post-market surveillance data is actually being fed back into the risk management file</li>
</ul>
The last point is one of the most commonly cited gaps in EU MDR technical file reviews. Risk management is supposed to be a living process, and notified bodies expect to see dated updates to the risk file that reflect post-market experience.
<h2>Common gaps in ISO 14971 implementation</h2>
Based on inspection observations and notified body feedback, these are the most frequent gaps:
<strong>Risk acceptability criteria defined after the analysis.</strong> If your risk matrix was built around the analysis results rather than defined independently beforehand, the criteria are not credible. Define criteria first, document the rationale, and apply them consistently.
<strong>Incomplete hazard identification.</strong> Many risk files focus on hardware failure modes and underrepresent use error scenarios, software-related hazards, and hazards from packaging or sterile barrier failure.
<strong>Missing traceability between risk controls and design outputs.</strong> Each risk control measure must link to a corresponding design output, and verification that the control was implemented must be documented in the design history file.
<strong>No post-production updates.</strong> A risk file last updated at design freeze, with no documented review of field complaint data or post-market surveillance findings, will draw scrutiny in any audit.
<strong>Overall residual risk conclusion missing or unsupported.</strong> The overall residual risk evaluation is required by the standard and is frequently absent or contains only a generic statement without reference to clinical benefit data.
<h2>Managing ISO 14971 risk files in an eQMS</h2>
ISO 14971 risk management involves multiple interconnected documents: the risk management plan, risk analysis records, risk control documentation, verification evidence, and post-production review records. Managing these across multiple spreadsheets or file folders makes traceability difficult to maintain and demonstrate.
An electronic QMS provides structured <a href="https://www.cloudtheapp.com/glossary-risk-register/">risk register</a> capabilities that link hazard records to risk controls, connect risk controls to verification activities, and log post-production updates with timestamps and user attribution.
Cloudtheapp's eQMS includes risk management, FMEA, design controls, and audit management as fully integrated applications. With 60+ applications built for regulated industries including medical device, pharmaceutical, and biotech, Cloudtheapp gives quality teams the traceability and document control they need to maintain a compliant ISO 14971 risk file through every phase of the device lifecycle.
<a href="https://www.cloudtheapp.com/demo/">Schedule a demo</a> to see how Cloudtheapp supports ISO 14971 risk management in practice.
<h2>Related reading</h2>
<ul>
<li><a href="https://www.cloudtheapp.com/what-is-risk-management-in-iso-13485-and-fda-qmsr/">What Is Risk Management in ISO 13485 and FDA QMSR?</a></li>
<li><a href="https://www.cloudtheapp.com/medical-device-qms-the-complete-guide-to-fda-qmsr-and-iso-13485-compliance/">Medical Device QMS: The Complete Guide to FDA QMSR and ISO 13485 Compliance</a></li>
<li><a href="https://www.cloudtheapp.com/what-is-fmea-a-practical-guide-for-quality-engineers-and-compliance-teams/">What Is FMEA? A Practical Guide for Quality Engineers and Compliance Teams</a></li>
</ul>
