ISO 14971 Risk Management for Medical Devices, Explained for Non-Engineers

ISO 14971:2019 is the international standard for risk management of medical devices. It tells a manufacturer how to find the hazards in a device, estimate and evaluate the risks, control them, and keep watching them for the whole life of the device. It is the method auditors, buyers and regulators expect behind every other claim a device company makes.

What ISO 14971 actually is

Every medical device can hurt someone. A pump can deliver the wrong dose. A scalpel handle can slip. A software update can freeze a monitor mid-surgery. ISO 14971 exists because "we were careful" is not a system. The standard gives a manufacturer a repeatable way to think about harm before it happens, write the thinking down, and keep updating it as real-world evidence comes in.

The current edition is ISO 14971:2019, released in December 2019. It replaced ISO 14971:2007 and the European EN ISO 14971:2012. If your documents still cite the 2007 edition, an auditor will ask why. The 2019 edition applies to every phase of a device's life, from the first sketch to the last unit in the field, and it covers software as a medical device and in vitro diagnostic devices too.

Two things the standard does not cover, and the distinction matters. It does not apply to decisions about using a device in one particular clinical procedure — that is the doctor's call, not the manufacturer's. And it does not cover business risk: the risk that a product fails in the market is not ISO 14971's business. It is about harm to people.

Is it law, or is it a choice?

Technically, the standard is voluntary. Practically, it is not a choice at all, and here is why. In Europe, EN ISO 14971:2019+A11:2021 is the harmonised version under the Medical Device Regulation. Apply it and you get a presumption of conformity with the regulation's safety requirements. The MDR's Annex I says risks must be reduced as far as possible without harming the benefit-risk ratio — and 14971 is the method everyone uses to show that.

In the United States, the FDA recognises ISO 14971:2019 in full, under recognition number 5-125, since 23 December 2019. And from 2 February 2026, the FDA's Quality Management System Regulation requires risk management throughout the quality system, working through ISO 13485:2016. The FDA's rule does not paste ISO 14971 into the regulation word for word, but a device company without a 14971-shaped risk process will not pass a QMSR inspection.

Then there is the point most guides skip: the standard sets no acceptable risk levels. It requires you to set your own criteria for what counts as acceptable, in writing, before you start judging risks. Two companies can look at the same hazard and reach different answers, honestly, because their criteria differ. What an auditor checks is that your criteria exist, that you applied them the same way every time, and that you can defend them.

The seven steps, one by one

The process runs in order, and each step feeds the next. The clause numbers are the ones auditors quote, so they are worth knowing.

1. The risk management plan (Clause 4). Before any analysis starts, you write the plan: scope, who is responsible, how you will judge acceptability, what verification you will do, and when the plan gets reviewed. A plan written after the analysis is a plan written to justify the analysis. Auditors notice.

2. Risk analysis (Clause 5). You describe the intended use and the reasonably foreseeable misuse — what happens when a tired nurse uses the device at 3 a.m., not just what the manual says. Then you list hazards and the hazardous situations that follow from them, and you estimate each risk. The guidance in ISO/TR 24971 helps here; the old hazard checklist was taken out of the standard itself in the 2019 revision and moved into that technical report.

3. Risk evaluation (Clause 6). Each estimated risk is compared with the acceptability criteria from your plan. Acceptable risks are recorded and left alone. Unacceptable risks move to the next step.

4. Risk control (Clause 7). You reduce the unacceptable risks, in a fixed order of priority — design first, protective measures second, information for safety last. I come back to this order below, because it is the part most companies get backwards.

5. Residual risk evaluation. After controls, you look at what risk is left and check it against the same criteria. Controls can also create new hazards — a sharper alarm can cause alarm fatigue — and those go back through the same loop.

6. Overall residual risk and benefit-risk analysis (Clause 8). You stop looking at hazards one by one and judge the device as a whole. If the remaining risk is still not acceptable on its own, you weigh it against the medical benefit. A heart valve that carries a small risk of clotting can still be acceptable, because the alternative is worse. That judgement has to be written down, with the clinical evidence behind it.

7. Production and post-production information (Clause 10). The file never closes. Complaints, vigilance reports, service data and post-market surveillance feed back into the risk analysis for the life of the device. A risk file that has not changed since certification day is a file nobody is reading.

The whole process is closed by a risk management review (Clause 9): a check that the plan was followed, the overall residual risk is acceptable, and the production and post-production information is actually being collected.

Severity × probability, worked out loud

Risk under ISO 14971 is the combination of two things: how bad the harm is, and how likely it is to happen. Take an infusion pump whose occlusion alarm fails silently. Severity: high — a blocked line means the patient gets no drug, and nobody is warned. Probability: low, if the alarm circuit is tested and the failure rate is one in ten thousand uses. High severity times low probability still lands in the "do something" zone for most companies' criteria, because the harm is serious and the fix is cheap: a second, independent alarm check.

Now flip it. A cosmetic scratch on the pump casing. Probability: high — it happens on most units in a year. Severity: negligible — nobody is harmed. That risk is acceptable without any control. The maths is simple. The discipline is writing down both numbers for every hazard, using the same scales every time, instead of deciding by gut feel which risks matter.

One warning: probability is the number teams argue about most, because it is the easiest to fudge. "It has never happened" is not a probability. Use field data from similar devices, published incident reports, and your own complaint history. If you have no data, say so in the file and use a conservative estimate.

The control order: fix the step, then the rail, then the sign

ISO 14971 insists on a priority order for controls, and it is the most practical idea in the whole standard. Think of a wobbly staircase in your house. The best fix is to rebuild the step so it cannot wobble — that is inherently safe design. The next best is a handrail, so a slip does not become a fall — that is a protective measure. The weakest fix is a sign that says "mind the step" — that is information for safety.

Now look at a device company that answers every hazard with a warning in the instructions for use. That is the sign on the staircase, used as the only fix. Auditors know the order, and they will ask why a design change was not considered first. Warnings and training sit last in the order for a reason: they depend on a tired human reading and remembering, at the exact moment it matters.

Real example: a reusable surgical instrument that must be sterilised between uses. The design-first control is a shape with no hidden crevices where blood can dry. The protective measure is a sterilisation indicator that changes colour. The information for safety is the reprocessing instruction in the manual. All three can exist together. The order decides which one you try first, and which one you are allowed to lean on.

The risk management file: what the auditor actually opens

The risk management file is not one document. It is the whole set of records that proves the process happened: the plan, the analysis, the control measures and their verification, the overall residual-risk evaluation, and the review report. Three pieces sit at the centre of it. The risk management plan sets the criteria and the responsibilities. The risk assessment holds the analysis, the evaluation, the controls and, where needed, the benefit-risk analysis. The risk management report proves the plan was followed, the overall residual risk is acceptable, and production and post-production information is being collected.

Two interfaces feed the file. Usability engineering under IEC 62366-1 supplies the use errors and foreseeable misuse — the human side of the hazards. The software life cycle under IEC 62304 requires ISO 14971 to be applied to device software, so a software team that works without a risk file is working outside the standard. For most Indian companies, the file lives inside the ISO 13485 quality system, because clause 7.1 of ISO 13485:2016 requires documented risk management in product realisation. Our ISO 13485 documents checklist shows where the risk file sits among the other records an auditor asks for.

FMEA is a tool, not the process

Ask a room of engineers what ISO 14971 is and someone will say "FMEA". It is not. Failure Mode and Effects Analysis is one tool for finding failure modes and scoring them. ISO 14971 is the whole process: the plan, the acceptability criteria, the control order, the benefit-risk judgement, the file, the review, and the post-market loop. FMEA can sit inside the risk analysis step and do a good job there. But a spreadsheet full of FMEA scores, with no plan, no criteria and no benefit-risk analysis, is not a risk management file. It is a spreadsheet.

The India layer: CDSCO, the Fifth Schedule and your licence

India's Medical Devices Rules, 2017 do not name ISO 14971 directly, and you should not let anyone tell you they do. The route runs through the quality system. The Fifth Schedule to the Rules sets out the quality management system a manufacturer must hold, and it mirrors ISO 13485:2016 — which in turn requires documented risk management in product realisation. So in practice, a manufacturer seeking a CDSCO manufacturing licence, or an importer holding an MD-15 import licence, is expected to run a risk process that looks like ISO 14971, even though the Rules never print the number.

That is why the risk file matters before the audit, not after it. A certification body auditing your ISO 13485 system will read the risk management file as evidence that product realisation is actually controlled. A CDSCO inspection can ask the same questions from the licensing side. The two audits are different, but the file is the same. Our ISO 13485 and CDSCO guide sets out how the licence classes and the certification fit together, and the importers and private labels guide covers who owns the file when the factory is overseas.

What changed in 2026

Two things. First, the FDA's QMSR took effect on 2 February 2026, harmonising the US quality rules with ISO 13485:2016 and making risk management a through-the-system requirement rather than a design-stage add-on. If you sell into the US, or plan to, your risk process is now part of the quality system inspection, not a separate exercise.

Second, ISO/TS 24971-2:2026 was published, giving the first guidance on applying ISO 14971 to machine-learning components in AI-based medical devices and IVDs. It is a technical specification, not a binding standard, but the Johner Institute's 2026 roundup notes it is likely to become the reference Notified Bodies and regulators reach for. If your device has an AI component, read it before your next design review — the risk questions for a model that keeps learning are different from the ones for a fixed algorithm.

What it costs and how long it takes

Risk management is usually built as part of an ISO 13485 project, not bought on its own. Our ISO 13485 consultancy costs ₹14,999 for Standard (up to 25 employees) and ₹29,999 for Growth (26–100 employees), consultancy only, with certification-body audit fees charged at actuals. A small company with one or two devices and a clean design history can usually build its first risk file in four to eight weeks of part-time work alongside the rest of the quality system. A company with several devices, software, or a messy legacy file should plan for three months. The honest variable is not the writing. It is how many design decisions the risk analysis forces you to revisit.

Before you start, it helps to know what the certificate you are working towards actually proves. Our guide to checking whether an ISO certificate is genuine explains the accreditation chain, and the ISO 13485 certification page sets out the full route. If you want a rough sense of the year's compliance spend before you commit, the compliance fee calculator puts the numbers in one place.

Five mistakes that fail audits

1. Writing the plan after the analysis. The plan sets the criteria. Criteria written after the results are known are not criteria.

2. Answering every hazard with a warning label. Information for safety is the last control in the order, not the first. Design first.

3. Using "it has never happened" as a probability. No data is not the same as low probability. Say what data you used, or admit you have none and estimate conservatively.

4. Treating FMEA as the whole process. A scoring spreadsheet is not a risk management file. No plan, no criteria, no benefit-risk analysis, no file.

5. Freezing the file after certification. Complaints and post-market data must feed back in. A file untouched since audit day is a file nobody is maintaining.

Frequently asked questions

What is ISO 14971 in simple words?
It is the international method for managing risk in medical devices. Find the hazards, estimate how bad and how likely each one is, control the ones that fail your own criteria, judge what risk is left against the benefit, and keep watching once the device is in use.

Is ISO 14971 mandatory?
The standard itself is voluntary, but the regulators behind it are not optional. The EU MDR gives presumption of conformity to the harmonised version, the FDA recognises the 2019 edition in full, and from 2 February 2026 the FDA's QMSR requires risk management through ISO 13485.

Does ISO 13485 include ISO 14971?
Not by name, but in practice yes. Clause 7.1 of ISO 13485:2016 requires documented risk management in product realisation, and ISO 14971 is the method auditors expect to see. A 13485 system without a risk file will not pass.

What goes in a risk management file?
The plan, the risk analysis and evaluation, the control measures and proof they work, the overall residual-risk evaluation with benefit-risk analysis where needed, and the review report — plus the production and post-production information that keeps it alive.

How is risk calculated under ISO 14971?
Risk is the combination of the severity of the harm and the probability it happens. The standard does not set the acceptable levels — you set your own criteria in the risk management plan, before you start judging risks, and apply them the same way every time.

Risk management sounds like paperwork until the day a complaint lands and you need to show your thinking. A good risk file is the record of decisions a careful company made before it had to defend them. Build it while the design is still open, keep it honest about what you do not know, and let the field data keep it current. That is the whole standard, and it is enough.