Skip to main content

Risk Management (ISO 14971)

Overview​

Risk management is mandatory for all medical devices under MedDO Annex I §§ 1–9. ISO 14971:2019 is the harmonised standard providing the accepted methodology. Risk management is a lifecycle activity — not a one-time documentation exercise.

Risk Management File (RMF)​

The RMF documents all risk management activities for a specific device. It must be updated when: new hazards are identified post-market; the device design or intended purpose changes; new clinical evidence affects the known risk profile; an FSCA or serious incident reveals a previously unrecognised risk.

The Five-Stage ISO 14971:2019 Process​

  1. Risk analysis — Define intended use and reasonably foreseeable misuse; identify hazards and hazardous situations; estimate probability and severity of harm
  2. Risk evaluation — Determine acceptability of each estimated risk against the risk acceptance criteria
  3. Risk control — Apply risk reduction measures in priority order: inherently safe design → protective measures → information for safety. Verify effectiveness and absence of new risks
  4. Benefit-risk analysis — Where residual risks remain, weigh against clinical benefit; overall residual risk must be acceptable
  5. Production and post-production — Collect and review post-market data; update RMF accordingly

Integration​

Risk management integrates with: IEC 62304 (software lifecycle); ISO 10993 (biological hazards); GSPR compliance matrix; clinical evaluation; post-market surveillance.

Official Sources​

Disclaimer

AI-assisted content for navigation only. Always verify against official Swissmedic and Fedlex sources. Not legal or regulatory advice.