News on the ISO 14971 standard version 2019: Medical devices - Application of risk management to medical devices

 07/01/2024

ISO 14971 version 2019 is the third version (edition) and replaces the second edition (2007).

• evaluate the risks
• deal with risks
• manage risks throughout the life cycle of medical devices

1. THE CLAUSES ARE 10 ACCORDING TO THE HIGH LEVEL STRUCTURE:

1. Scope
2. Normative references
3. Terms and definitions
4. General requirements for risk management
5. Risk analysis
6. Risk evaluation
7. Risk control
8. Evaluation of overall residual risk
9. Risk management review
10. Production and post-production activities

• Annex A (informative) Rationale for requirements
• Annex B (informative) Risk management process for medical devices
• Annex C (informative) Fundamental risk concepts

2. DIFFERENCES FROM THE 2007 VERSION

• high level structure (10 clauses including requirements in clauses 4 to 10)
• clause 3 (Terms and Definitions) is updated with new terms such as:
  • benefit
  • hazard
  • reasonably foreseeable misuse
  • state of the art
• the risk management process also includes risks related to data and system security
• the Risk reduction sub-clause is deleted
• the Evaluation of overall residual risk method is added
• risk management plan includes pre-market review
• the life cycle of medical devices is addressed more comprehensively
• post-production requirements are added
• certain annexes (C, F and J) are moved to ISO 24971 because they are closer to recommendations than requirements

3. REQUIRED RECORDS AND FILE 

• records (documents): 
  • risk management process (§ 4.1)
  • top management commitment (§ 4.2)
  • risk policy (§ 4.2)
  • decisions and actions (§ 4.2)
  • competence of personnel (§ 4.3)
  • risk management plan (§ 4.4)
  • changes of the risk management plan (§ 4.4)
• risk management file (§ 4.5):
  • risk analysis (§ 5.1)
  • intended use (§ 5.2)
  • reasonably foreseeable misuse (§ 5.2)
  • safety features (§ 5.3)
  • hazards and hazardous situations (§ 5.4)
  • risk estimation (§ 5.5)
  • results of the risk evauation (clause 6)
  • risk control measures (§ 7.1)
  • verification of the implementation of risk control measures (§ 7.2)
  • effectiveness of risk control measures (§ 7.2)
  • residual risk evaluation (§ 7.3)
  • benefit-risk analysis (§ 7.4)
  • risks from risk control measures (§ 7.5)
  • completeness of risk control (§ 7.6)
  • overall residual risk (clause 8)
  • evaluation of overall residual risk (clause 8)
  • accompanying documentation (clause 8)
  • risk management review (clause 9)
  • production and post-production phases (§ 10.1)
  • list of information collected (§ 10.2)
  • review of information (§ 10.3)
  • actions taken (§ 10.4)

4. PROCESSES REQUIRED process 

• risk management (§ 4.1)
• risk analysis (§ 5.1)