ISO 14971

ISO 14971 is the international standard for managing the risks of a medical device across its whole life: find the hazards, estimate and control the risks, judge what remains against the benefit, and keep watching once the device is on the market. EU and UK device regulators rely on it. There is no certificate for it on its own.

What it is and who it applies to

The formal designation is ISO 14971:2019, Medical devices, Application of risk management to medical devices, published by the International Organization for Standardization in December 2019 as the third edition. It replaced the 2007 edition, and ISO confirmed it unchanged at its 2025 review, so it remains current. A companion guide, ISO/TR 24971:2020, explains techniques and acceptability criteria but sets no requirements; most of the 2007 edition’s informative annexes moved into it.

The 2019 edition kept the shape of the process and sharpened it. It defines benefit, asks you to weigh the overall residual risk of the device against the benefits of its intended use, and expects you to collect production and post-production information actively rather than wait for it to arrive.

The European version is EN ISO 14971:2019 with amendment A11:2021. The amendment adds informative annexes that map the standard to the general safety and performance requirements of the EU MDR and the EU IVDR; the process itself is unchanged.

It applies to every manufacturer of a medical device, including software as a medical device and in vitro diagnostics, from concept to decommissioning. Its subject is harm to patients, users and other people, not business or information security risk. It sits inside a quality management system: ISO 13485 requires documented risk management in product realisation and points to ISO 14971 for the method.

This is guidance to help you understand the requirement, not legal advice.

Structure

Clauses 1 to 3 set out the scope, references and definitions. Clauses 4 to 10 carry the requirements, in the order the process runs, and three informative annexes explain the reasoning behind them and the risk concepts they rest on. The table paraphrases each requirement clause.

The plan and the file

The risk management plan (ISO 14971:2019 4.4) is written per device or device family. It sets the scope, who does what and, most important, the criteria for deciding whether a risk is acceptable. Those criteria come from a policy top management owns, so two teams in the same company judge risk the same way.

The risk management file (ISO 14971:2019 4.5) is not one document. It is the set of records, kept or referenced, that lets an assessor follow every hazard from identification to residual risk. Most manufacturers keep a hazard analysis table, a controls trace to design inputs and verification, the overall residual risk evaluation and the report, with production and post-market reviews appended over the device’s life.

Acceptable is a regulatory word too

The standard leaves acceptability criteria to you. EU MDR Annex I, section 2, does not: it asks you to reduce risks as far as possible without making the benefit-risk balance worse. Criteria that stop reducing a risk once it is low enough, or once a further control looks too expensive, are a common EU finding. Write criteria that reduce every risk as far as possible, then judge acceptability on the benefit-risk analysis (ISO 14971:2019 7.4 for single risks, clause 8 for the device as a whole).

Certification and enforcement

No accredited certification scheme exists for ISO 14971 on its own, and no certificate to it opens a market. Assessors read your risk work inside two other assessments: the ISO 13485 audit of your quality system, and your device’s conformity assessment.

In the EU

The EU MDR makes risk management a legal duty. EU MDR Article 10(2) requires manufacturers to run a risk management system as set out in Annex I, and EU MDR Article 10(9)(e) puts it inside the quality management system. EU MDR Annex I, section 3, describes a continuous process across the device’s life with a plan for each device and a feedback loop from post-market surveillance; section 4 sets the order of preference for controls and requires the residual risk of each hazard, and the overall residual risk, to be acceptable.

EN ISO 14971:2019 with A11:2021 is a harmonised standard under the MDR. Implementing Decision (EU) 2022/757 added it to the list kept in Implementing Decision (EU) 2021/1182, and the amendment of 11 June 2026 left that entry in place. Conformity with it therefore presumes conformity with the requirements it covers (EU MDR Article 8). A parallel decision lists it under the IVDR.

The results go into the technical documentation, which must hold the benefit-risk analysis and the risk management results (EU MDR Annex II, section 5). Above the self-declared Class I, a notified body assesses that file as part of conformity assessment.

In Great Britain and the US

In Great Britain, EN ISO 14971:2019 with A11:2021 has been a designated standard under UK MDR 2002 since 17 January 2026, replacing the 2012 European version. Designation gives a presumption of conformity with the essential requirements the standard covers, and UK approved bodies review the file as notified bodies do.

In the US, the FDA lists ISO 14971:2019 among its recognised consensus standards, and its quality system rules bring in risk management through ISO 13485.

The usual findings are acceptability criteria that conflict with the MDR’s as-far-as-possible rule, a risk file not updated after complaints or design changes, controls with no evidence that they work, and an overall residual risk evaluation that is one sentence long. Each is closed by changing the file, not by explaining it.

How the pieces fit

The process is a loop. The plan (ISO 14971:2019 4.4) sets the criteria. Risk analysis (ISO 14971:2019 5) starts from intended use and foreseeable misuse and works through hazards and hazardous situations to an estimate of each risk. Risk evaluation (ISO 14971:2019 6) compares each estimate with the criteria. Risk control (ISO 14971:2019 7) reduces what is not acceptable and checks that the controls work and create no new risk.

Once every single risk is handled, you judge the device as a whole (ISO 14971:2019 8) and review the work before release (ISO 14971:2019 9). The risk management report closes that phase, not the file. Production and post-production information (ISO 14971:2019 10) then reopens the analysis whenever it shows a new hazard or a risk that was estimated wrongly.

Other standards plug into the loop. IEC 62366-1 supplies the use-related hazards and controls, IEC 62304 the software ones, and clinical evaluation the evidence of benefit. ISO 13485 turns controls into design inputs and sends complaints and corrective actions back. An assessor follows one thread: a hazard, its control, the design input it became, the verification that proved it, and the complaint trend that would show it failing.

In this section

ISO 14971 is covered on this page; it has no sub-pages. The topics it depends on and feeds into have their own pages:

• ISO 13485 design and development: how do risk controls become design inputs, and how is their effect verified?
• ISO 13485: what quality system must the risk process sit inside?
• IEC 62366-1: how do you find and control the risks of use errors?
• IEC 62304: how does software risk management join this process?
• EU MDR technical documentation: where do the risk management file and report go in the file a notified body reviews?
• EU MDR post-market surveillance and vigilance: how does post-market data reach the risk file?
• How to run a risk assessment: how do you score likelihood and severity and write acceptance criteria?

How Sted maps it

ISO 14971 is one of the standards, regulations and schemes in Sted’s catalogue.

Sted treats it as mandatory when a product carries design responsibility under a device regulation that applies to you, or when a clinical investigation is planned or running, and as committed when you already keep a risk management file. It has no commercial route, because there is no certificate to pursue, and while the device regulation is still pending, so is ISO 14971. Under the EU MDR, a manufacturer role brings it in alongside ISO 13485, IEC 62366-1 and IEC 62304. Those rules work from your recorded answers; the AI model does not decide them.

Sted recommends it with its reasons, and you select it or leave it. Administrators and Policy and Process Owners make that choice. Choosing it and pressing Update and generate framework builds the documents it needs.

For ISO 14971 Sted’s knowledge base carries six procedures, led by the Risk Management Procedure (PRC-RMP), and 21 record templates, from the Medical Device Risk Management Plan (REC-MDRMP), Medical Device Risk Management File (REC-MDRM) and Risk Management Report (REC-RMR) to the usability, software and post-market records that feed them. The procedures are drafted for your organisation for you to review and approve, and each record template gives your evidence a fixed shape. The risk management plan comes with a suggested annual review, and nothing repeats until you pick a first due date. From then on Sted raises it when it falls due.

Because the catalogue lists clauses 4 to 10, an adopted ISO 14971 also gets a Statement of Applicability card on Summary, with the clauses as its rows. See Records, Documents and Classification and applicability for how they work in StedOS.

Sted does not decide whether a risk is acceptable or sign your risk management report. It holds the plan, the file and the report as documented information in your quality management system, under your own document control.

Frequently asked questions