ISO 14971
ISO 14971 is the international standard for applying risk management to medical devices throughout their life cycle. It connects hazard identification, risk control and post-production information in one documented process.
What is ISO 14971?
ISO 14971 defines a systematic process for identifying medical device hazards, estimating and evaluating risks, controlling those risks and monitoring whether the controls remain effective.
As of July 2026, ISO 14971:2019 is the current edition. ISO confirmed it during its 2025 systematic review. The standard applies to medical devices, including IVDs and software, throughout their life cycles.
What is the difference between a hazard and a risk?
A hazard is a potential source of harm. Risk considers both the probability that harm will occur and the severity of that harm.
Keeping the terms separate is important. A device may contain an inherent hazard, but its design and protective measures can change the likelihood or severity of resulting harm. Risk management documents should make those relationships traceable.
Does ISO 14971 define acceptable risk levels?
No. ISO 14971 requires manufacturers to establish objective criteria for risk acceptability, but it does not prescribe one universal threshold. Appropriate criteria depend on the device, intended use, state of the art, applicable regulations and the manufacturer’s risk management policy.
When a risk cannot be reduced further, the manufacturer may need to assess whether the expected medical benefits outweigh the residual risk. A benefit-risk conclusion does not replace reasonable risk controls.
What information belongs in the risk management file?
The risk management file provides traceability across the process. It should connect the risk management plan, analyses, evaluations, controls, verification of those controls, residual-risk conclusions and review of production and post-production information.
The file does not have to be one physical document. It may reference controlled records elsewhere in the quality system, provided those records remain identifiable and accessible.
Does risk management continue after launch?
Yes. Production experience, complaints, adverse events, literature, cybersecurity information and post-market surveillance may reveal new hazards or change previous risk estimates. Manufacturers should use that information to update the risk analysis and determine whether corrective action is needed.
ISO 14971 supports regulatory work in the European Union, United States and other markets. It also provides the risk-management foundation for ISO 10993 biological evaluation and medical device software standards.
Market · Jul 24, 2026FDA US Medical Device RegistrationMarket · Jul 24, 2026EU Medical Device Classification & Regulation (MDR/IVDR)Research Report · Jul 27, 2026IVD Global Market Access 2026Research Report · Jul 20, 2026Orthopedic Implants: The 2026 Global Market-Access MapResearch Report · Jul 13, 2026Aesthetic Devices: The 2026 Global Market-Access MapResearch Report · Jul 6, 2026Continuous Glucose Monitors: The Global Regulatory MapRegulatory Update · Jun 25, 2026EU Harmonized Standards 2026 UpdateRegulatory Update · Jun 25, 2026MDCG 2021-5 Rev.1 EU REP Symbol TransitionRegulatory Update · Jun 2, 2026FDA Human Factors Guidance 2026 Update for Device SubmissionsRegulatory Update · May 26, 2026Regulation (EU) 2026/977 Establishes New Rules for Notified Bodies on Timelines, Costs, and ProceduresLet's Talk,
Anywhere You Are.
Whether looking for more information or ready to partner with us, we're here to guide you through every step of the regulatory process.
Contact us