ISO 14971 is not optional supplementary guidance for ISO 13485 — it is the required risk management framework woven throughout the medical device lifecycle. Here’s what it requires, how it works, and why the FDA’s QMSR makes understanding it more important than ever.
Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.
From the Shop Floor
Risk management in manufacturing is not a new concept. Every process engineer who has ever run a failure modes and effects analysis on a production line understands the core logic: identify what can go wrong, estimate how likely it is and how bad it would be, put controls in place, and verify those controls work.
What ISO 14971 adds to that foundation is structure, lifecycle scope, and documentation discipline.
After 25 years in heavy industrial manufacturing — including quality systems, process control, and operational risk — the single most consistent gap I see in medical device risk management is the treatment of the Risk Management File as a design-phase deliverable rather than a living operational document. Teams build an impressive RMF during product development, get through their certification audit, and then let the file sit static while the real world generates new information about how the device actually performs.
That approach worked well enough under the old QSR. It does not work under the QMSR.
FDA investigators under CP 7382.850 are not looking at your RMF to confirm it was done — they are using it as a roadmap to evaluate whether your entire quality system is functioning as an integrated risk management framework. A risk management file that hasn’t been updated since device release is not a minor documentation gap. It is evidence that your risk management process is not integrated with complaint handling, CAPA, and post-market surveillance the way the QMSR requires.
The organizations I have seen handle this well treat the RMF update as a standing agenda item in management review — not a corrective action triggered by an audit finding. If post-market data is generating complaints, those complaints are being evaluated in the context of the risk management file every quarter. That is the operating model QMSR expects.
ISO 14971 Is the Standard Your QMS Is Already Required to Implement
If you are pursuing ISO 13485 certification, operating under the FDA’s QMSR, or manufacturing medical devices for any major regulated market, ISO 14971 is not a standard you get to choose whether to implement.
ISO 13485:2016 explicitly requires risk management per ISO 14971 throughout the medical device lifecycle — in design controls, production processes, supplier controls, complaint handling, and post-market surveillance. Under the FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, that requirement now carries federal regulatory weight. FDA investigators under Compliance Program 7382.850 are expected to use the risk management file as their inspection roadmap.
Yet despite being one of the most referenced standards in medical device regulation, ISO 14971 remains one of the least understood. Most manufacturers know it exists. Far fewer understand what it actually requires, how its six-step process works across the device lifecycle, or why the 2019 edition introduced changes that many organizations still haven’t fully implemented.
This guide covers all of it — what ISO 14971 is, what it requires clause by clause, how it integrates with ISO 13485 and the QMSR, and what your risk management program needs to look like in practice.
In This Guide
- What ISO 14971 is and why it exists
- Who needs ISO 14971
- The six-step ISO 14971 risk management process
- Key clause-by-clause breakdown
- What changed in the 2019 edition
- The Risk Management File — what it contains and how it’s structured
- ISO 14971 and ISO 13485 — how they integrate
- ISO 14971 under the FDA QMSR
- ISO/TR 24971 — the companion guidance document
- How to buy the official standard
- Frequently asked questions
Table of Contents
✅ Start Here (Top Resources)
📋 Purchase the official ISO 14971:2019 standard → ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026
📋 Purchase the official ISO 13485:2016 standard — required companion → ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off
📋 Save up to 50% buying both standards as a bundle → ISO Standards Packages — ANSI Webstore
📋 Get ISO 13485 training that covers ISO 14971 integration → BSI Group ISO 13485 Training
📋 Get ISO 13485 certified with an accredited certification body → ISOQAR ISO 13485 Certification
What Is ISO 14971?
ISO 14971 is the international standard for the application of risk management to medical devices. The current version — ISO 14971:2019 — is the third edition, published in December 2019. It specifies the terminology, principles, and a structured process for identifying hazards associated with medical devices, estimating and evaluating the associated risks, controlling those risks, and monitoring the effectiveness of controls throughout the entire device lifecycle.
The standard applies to:
- Physical medical devices of all classifications
- Software as a Medical Device (SaMD)
- In vitro diagnostic (IVD) medical devices
- Combination products where the device constituent part requires risk management
Before ISO 14971, there was no universally accepted methodology for risk management in the medical device industry. Different manufacturers used different approaches, different terminology, and different standards for what constituted acceptable risk. ISO 14971 introduced a standardized process that could be consistently applied across the industry globally — giving regulators, certification bodies, and trading partners a shared framework for evaluating whether a manufacturer’s risk management is adequate.
Risk, as defined by ISO 14971, is the combination of two components:
- The probability that harm will occur
- The severity of that harm
This definition is important because it shapes the entire risk management process. A high-severity potential harm that is extremely unlikely to occur produces a different risk level than a moderate-severity harm that occurs frequently. ISO 14971 requires manufacturers to evaluate both dimensions systematically — not rely on intuition or experience alone.
Who Needs ISO 14971?
ISO 14971 is effectively required for any organization involved in the medical device supply chain. Specifically:
Organizations that must implement ISO 14971:
- Medical device manufacturers — it is explicitly required by ISO 13485 and referenced throughout FDA QMSR, EU MDR, Health Canada, TGA (Australia), and most other major regulatory frameworks
- Design-responsible organizations developing medical devices or device software
- Contract manufacturers producing devices under a design owner’s technical file
Organizations that should implement ISO 14971:
- Component suppliers whose products are incorporated into medical devices — risk management requirements are increasingly flowed down through quality agreements
- Software developers producing SaMD or software incorporated into medical devices
- Sterilization service providers — sterilization process risk must be managed within the device’s overall risk management framework
A critical distinction: ISO 14971 is not legally mandated in the same way a regulation is — regulators like the FDA do not list it as a statutory requirement. However, regulators worldwide recognize ISO 14971 as the state of the art for medical device risk management. Non-conformance with ISO 14971 — or the absence of a risk management program built on its framework — creates significant regulatory exposure. For practical purposes, ISO 14971 is mandatory for any organization intending to demonstrate that their device is safe and effective.
The ISO 14971 Risk Management Process — Six Steps
ISO 14971 defines a six-step risk management process that applies across the entire device lifecycle — from initial concept through design, production, and post-market activities.
Step 1 — Risk Analysis
Risk analysis is the systematic use of available information to identify hazards and estimate the risks associated with a medical device. It consists of two activities:
Hazard identification: Identifying all reasonably foreseeable hazards associated with the device under both normal use conditions and fault conditions. The 2019 edition specifically requires both normal and fault conditions to be considered — a change from the 2007 edition which emphasized fault conditions primarily.
Sources of hazards include:
- Device energy sources (electrical, thermal, mechanical, radiation)
- Device materials and their biological interactions
- Use environment and user characteristics
- Reasonably foreseeable misuse
- Software failures and cybersecurity vulnerabilities
- Interactions with other devices
Risk estimation: For each hazardous situation identified, estimating the risk by determining the probability of occurrence of harm and the severity of that harm. ISO 14971 does not specify acceptable risk levels — manufacturers must establish their own objective criteria based on regulatory requirements, industry standards, and clinical context.
Step 2 — Risk Evaluation
Risk evaluation is the process of comparing estimated risks against the manufacturer’s defined risk acceptability criteria to determine whether risk reduction is required. If the estimated risk exceeds acceptable levels, the process moves to risk control. If the risk is within acceptable limits, it is documented as acceptable residual risk and monitored.
Step 3 — Risk Control
Risk control is the process of implementing and verifying measures to reduce risks that exceed acceptable levels. ISO 14971 requires risk control measures to be implemented in a defined priority order:
- Inherent safety by design — eliminate or reduce hazards through design decisions (preferred)
- Protective measures — guards, alarms, interlocks in the device or manufacturing process
- Information for safety — warnings, instructions for use, training requirements (last resort)
After implementing risk control measures, the residual risk — the risk remaining after controls — must be estimated and evaluated again. The process is iterative: if residual risk is still unacceptable, additional risk control measures must be implemented.
Risk control measures must also be evaluated for introduced risks — a control measure that eliminates one hazard may introduce a new one.
Step 4 — Evaluation of Overall Residual Risk
After all individual risks have been addressed, the overall residual risk of the device must be evaluated — not just each individual risk in isolation. If the overall residual risk is not acceptable using the manufacturer’s risk acceptability criteria, a benefit-risk analysis must be performed.
Benefit-risk analysis (introduced as a formal requirement in the 2019 edition) evaluates whether the clinical benefits of the device outweigh the overall residual risk in the context of the device’s intended use. If the benefits outweigh the risks, and appropriate information is provided to users, the device may be released. If the benefits do not outweigh the risks, the device cannot be released — additional risk control measures are required.
Step 5 — Risk Management Review
Before a device is released for distribution, a formal risk management review must be completed. The 2019 edition changed the title of this clause from “Risk Management Report” to “Risk Management Review” — a deliberate signal that this is an active review activity, not simply a summary document.
The review must confirm:
- The risk management plan has been fully implemented
- The overall residual risk is acceptable
- Appropriate methods are in place to collect and review production and post-production information
Reviewers must be identified in the risk management plan in advance — they cannot be appointed after the fact.
Step 6 — Production and Post-Production Information
Risk management does not end when the device is released. ISO 14971 requires a systematic process for collecting and reviewing information from production and post-market activities throughout the device’s commercial life. This includes:
- Complaint data and adverse event reports
- Post-market surveillance information
- Production nonconformances and CAPA trends
- New scientific and technical information relevant to device safety
When this information indicates that the risk management process needs to be updated — that a new hazard has been identified, or that an existing risk estimate was incorrect — the risk management file must be revised and risk control measures re-evaluated.
ISO 14971 Clause-by-Clause Breakdown
| Clause | Title | Key Content |
|---|---|---|
| 1 | Scope | Applicability to all medical devices, SaMD, IVDs, combination products |
| 2 | Normative references | ISO 9000:2015 for defined terms |
| 3 | Terms and definitions | 31 defined terms including risk, hazard, harm, hazardous situation, benefit |
| 4 | General requirements | Risk management system requirements, management responsibilities, competence requirements |
| 5 | Risk management planning | Risk management plan requirements — device scope, lifecycle phases, risk acceptability criteria |
| 6 | Risk analysis | Intended use, hazard identification, risk estimation |
| 7 | Risk evaluation | Comparison to acceptability criteria, benefit-risk analysis (Clause 7.4) |
| 8 | Risk control | Control option analysis, measure implementation, residual risk evaluation, introduced risks |
| 9 | Evaluation of overall residual risk | Overall residual risk acceptability, benefit-risk if needed |
| 10 | Risk management review | Pre-release review requirements, reviewer identification |
| 11 | Production and post-production activities | Information collection, new hazard identification, risk file updates |
What Changed in ISO 14971:2019
The 2019 edition is the third edition of ISO 14971, replacing the 2007 version. Several changes have practical implementation implications:
Benefit-risk analysis is now a formal requirement. The 2019 edition formally introduced benefit-risk analysis as a defined process step (Clause 7.4) when overall residual risk is not acceptable under the manufacturer’s criteria alone. The 2007 edition referenced this concept but did not treat it as a structured requirement. The FDA’s influence here is direct — the FDA revised its language to place “benefit” before “risk” for novel device submissions, and the ISO 14971 committee adopted this framing in the 2019 revision.
Both normal and fault conditions must be analyzed. Clause 5.4 of the 2019 edition explicitly requires identification of anticipated hazards under both normal use and fault conditions. The 2007 edition emphasized fault conditions — the 2019 edition closes that gap. This has direct implications for FMEA and hazard analysis documentation.
Post-production requirements are more prescriptive. The requirements for production and post-production information collection (Clause 11) are more detailed in the 2019 edition, with stronger emphasis on systematic feedback of real-world performance data into the risk management file.
Risk Management Review replaces Risk Management Report. The title change in Clause 9 (from “report” to “review”) reflects a substantive intent: the activity must be an active review with identified reviewers, not a passive summary document compiled at device release.
EN ISO 14971:2019 + A11:2021 for EU MDR. The European version of the standard includes Amendment A11:2021, which maps ISO 14971 requirements to the General Safety and Performance Requirements (GSPR) of the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR). Organizations selling into the EU need the A11 annex — organizations selling only in the U.S. do not, but the normative requirements are identical in both versions.
The Risk Management File
The Risk Management File (RMF) is the central documentation output of the ISO 14971 process. It is the organized collection of records that demonstrates a manufacturer has systematically identified hazards, evaluated risks, implemented controls, and monitored the effectiveness of those controls throughout the device lifecycle.
The RMF is not a single document. It is a defined collection of records that includes:
- Risk Management Plan (RMP): Defines the scope of risk management activities, the lifecycle phases covered, the risk acceptability criteria, the risk estimation methodology, and the verification activities planned
- Risk Analysis records: Hazard identification outputs, risk estimation records, FMEA or other analysis tool outputs
- Risk Evaluation records: Comparison of estimated risks against acceptability criteria
- Risk Control records: Selected control measures, implementation records, verification that controls achieved their intended risk reduction, evaluation of introduced risks
- Overall Residual Risk evaluation: Documentation of the overall residual risk assessment and benefit-risk analysis if required
- Risk Management Review: Pre-release review record with identified reviewers
- Post-Production information records: Systematic records of production and post-market information reviewed against the risk management file
A common audit finding is a Risk Management File that functions as a static document compiled at device release — rather than a living record updated throughout the device’s commercial life as post-production information is gathered. Under the QMSR, FDA investigators start inspections with the risk management file. A static RMF that hasn’t been updated since initial device release is a significant inspection vulnerability.
📋 How does your risk management program measure up? Section 6 of the free ISO 13485 Gap Assessment Checklist covers ISO 14971 integration specifically — risk management plan requirements, RMF structure, post-production feedback, and the QMSR inspection implications. Download Free Checklist
ISO 14971 and ISO 13485 — How They Integrate
ISO 14971 and ISO 13485 are companion standards — not alternatives. ISO 13485 is the quality management system framework. ISO 14971 is the risk management framework that ISO 13485 requires to be implemented throughout that QMS.
ISO 13485 references ISO 14971 in multiple clauses:
- Clause 7.1 — Planning of product realization: Risk management activities must be planned as part of product realization
- Clause 7.3 — Design and development: Risk management must be integrated throughout design and development activities
- Clause 7.4 — Purchasing: Supplier controls must reflect risk — suppliers of higher-risk components require more rigorous qualification
- Clause 8.2.1 — Feedback: Post-market feedback must be evaluated in the context of risk management
- Clause 8.5 — Improvement: CAPA and continual improvement activities must consider risk management outputs
ISO 14971 is not optional supplementary guidance for ISO 13485. Organizations implementing ISO 13485 must purchase and implement ISO 14971. It is an external document that must be controlled under ISO 13485 Clause 4.2.4 — registered, version-controlled, and accessible to relevant personnel.
For a complete comparison of how ISO 13485 and risk management requirements interact, see ISO 9001 vs ISO 13485 — Key Differences.
📋 Buy ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off
ISO 14971 Under the FDA QMSR
The FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporated ISO 13485:2016 by reference into 21 CFR Part 820 — and with it, ISO 13485’s explicit requirement for risk management per ISO 14971.
Under QMSR, several specific changes elevate the practical importance of ISO 14971:
Risk management now extends across the entire QMS. Under the old QSR, risk management was concentrated primarily in design controls. Under QMSR, risk-based thinking is required throughout the entire quality system — supplier controls, production processes, CAPA, complaint handling, and post-market surveillance. ISO 14971 is the expected framework for implementing this expanded risk management scope.
FDA investigators start inspections with the risk management file. Under Compliance Program 7382.850 — the new inspection program that replaced QSIT on February 2, 2026 — FDA investigators are expected to begin inspections by reviewing the risk management file and following risk documentation into other quality system areas. A well-maintained, current risk management file is inspection preparation. An incomplete or static risk management file is an inspection liability.
Post-market surveillance feeds the risk management file. The QMSR’s requirements for production and post-production information — complaint handling, MDR, field corrections — are expected to feed systematically into the risk management file. Organizations that maintain complaint handling and risk management as separate, unconnected systems have a QMSR gap.
For the complete QMSR transition guide, see FDA QSR vs ISO 13485: The Complete QMSR Transition Guide.
ISO/TR 24971 — The Companion Guidance Document
ISO/TR 24971:2020 is the technical report published as a companion to ISO 14971:2019. Unlike ISO 14971, which is a normative standard (its requirements are mandatory for certification purposes), ISO/TR 24971 is guidance — it does not add requirements but provides practical methodology for implementing ISO 14971’s requirements.
ISO/TR 24971:2020 covers:
- Guidance on risk management planning
- Practical methods for hazard identification and risk estimation
- Guidance on benefit-risk analysis
- Application of risk management to software
- Application of risk management to usability and human factors
- Guidance on production and post-production information processes
For organizations building or rebuilding their risk management program, ISO/TR 24971 is the practical implementation companion to ISO 14971’s requirements. Many experienced quality and regulatory professionals recommend reading both together.
📋 ISO/TR 24971:2020 — ANSI Webstore — use coupon CC2026 for 5% off
How to Buy ISO 14971
ISO 14971 is a copyrighted document and must be purchased from an authorized source. It cannot be legally downloaded for free.
ANSI Webstore — Recommended U.S. Source
The ANSI Webstore is the authorized U.S. distributor for ISO standards. ISO 14971:2019 is available in PDF format with immediate download after purchase.
📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026
Bundle with ISO 13485 — Save Up to 50%
Organizations implementing ISO 13485 need both standards. Purchasing as a bundle through the ANSI Webstore saves significantly compared to individual purchases.
📋 ISO Standards Bundles — Save up to 50%
For the complete guide to purchasing ISO 13485, see Buy ISO 13485 — Complete Purchasing Guide.
Frequently Asked Questions
What is ISO 14971 used for?
ISO 14971 is the international standard for applying risk management to medical devices. It provides the structured process — hazard identification, risk estimation, risk evaluation, risk control, overall residual risk evaluation, and post-production monitoring — that manufacturers must use to demonstrate that their devices are safe for their intended use.
Is ISO 14971 required for ISO 13485 certification?
Yes. ISO 13485 explicitly requires risk management per ISO 14971 throughout the medical device quality management system. Organizations cannot achieve ISO 13485 certification without demonstrating that their risk management program is built on the ISO 14971 framework. ISO 14971 must be controlled as an external document within the ISO 13485 QMS.
Is ISO 14971 required by the FDA?
ISO 14971 is not listed as a statutory FDA requirement. However, the FDA recognizes ISO 14971 as the state of the art for medical device risk management. Under the QMSR, effective February 2, 2026, ISO 13485 is incorporated by reference into 21 CFR Part 820 — and ISO 13485 explicitly requires ISO 14971. FDA investigators under CP 7382.850 use the risk management file as their inspection starting point. For practical purposes, ISO 14971 is effectively mandatory for any FDA-regulated medical device manufacturer.
What is the difference between ISO 14971:2007 and ISO 14971:2019?
The 2019 edition introduced several substantive changes: benefit-risk analysis is now a formal requirement when overall residual risk is not acceptable; both normal use and fault conditions must be analyzed during hazard identification; post-production requirements are more prescriptive; and the Risk Management Report was renamed Risk Management Review to signal an active review activity rather than a passive document.
What is the Risk Management File?
The Risk Management File (RMF) is the organized collection of records that demonstrates a manufacturer has systematically implemented the ISO 14971 risk management process. It includes the Risk Management Plan, hazard analysis records, risk evaluation records, risk control records, overall residual risk evaluation, risk management review, and post-production information records. The RMF is a living document — it must be updated throughout the device’s commercial life as post-production information is gathered.
What is ISO/TR 24971?
ISO/TR 24971:2020 is the technical report companion to ISO 14971:2019. It provides practical guidance on implementing ISO 14971’s requirements — methods for hazard identification, risk estimation, benefit-risk analysis, software risk management, and post-production information processes. It does not add normative requirements but is an essential practical companion for organizations building or rebuilding their risk management programs.
What is the difference between ISO 14971 and ISO 31000?
ISO 14971 is specific to medical device risk management and defines risk purely in terms of harm to people — the combination of probability of harm and severity of that harm. ISO 31000 is a broader enterprise risk management standard with a wider definition of risk that includes any effect on objectives, including positive risks (opportunities). The two standards serve different purposes and are not interchangeable in the medical device context.
Does ISO 14971 apply to software as a medical device?
Yes. ISO 14971:2019 explicitly applies to Software as a Medical Device (SaMD). ISO/TR 24971 provides specific guidance on applying ISO 14971 to software. The companion standard IEC 62304 — Medical Device Software Lifecycle Processes — also references ISO 14971 risk management requirements throughout its software development lifecycle requirements.
📥 Free Resources
- 👉 ISO 9001 Roadmap — Step-by-Step Implementation Guide
- 👉 Manufacturing Compliance Checklist — verify all compliance areas before your certification audit
- 👉 Supplier Quality Checklist — material supplier and tooling supplier qualification requirements
Not Sure What to Do Next?
✅ You need the official ISO 14971:2019 standard 📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026
✅ You also need ISO 13485:2016 — the required companion QMS standard 📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off
✅ You need the ISO/TR 24971 implementation guidance companion 📋 ISO/TR 24971:2020 — ANSI Webstore — use coupon CC2026 for 5% off
✅ You want to save buying multiple standards together 📋 ISO Standards Bundles — Save up to 50% — ANSI Webstore
✅ You need ISO 13485 training that covers ISO 14971 integration 📋 BSI Group ISO 13485 Training
✅ You are ready to pursue ISO 13485 certification 📋 ISOQAR ISO 13485 Certification
✅ You want to understand what ISO 13485 requires 📋 What Is ISO 13485? — Complete Guide
✅ You want to understand the FDA QMSR and how ISO 14971 fits 📋 FDA QSR vs ISO 13485 — The Complete QMSR Transition Guide
✅ You want to compare ISO 9001 and ISO 13485 📋 ISO 9001 vs ISO 13485 — Key Differences
✅ You want to understand ISO 13485 purchase options and cost 📋 Buy ISO 13485 — Complete Purchasing Guide 📋 How Much Does ISO 13485 Cost?
Risk Management Is Not a Deliverable. It’s an Operating Model.
ISO 14971 is not a checkbox on a certification audit list. It is the framework that determines whether the medical devices your organization produces — or supplies components for — are demonstrably safe for their intended use.
Under the FDA’s QMSR, effective February 2, 2026, that framework now carries federal regulatory weight. Risk management under QMSR extends across the entire quality system, and FDA investigators under CP 7382.850 are using the risk management file as their inspection roadmap.
The organizations that navigate this environment successfully are the ones that treat risk management as an operating discipline — not a documentation exercise. The Risk Management File is updated because post-market data is being systematically reviewed, not because an audit is scheduled. CAPA is connected to the risk management file because the quality system is integrated, not because an investigator asked to see the connection.
That is what ISO 14971, properly implemented, actually produces.
At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.
✅ Get updates on new standards, implementation strategies, and compliance insights ✅ Be first to access new guides, tools, and checklists
Subscribe below to stay ahead.
5 thoughts on “What Is ISO 14971? Risk Management for Medical Devices Explained (2026 Guide)”