Last Updated: May 2026
ISO 13485 requires risk management. ISO 14971 defines how to do it. Understanding the precise relationship between these two standards — and what it means under the FDA’s QMSR — is the difference between a QMS that holds up under inspection and one that doesn’t.
Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.
📋 Free Download: ISO 13485 Gap Assessment Checklist Identify your compliance gaps before your first audit — 64 items across 7 sections including ISO 14971 risk management integration and all four FDA QMSR bridge requirements. Download Free Checklist
ISO 13485 Tells You to Manage Risk. ISO 14971 Tells You How.
That single sentence is the most important thing to understand about the relationship between these two standards — and it’s the part most manufacturers either misread or oversimplify.
ISO 13485:2016 is a quality management system standard. It requires risk-based thinking throughout the QMS — in design and development planning, production controls, supplier controls, complaint handling, and post-market surveillance. It references ISO 14971 in a note to Clause 7.1. But it does not specify how risk management must be conducted. It tells you risk management is required. ISO 14971 tells you how to do it.
ISO 14971:2019 is a risk management standard. It provides the structured framework — hazard identification, risk estimation, risk evaluation, risk control, overall residual risk evaluation, risk management review, and post-production monitoring — that gives ISO 13485’s risk management requirements their practical content.
Together they form the twin pillars of medical device quality and safety assurance. Neither is complete without the other for a manufacturer operating in any major regulated market. And under the FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, the relationship between the two standards now carries federal regulatory weight.
In This Guide
- What ISO 13485 covers and what it requires on risk
- What ISO 14971 covers and what it adds
- The key differences between the two standards
- The precise points where ISO 13485 references ISO 14971
- The important nuance about whether ISO 14971 is truly mandatory
- How the FDA QMSR changes the practical answer to that question
- How to implement both standards together
- Which standard to buy first and why
- Frequently asked questions
Table of Contents
✅ Start Here (Top Resources)
📋 Buy ISO 13485:2016 (official standard) → ANSI Webstore — ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.
📋 Buy ISO 14971:2019 (required companion) → ANSI Webstore — Purchase both standards together for maximum savings. Use coupon CC2026 for 5% off.
📋 Save buying both standards → ISO Standards Bundles — Up to 50% Off — Purchasing ISO 13485 and ISO 14971 as a bundle through the ANSI Webstore saves significantly compared to individual purchases.
📋 Get ISO 13485 trained before implementation → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.
📋 Get ISO 13485 certified → ISOQAR ISO 13485 Certification — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.
What Is ISO 13485?

ISO 13485:2016 is the international standard for quality management systems specific to the medical device industry. It specifies requirements for a QMS that enables an organization to consistently design, develop, produce, and deliver safe and effective medical devices and related services.
ISO 13485 is used as the baseline QMS framework by regulatory authorities and certification bodies in most major medical device markets — including Health Canada, the EU MDR, MDSAP, and since February 2, 2026, the FDA’s QMSR under 21 CFR Part 820.
ISO 13485 covers the full scope of quality management system requirements:
- Context of the organization and QMS scope
- Management responsibility, quality policy, and management review
- Resource management — personnel, infrastructure, and work environment
- Product realization — design and development, purchasing, production, and service provision
- Measurement, analysis, and improvement — internal audits, complaint handling, CAPA, and corrective action
What ISO 13485 requires on risk: ISO 13485 requires risk-based thinking throughout the quality management system. Risk management must be planned as part of product realization (Clause 7.1), integrated into design and development (Clause 7.3), applied to supplier controls (Clause 7.4), and fed by post-market surveillance feedback (Clause 8.2). The standard references ISO 14971 explicitly in its Clause 7.1 note and implicitly throughout its design and development requirements.
What ISO 13485 does not do is specify the methodology for risk management. It does not define how to identify hazards, estimate risks, evaluate acceptability, or control residual risk. That is what ISO 14971 does.
For a complete overview of ISO 13485 requirements, see What Is ISO 13485? Complete Guide.
What Is ISO 14971?
ISO 14971:2019 is the international standard for the application of risk management to medical devices. It provides the structured methodology — terminology, principles, and process — for identifying hazards, estimating and evaluating risks, implementing risk controls, and monitoring risk throughout the entire device lifecycle.
ISO 14971 covers:
- Risk management planning — scope, lifecycle phases, risk acceptability criteria
- Hazard identification — under both normal use and fault conditions
- Risk estimation — probability of harm and severity of harm
- Risk evaluation — comparison against acceptability criteria
- Risk control — priority order: design, protective measures, information for safety
- Evaluation of overall residual risk — including benefit-risk analysis where required
- Risk management review — pre-release review with identified reviewers
- Production and post-production information — systematic feedback into the risk management file
What ISO 14971 adds beyond ISO 13485: While ISO 13485 says risk management is required throughout the QMS, ISO 14971 specifies exactly how that risk management must be structured, documented, and maintained. The Risk Management File (RMF) — the central documentation output of the ISO 14971 process — is the evidence base that demonstrates a manufacturer has systematically identified hazards, evaluated risks, implemented controls, and monitored effectiveness.
For a complete overview of ISO 14971 requirements, see What Is ISO 14971? Risk Management for Medical Devices Explained.

ISO 14971 vs ISO 13485 — Key Differences
| Element | ISO 13485:2016 | ISO 14971:2019 |
|---|---|---|
| Standard type | Quality management system standard | Risk management standard |
| Purpose | Define QMS requirements for medical device manufacturers | Define the risk management process for medical devices |
| Scope | Entire quality management system | Risk management specifically |
| Risk coverage | Requires risk-based thinking throughout QMS | Specifies how risk management must be conducted |
| Key output | Certified, compliant QMS | Risk Management File (RMF) |
| Certification | Certifiable — third-party certification available | Not certifiable on its own |
| Published by | ISO Technical Committee 210 (ISO/TC 210) | ISO Technical Committee 210 (ISO/TC 210) |
| Current edition | ISO 13485:2016 | ISO 14971:2019 |
| Applies to | Manufacturers, suppliers, contract manufacturers | All organizations involved in device lifecycle |
| Risk methodology | Not specified | Six-step structured process |
| Hazard analysis | Referenced but not detailed | Defined in detail |
| Risk Management File | Not specified | Required |
| Benefit-risk analysis | Not addressed | Required when overall residual risk is unacceptable |
| Post-production monitoring | Addressed through complaint handling and feedback | Explicitly required as ongoing RMF input |
| QMSR status | Incorporated by reference into 21 CFR Part 820 | Expected framework; referenced through ISO 13485 |
Best for:
- ISO 13485: Any organization that designs, manufactures, or supplies medical devices and needs a certified quality management system
- ISO 14971: The same organizations — it provides the risk management methodology that ISO 13485’s requirements assume is in place
Where ISO 13485 References ISO 14971

ISO 13485 references ISO 14971 at specific points throughout its clause structure. Understanding exactly where these references occur is critical for building a compliant integrated system.
Clause 7.1 — Planning of Product Realization
Clause 7.1 requires that risk management activities be planned as part of product realization. The note to this clause states: “Further information can be found in ISO 14971.” This is the most direct reference to ISO 14971 in the standard.
Clause 7.3 — Design and Development
The design and development requirements of ISO 13485 are where ISO 14971 integration is most intensive. Design inputs must include risk management outputs. Design verification and validation activities must address risks. The Design and Development File (DDF) must reference risk management records.
Clause 7.4 — Purchasing
ISO 13485 Clause 7.4 requires that purchasing controls be proportionate to the risk the external provider poses to the finished device. The extent of supplier qualification, incoming inspection, and monitoring is determined by risk — which requires a risk framework to apply.
Clause 8.2 — Monitoring and Measurement
Post-market surveillance and complaint handling data collected under Clause 8.2 must feed back into the risk management process. ISO 14971 Clause 11 (Production and Post-Production Information) specifies how this information must be systematically reviewed and how it triggers updates to the Risk Management File.
Clause 8.5 — Improvement
CAPA activities under Clause 8.5 must consider risk. Significant quality failures identified through corrective action must evaluate whether the risk management file needs to be updated — connecting the two standards at the improvement level of the QMS.
At this point, most organizations beginning ISO 13485 implementation should:
📋 Purchase both ISO 13485:2016 and ISO 14971:2019 together as a bundle — the clause-by-clause integration means implementing one without the other creates immediate documentation gaps that auditors will identify.
→ ISO Standards Bundle — ANSI Webstore — Save up to 50% purchasing both standards together
Is ISO 14971 Actually Mandatory Under ISO 13485?
This is one of the most debated questions in the medical device quality community, and the honest answer is more nuanced than most articles present.
The technical answer: ISO 14971 is not formally mandated by ISO 13485. The reference in Clause 7.1 is a note — informative guidance, not a normative requirement. A manufacturer could theoretically implement a risk management process using a different methodology and still demonstrate conformance to ISO 13485’s risk-based requirements.
The practical answer: In the real world, ISO 14971 is effectively mandatory for any organization pursuing ISO 13485 certification or operating in regulated markets. Here’s why:
Certification bodies expect it. When a UKAS-accredited certification body audits your ISO 13485 QMS, the auditors evaluating your risk management program will be assessing it against the ISO 14971 framework — because that is the internationally recognized methodology for medical device risk management. A risk management program that doesn’t follow ISO 14971’s structure will face significant findings regardless of the technical argument about normative versus informative references.
Regulatory bodies reference it. The EU MDR, Health Canada, TGA, and MDSAP all reference ISO 14971 as the expected risk management framework. Operating without it creates regulatory exposure in every major market.
FDA QMSR changes the equation significantly — which brings us to the most important development of 2026.
The QMSR Changes the Practical Answer
The FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporated ISO 13485:2016 by reference into 21 CFR Part 820. Since ISO 13485 explicitly references ISO 14971, that reference now carries federal regulatory weight.
Under the FDA’s new inspection program — Compliance Program 7382.850 — FDA investigators are expected to start inspections by reviewing the risk management file and following risk documentation into other quality system areas. The risk management file is the inspection roadmap. If your risk management program is not structured against ISO 14971, your risk management file will not hold up under that inspection approach.
Additionally, the QMSR extended risk management expectations beyond design controls — where the old QSR concentrated them — to the entire quality system. This is precisely what ISO 14971 requires: risk management planning, hazard identification, risk control, and post-production monitoring integrated across the device lifecycle, not just in the design phase.
The bottom line under QMSR: Whether or not ISO 14971 is technically mandatory in the normative sense of ISO 13485, it is the framework FDA investigators will use to evaluate your risk management program. Operating without it under the current inspection regime is an inspection liability.
⚠️ QMSR effective February 2, 2026: If your risk management program is not built on the ISO 14971 framework, this is your highest-priority gap for QMSR compliance.
For the complete QMSR transition guide, see FDA QSR vs ISO 13485 — The Complete QMSR Transition Guide.
How the Two Standards Work Together in Practice
The integration of ISO 13485 and ISO 14971 is not a separate parallel process — it is woven into how the QMS functions. Here is how the two standards interact at each stage of the device lifecycle:
Concept and Planning Stage
ISO 13485 Clause 7.1 requires risk management to be planned as part of product realization. ISO 14971 provides the Risk Management Plan — the document that defines scope, lifecycle phases, risk acceptability criteria, and the methods that will be used throughout the device’s life.
Design and Development
ISO 13485 Clause 7.3 requires design inputs to include risk management outputs and design outputs to be reviewed against inputs. ISO 14971 provides hazard identification and risk analysis — the outputs of which flow directly into design input requirements, design verification criteria, and design validation protocols.
Purchasing and Supplier Controls
ISO 13485 Clause 7.4 requires supplier controls proportionate to supplier risk. ISO 14971’s risk framework defines what “risk” means in this context — the severity and probability of harm that could result from supplier failures. Risk level drives supplier classification, incoming inspection intensity, and qualification requirements.
Production
ISO 13485 Clause 7.5 requires controlled production conditions and validation of special processes. Risk management under ISO 14971 determines which processes require validation (those where outputs cannot be fully verified) and what monitoring is required during production.
Post-Market Surveillance and CAPA
ISO 13485 Clause 8.2 requires systematic collection of post-market information. ISO 14971 Clause 11 requires that production and post-production information be systematically reviewed and fed back into the risk management file. When complaint data or CAPA findings reveal new hazards or indicate that risk estimates were incorrect, the Risk Management File must be updated.
This is where the most common gap exists in practice: organizations that treat risk management as a design-phase deliverable and do not maintain the connection between post-market data and the risk management file. Under QMSR, this gap is visible to FDA investigators within the first day of an inspection.
📋 Free Download: ISO 13485 Gap Assessment Checklist Section 6 covers ISO 14971 risk management integration specifically — risk management plan requirements, RMF structure and completeness, post-production feedback, and QMSR inspection implications. Download Free Checklist
The Risk Management File — Where They Intersect Most Clearly

The Risk Management File (RMF) is the single most important integration point between ISO 13485 and ISO 14971. It is the documentation output of the ISO 14971 process, and it is the record that connects risk management to every other element of the ISO 13485 QMS.
The RMF is not a single document. It is an organized collection of records that includes:
- Risk Management Plan — scope, lifecycle phases, acceptability criteria, methodology
- Risk analysis records — hazard identification, risk estimation
- Risk evaluation records — comparison against acceptability criteria
- Risk control records — selected measures, implementation records, verification
- Overall residual risk evaluation — benefit-risk analysis where required
- Risk Management Review — pre-release review with identified reviewers
- Post-production information records — systematic review of real-world performance data
Under ISO 13485, the DDF (Design and Development File) must contain or reference risk management records. Under the QMSR and CP 7382.850, the RMF is where FDA investigators begin their inspection — tracing risk documentation into design controls, CAPA, complaint handling, and post-market surveillance.
A Risk Management File that was completed at device release and has not been updated since is one of the most common and most significant findings under the current inspection approach. The RMF is a living document. It must be updated throughout the device’s commercial life as post-production information is gathered and evaluated.
If your organization is already ISO 13485 certified and is assessing QMSR readiness, the current state of your Risk Management File is the single most important thing to evaluate first.
At this point, most organizations preparing for QMSR inspection should:
📋 Conduct a formal review of whether your Risk Management File has been updated since device release — and whether post-market complaint and CAPA data is systematically feeding into it. This is the highest-frequency inspection gap under CP 7382.850.
From the Shop Floor
After 25 years in heavy industrial manufacturing and quality systems, the most consistent pattern I see when organizations implement both ISO 13485 and ISO 14971 is this: they implement risk management well during design and development, and then they stop.
The Risk Management File is completed before device release. The risk management review is signed off. The certification audit passes. And then for the next three years, every complaint, every CAPA, every production nonconformance is handled in its own system — with no connection back to the risk management file that is supposed to be the living record of everything known about how the device can cause harm.
Three years later, an FDA investigator arrives under CP 7382.850 with the risk management file as their starting point. They trace a complaint about device malfunction into the CAPA system. They find a corrective action that was opened and closed. They look for the connection back to the risk management file — the evaluation of whether this complaint revealed a new hazard or indicated that an existing risk estimate was incorrect. The connection doesn’t exist.
That is not an ISO 13485 finding. It is not an ISO 14971 finding. It is a QMSR finding, because under the QMSR that connection is an expected element of a functioning integrated quality and risk management system.
The organizations that handle this well are the ones that treat the RMF update as a standing agenda item in management review — not a corrective action triggered by an audit finding. Post-market data goes into the RMF review process because the system requires it, not because an investigator asked for it.
That is what the integration of ISO 13485 and ISO 14971 is supposed to produce. It is also what separates manufacturers who pass inspections from those who merely survive them.
Which Standard Do You Buy First?
Both ISO 13485 and ISO 14971 are required for any serious medical device quality management implementation. The practical question is which to acquire and read first.
Buy ISO 13485 first if your organization is beginning the certification journey. ISO 13485 defines the overall QMS framework — understanding its requirements first gives you the context for understanding where and why ISO 14971 integrates.
Buy ISO 14971 immediately after — or together as a bundle. You cannot build a compliant risk management program from summaries or paraphrases. Both standards must be purchased, controlled as external documents within your QMS (as required under QMSR), and read by the people building your system.
For a complete overview of available medical device standards, see the Standards Library — Medical Devices Section.
The bundle option saves significantly. The ANSI Webstore offers the ISO 13485 and ISO/TR 14969 Quality Management Systems Medical Devices Package which includes both documents together at a meaningful discount versus individual purchases.
📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off
📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off
Frequently Asked Questions
What is the main difference between ISO 14971 and ISO 13485?
ISO 13485 is a quality management system standard that defines what a medical device manufacturer’s QMS must cover — including the requirement that risk management be applied throughout the system. ISO 14971 is a risk management standard that defines how risk management must be conducted — the six-step process, the required documentation, and the Risk Management File structure. ISO 13485 requires risk management. ISO 14971 specifies how to do it.
Is ISO 14971 required if you have ISO 13485?
ISO 14971 is not formally mandated by ISO 13485’s normative requirements — the reference in Clause 7.1 is a note, not a normative requirement. However, certification bodies evaluate risk management programs against the ISO 14971 framework, and under the FDA’s QMSR (effective February 2, 2026), risk management expectations now carry federal regulatory weight. For practical purposes, ISO 14971 is effectively required for any organization pursuing ISO 13485 certification or operating in regulated markets.
Can you be certified to ISO 14971?
No. ISO 14971 is not a certifiable standard — there is no third-party certification to ISO 14971 itself. ISO 13485 is the certifiable standard. However, ISO 13485 certification implicitly requires that risk management is conducted in a way consistent with ISO 14971, since that is the framework certification bodies evaluate against.
Which came first — ISO 13485 or ISO 14971?
Both standards have long histories. ISO 14971 was first published in 2000, with major revisions in 2007 and 2019. ISO 13485 was first published in 1996, revised in 2003, and again in 2016. The 2016 edition of ISO 13485 was developed with the intent of aligning more closely with the 2012 draft of ISO 14971, ensuring stronger integration between the two standards.
Does ISO 14971 apply to software as a medical device?
Yes. ISO 14971:2019 explicitly applies to Software as a Medical Device (SaMD). The companion document ISO/TR 24971 provides specific guidance on applying ISO 14971 to software, including cybersecurity risk considerations.
How does the QMSR affect the relationship between ISO 13485 and ISO 14971?
The QMSR (effective February 2, 2026) incorporated ISO 13485 by reference into 21 CFR Part 820. Since ISO 13485 references ISO 14971, that reference now carries federal regulatory weight. FDA investigators under the new Compliance Program 7382.850 start inspections with the risk management file — which is the primary output of the ISO 14971 process. The QMSR also extended risk management expectations across the entire QMS rather than concentrating them in design controls as the old QSR did.
What is the Risk Management File and which standard requires it?
The Risk Management File (RMF) is the organized collection of records that documents all risk management activities for a specific medical device — risk management plan, hazard analysis records, risk evaluation records, risk control records, overall residual risk evaluation, risk management review, and post-production information records. It is required by ISO 14971, not ISO 13485 directly. However, under ISO 13485, the Design and Development File must contain or reference risk management records — and under the QMSR, the RMF is what FDA investigators use as their inspection roadmap.
Do I need ISO/TR 24971 as well?
ISO/TR 24971:2020 is the technical report companion to ISO 14971:2019. It provides practical guidance on implementing ISO 14971’s requirements — methods for hazard identification, risk estimation, benefit-risk analysis, and software risk management. Unlike ISO 14971, it is guidance rather than a standard with requirements. For organizations building or rebuilding their risk management program, ISO/TR 24971 is a valuable implementation companion. It is not required, but it is practically useful.
How does ISO 14971 differ from ISO 31000?
ISO 14971 is specific to medical device risk management and defines risk in terms of patient harm — the combination of probability and severity of harm to people. ISO 31000 is a broader enterprise risk management standard with a wider definition of risk that includes any effect on objectives. The two are not interchangeable in the medical device context. ISO 14971 is the expected framework for medical device risk management. ISO 31000 is not.
✅ Free Resources
📋 ISO 13485 Gap Assessment Checklist — 64 items across 7 sections including ISO 14971 risk management integration requirements and all four FDA QMSR bridge requirements. Identify your gaps before your first audit.
📋 Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all compliance systems.
📋 Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.
📋 ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.
Not Sure What to Do Next?
✅ You need the official ISO 13485:2016 standard 📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off
✅ You need the official ISO 14971:2019 standard 📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off
✅ You want to save buying both standards together 📋 ISO Standards Bundle — ANSI Webstore — Save up to 50%
✅ You want to identify your ISO 13485 and QMSR compliance gaps before spending anything 📋 Download the Free ISO 13485 Gap Assessment Checklist
✅ You need ISO 13485 training before implementation 📋 ISO 13485 Training — BSI Group
✅ You are ready to pursue ISO 13485 certification 📋 ISOQAR ISO 13485 Certification
✅ You want to understand what ISO 13485 requires 📋 What Is ISO 13485? Complete Guide
✅ You want to understand what ISO 14971 requires 📋 What Is ISO 14971? Risk Management for Medical Devices
✅ You want to understand the FDA QMSR and its impact 📋 FDA QSR vs ISO 13485 — The Complete QMSR Transition Guide
✅ You want to compare ISO 9001 and ISO 13485 📋 ISO 9001 vs ISO 13485 — Key Differences
✅ You want to understand ISO 13485 purchase options and cost 📋 Buy ISO 13485 — Complete Guide 📋 How Much Does ISO 13485 Cost?
✅ You want to browse all available medical device standards 📋 Standards Library — Medical Devices & Regulated Manufacturing 📋 Popular Standards — Most Frequently Purchased
Still Figuring Out Where to Start?
If you’re not ready to purchase or certify yet — that’s normal. ISO 13485 and ISO 14971 implementation decisions typically take three to six months from first research to commitment.
The best next step for most organizations at this stage:
📋 Download the free ISO 13485 Gap Assessment Checklist — it covers all 64 clause requirements including the ISO 14971 integration section and the four QMSR bridge requirements. It takes 30 minutes and tells you exactly where your gaps are before you spend anything.
ISO 13485 and ISO 14971 Are Not Optional to Each Other
ISO 13485 tells you risk management is required across your quality management system. ISO 14971 tells you how to conduct it. One without the other produces either a QMS with undefined risk methodology or a risk management program without a quality system framework to integrate it.
Under the FDA’s QMSR, effective February 2, 2026, that integration is no longer just a best practice — it is what federal regulatory inspection expects. FDA investigators start with the risk management file. They follow it into design controls, CAPA, complaint handling, and post-market surveillance. A quality management system that treats risk management as a design-phase deliverable rather than a lifecycle discipline will not hold up under that inspection approach.
The organizations that get this right are the ones that treat the Risk Management File as a living operational document — not a certification artifact. They update it because post-market data flows into it systematically. They connect CAPA to it because the system requires the connection. They identify new hazards from real-world performance data because that is what ISO 14971 Clause 11 requires and what QMSR now enforces.
That is what implementing both standards properly actually produces.
At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.
✅ Get updates on new standards, implementation strategies, and compliance insights ✅ Be first to access new guides, tools, and checklists
Subscribe below to stay ahead.

























