All terms
    Quality & RiskQuality System

    Hazard, Hazardous Situation, and Harm

    ISO 14971 distinction underpinning all medical-device risk analysis.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

    Definition

    A hazard is a potential source of harm. A hazardous situation describes circumstances in which people, property or the environment are exposed to a hazard. Harm is injury or damage to health, property or the environment. These are distinct points in a risk-management analysis, not interchangeable labels. A sequence of events can lead from a hazard to exposure and then to harm. Risk combines the probability of occurrence of harm and its severity. For an illustrative medical device example, electrical energy is a potential source, contact with an energized accessible part is the exposure situation, and an electrical burn is a possible harm. This summary is educational; consult the licensed ISO 14971 text for normative definitions and application.
    What the regulation says
    ISO 14971:2019 describes a medical-device risk-management process covering hazard identification, risk estimation and evaluation, risk control and monitoring of controls. The official ISO overview supports that process scope; it does not provide the complete normative clauses. No specific clause or annex is asserted here without access to the licensed text. Regulatory use or recognition of a standard should be checked for the relevant jurisdiction and submission.

    What this means in practice

    In a risk analysis, record the potential source of harm, the sequence of events, the exposure situation and each possible injury separately. A component failure is an event; it is not automatically a hazard or a harm. Keeping these distinctions visible helps a team explain why a control addresses a particular point in the sequence. For an illustrative electrical scenario, insulation damage could make a conductive surface live. Contact with that surface is a hazardous situation, and an electrical burn is a possible harm. The same potential source can produce different outcomes depending on who is exposed and how the device is used. Do not assign a single injury to every failure without examining the actual sequence. When selecting controls, ask which event or exposure the proposed design change addresses, what evidence demonstrates its effect and whether it introduces another risk. Record the rationale in the risk-management file and revisit it when field information changes the assumptions. This is an educational workflow, not a substitute for the licensed ISO 14971 requirements.

    Examples

    • Illustrative electrical sequence: damaged insulation (event), accessible electrical energy (hazard), a person touching the energized surface (hazardous situation), and a burn (harm).
    • Illustrative therapy sequence: a delivery interruption creates a situation in which a patient does not receive needed treatment; clinical context determines the possible harm. A generic failure label is not enough.
    • Illustrative cybersecurity sequence: unauthorized changes to a device setting may lead to unsafe treatment. The vulnerability, event sequence, exposure and patient injury should be analyzed separately.

    Use cases

    1 scenario
    1

    Reviewing a risk-analysis row

    Risk-management team

    A draft lists 'electrical burn' as the hazard. The team separates electrical energy, the events allowing contact, exposure to a live surface and the potential burn, then links each proposed control to the point it addresses.

    OutcomeA clearer, traceable analysis for design review; this illustrative row is not a validated device-specific risk assessment.
    Common pitfalls
    • •Using a failure mode, hazard and patient harm as interchangeable labels.
    • •Skipping the hazardous situation and moving directly from a component defect to injury.
    • •Assuming the probability of a software fault is the probability of patient harm.
    • •Assigning exact ISO clauses without consulting the licensed standard.
    • •Claiming a control eliminates all risk without evidence and residual-risk analysis.

    Frequently asked questions

    No. A hazard is a potential source; harm is injury or damage. A hazardous situation describes exposure. Keeping these distinct makes the sequence of events and possible controls clearer.

    Cross-references

    Used by

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Ecosystems (1)

    Latest in MedTech

    Sources

    3 sources

    Sources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Official-source claim check:

    Removed unsupported ISO clause and Annex references; clarified hazard, exposure and harm as distinct concepts.

    Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.

    Remaining verification limits
    • The official ISO overview was read, but licensed normative ISO 14971 clauses were not available for full verification.
    Tier 1Binding law and standards· 2Tier 2Regulator guidance and consensus· 1
    Link health: 3 verified· last checked 2026-06-20
    ISO·2AAMI·1
    1. 1
      ISO 14971:2019
      Tier 1 Verified
      ISOiso.org
    2. 2
      ISO 13485 Standard Page
      Tier 1 Verified
      ISOiso.org
    3. 3
      AAMI - Quality Systems Resources
      Tier 2 Verified
      AAMIaami.org

    Inline markers like [1] jump to the matching reference above.