MedTech Terms
    The authoritative reference
    Back to Standards Stack for Medical Devices
    StandardsQuality System

    ISO 14971

    International standard for the application of risk management to medical devices.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

    Definition

    ISO 14971:2019 specifies terminology, principles, and a process for risk management of medical devices, including software and in-vitro diagnostics, throughout the device lifecycle. The process runs through a risk management plan, risk analysis (intended use, hazards, hazardous situations), risk evaluation against predefined criteria, risk control, evaluation of overall residual risk, a risk management review and production and post-production activities. The 2019 edition added explicit treatment of benefits and data and system security as sources of hazards. It is recognized by FDA and harmonised in the EU as EN ISO 14971:2019 with Amendment A11:2021.
    What the regulation says
    ISO 14971:2019, published in December 2019, provides a lifecycle risk management framework for MedTech devices, but is not itself legislation. In the United States, FDA's Quality Management System Regulation, 21 CFR part 820, effective February 2, 2026, incorporates ISO 13485:2016. Section 820.10 requires manufacturers to document a quality management system complying with applicable requirements of that standard, including risk management requirements. FDA recognition of ISO 14971:2019 supports its voluntary use to demonstrate risk management practices; recognition does not make every provision independently mandatory or replace applicable statutory and regulatory obligations. In the EU, Regulation (EU) 2017/745, applicable from May 26, 2021, and Regulation (EU) 2017/746, applicable from May 26, 2022, require lifecycle risk management under Annex I, Section 3. Manufacturers must establish a risk management plan, identify and analyse hazards, evaluate and control risks, and assess information from production and post-market surveillance. Under Article 8 of both regulations, harmonised standards confer a presumption of conformity only for requirements they cover and where their references are published in the Official Journal. EN ISO 14971:2019 with Amendment A11:2021 supports this route, but manufacturers must still demonstrate compliance with the relevant regulation, including its risk reduction and benefit-risk requirements.

    What this means in practice

    Risk management per ISO 14971 underpins design controls, cybersecurity risk decisions, post-market surveillance, and benefit-risk determinations expected by FDA, EU notified bodies, and other regulators.

    Examples

    • A manufacturer developing a new surgical robot applies ISO 14971 principles to identify potential hazards like software errors causing unintended motion, user interface confusion, or power failures, and then implements controls to mitigate these risks.
    • For an in-vitro diagnostic test, the risk management process identifies potential harms from incorrect test results due to sample contamination or reagent degradation, leading to design changes and labeling warnings.
    • During post-market surveillance for a connected patient monitoring device, newly identified cybersecurity vulnerabilities are fed back into the risk management process to reassess risks and implement updated software patches or operational procedures.

    Use cases

    1 scenario
    1

    Risk file for an AI-enabled radiology triage tool

    Risk Management lead

    The team builds a risk management file: hazard analysis covering false negatives, automation bias, and model drift; risk controls including human-in-the-loop review and performance monitoring; and a benefit-risk conclusion tied to clinical evidence.

    OutcomeThe file supports both FDA and EU MDR submissions and drives the post-market performance monitoring plan.
    Common pitfalls
    • •Treating risk management as a one-time activity at the beginning of the device lifecycle rather than an ongoing, dynamic process that continues through post-production.
    • •Focusing solely on safety risks and neglecting other critical aspects like data security, usability risks, or the balance of benefits versus risks, as explicitly highlighted in the 2019 revision.
    • •Failing to adequately document the risk management process, including risk analysis, evaluation against predefined criteria, control measures, and the assessment of overall residual risk, which is crucial for regulatory submissions.

    Frequently asked questions

    ISO 14971:2019 is a voluntary consensus standard, but it is recognized by FDA and harmonized under EU MDR, so conforming to it is the accepted method of demonstrating compliance with the risk management obligations in the Quality Management System Regulation and MDR Annex I general safety and performance requirements. Manufacturers are technically free to use another risk management methodology, but auditors and notified bodies expect ISO 14971 conformance in practice, and deviating from it invites additional scrutiny. Most quality systems therefore reference ISO 14971 directly in their risk management procedures rather than building a parallel framework.

    Cross-references

    Used by

    Overlaps with

    See also

    Related terms

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Learning paths (2)
    Ecosystems (1)
    Comparisons (1)

    Sources

    3 sources

    Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Tier 1Binding law and standards· 3
    Link health: 3 verified· last checked 2026-06-20
    ISO·2IEC·1
    1. 1
      ISO 14971:2019
      Tier 1 Verified
      ISOiso.org
    2. 2
      ISO Standards Catalogue - Health
      Tier 1 Verified
      ISOiso.org
    3. 3
      IEC Webstore - Medical Equipment
      Tier 1 Verified
      IECwebstore.iec.ch

    Inline markers like [1] jump to the matching reference above.