All terms

    ISO/TR 24971

    Guidance on the application of ISO 14971 to medical devices.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

    Definition

    ISO/TR 24971:2020 provides guidance on developing, implementing, and maintaining a risk management system per ISO 14971, including hazard identification, risk control, residual risk evaluation, and post-production information. Because it is a technical report, it gives guidance and examples rather than requirements. Annexes cover topics such as identifying hazards and characteristics related to safety, techniques like FMEA and fault tree analysis, risk management for IVDs, and security-related risks. Much of the informative guidance that was in annexes of older editions of ISO 14971 was moved into TR 24971 in 2020.
    What the regulation says
    ISO/TR 24971:2020 offers supplementary guidance to ISO 14971:2019, providing practical methods and examples for establishing, documenting, and maintaining a risk management system. While not a normative standard itself, regulators and notified bodies expect manufacturers to consider its recommendations for demonstrating conformity to risk management requirements, such as those in EU MDR Annex I Chapter I Section 3.

    What this means in practice

    TR 24971 is the de facto playbook for executing ISO 14971 in practice and is frequently referenced by auditors and notified bodies.

    Examples

    • A MedTech manufacturer uses the guidance in ISO/TR 24971 section 6.2, 'Risk analysis techniques,' to select appropriate methodologies for identifying hazards and estimating risks for a new surgical robot.
    • During a notified body audit for CE marking, a manufacturer references specific examples from ISO/TR 24971 regarding risk control measures to justify their approach to mitigating software cyber risks in their diagnostic imaging system.
    • A quality manager consults ISO/TR 24971 Annex C, 'Guidance on safety-related information,' to improve their post-market surveillance process for collecting and analyzing field data relevant to risk management.
    Common pitfalls
    • •A common pitfall is treating ISO/TR 24971 as a standalone requirement rather than as guidance for implementing ISO 14971.
    • •Manufacturers sometimes fail to periodically review and update their risk management processes based on the evolving recommendations in ISO/TR 24971.
    • •Overlooking the interconnectedness between risk management activities and other quality system elements, such as design control or post-market surveillance, is a frequent mistake.

    Frequently asked questions

    No, ISO/TR 24971 is a technical report providing guidance, not a normative standard with auditable requirements. Its purpose is to aid in the effective application of ISO 14971:2019.

    Cross-references

    See also

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Ecosystems (1)

    Latest in MedTech

    Sources

    3 sources

    Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Tier 1Binding law and standards· 2Tier 2Regulator guidance and consensus· 1
    Link health: 3 verified· last checked 2026-06-20
    ISO·2FDA·1
    1. 1
      ISO/TR 24971:2020
      Tier 1 Verified
      ISOiso.org
    2. 2
      FDA Recognized Consensus Standards
      Tier 2 Verified
      FDAaccessdata.fda.gov
    3. 3
      ISO Standards Catalogue - Health
      Tier 1 Verified
      ISOiso.org

    Inline markers like [1] jump to the matching reference above.