Current Edition Checked October 24, 2026
ISO/TR 24971:2020 gives the guidance, and ISO/TS 24971-2:2026 now adds guidance for devices that use machine learning.
Next: No new edition announced.
What It Covers
The process a manufacturer uses to identify hazards, estimate and evaluate risks, control them, judge the overall residual risk against the benefits, and keep watching once the device is on the market.
Who It Applies To
Every medical device manufacturer, for every device, across the whole life cycle. ISO 13485, the EU MDR and the US QMSR all expect it, directly or through the state of the art.
Key Requirements
- A risk management plan and a risk management file for each device (4.4, 4.5).
- Criteria for risk acceptability set by a policy from top management (4.2).
- Risk analysis, evaluation and control, in the order: inherent safety by design, protective measures, information for safety (5–7).
- Evaluation of overall residual risk against the benefits, and a review before release (8, 9).
- Production and post-production information collected and fed back into the risk file (10).
What an Auditor Asks to See
- The risk management plan and the acceptability criteria behind it.
- Traceability from each hazard through its controls to verification of their effectiveness.
- The overall residual risk evaluation and the benefit-risk conclusion.
- Evidence that complaints and post-market data have reopened the risk file when they should.
Where Systems Fall Short
- A risk file written for submission and not updated since launch.
- Risk controls listed but never verified as implemented and effective.
- Labeling used as the first control rather than the last.
Structure at a Glance
| Part | Topic | What It Asks For |
|---|---|---|
| 4 | General Requirements | Process, management responsibilities and policy, competence, the plan, and the file. |
| 5 | Risk Analysis | Intended use, safety characteristics, hazards and hazardous situations, risk estimation. |
| 6 | Risk Evaluation | Comparing each estimated risk against the acceptability criteria. |
| 7 | Risk Control | Option analysis, implementation, residual risk, benefit-risk, new risks, completeness. |
| 8 | Overall Residual Risk | Judging the residual risk of the device as a whole against its benefits. |
| 9 | Risk Management Review | Confirming before release that the plan was carried out. |
| 10 | Production and Post-Production | Collecting and reviewing information and acting on it. |
Requirements Checklist
Work down the list with the evidence in hand. The PDF has a column for noting where each item is evidenced.
- Risk policy and acceptability criteria approved by top management.
- Plan states scope, responsibilities, review requirements, acceptability criteria, and verification activities.
- Intended use and reasonably foreseeable misuse documented.
- Hazards identified for normal and fault conditions, including use error and software.
- Each risk estimated and evaluated against the criteria.
- Controls chosen in the priority order the standard sets.
- Each control verified as implemented and as effective.
- Residual risks disclosed, including in the information for safety.
- Overall residual risk and benefit-risk conclusion documented.
- Risk management review completed before commercial release.
- Post-market information sources defined and reviewed on a schedule.
- Risk file updated when new hazards or changed estimates appear.
Implementation Roadmap
- 1. Policy Set the risk policy and acceptability criteria at management level.
- 2. Plan Write a plan per device or family, naming the people and the reviews.
- 3. Analyze and control Work through hazards, estimates, controls and verification, traceably.
- 4. Decide Evaluate overall residual risk and benefit, and review before release.
- 5. Watch Connect complaints, service, and literature back into the file.
How It Fits with Other Standards
ISO 13485 requires risk-based decisions throughout the system; ISO 14971 supplies the device-level method. IEC 60601-1, IEC 62304, and IEC 62366-1 each call on its process. Under the EU MDR, Annex I’s general requirements 1 to 9 are, in practice, met through it.
Findings We See Most Often
- Hazard lists that stop at design and ignore use error and post-market data.
- Severity and probability scales with no defined meaning.
- Benefit-risk asserted in one sentence rather than reasoned.
- Post-market reviews that never change a single estimate.
How QES Helps
Risk management files rebuilt so each control traces to its verification, and post-market feedback wired back into them.
Related Standards
Sources. ISO — ISO 14971:2019 (opens in a new tab); Johner Institute — ISO/TS 24971-2:2026 (opens in a new tab); iTeh — EN ISO 14971:2019/A11:2021 (opens in a new tab). Status checked October 24, 2026. This page summarizes ISO 14971:2019; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.