ISO 14971 is the international standard for applying risk management to medical devices, covering hazard identification, risk estimation, risk control, and production and post-production monitoring. The third edition, which replaces ISO 14971:2019, keeps the core risk management process largely unchanged but clarifies key definitions and expands requirements for gathering real-world usability data after a device reaches market.
The third edition of ISO 14971 is now available and supersedes the former ISO 14971:2019. The risk management process definition in the standard remains largely unchanged, but the most current edition has been expanded to include more guidance, exploration, and examples of the risk management process requirements.
Below is a summary of the changes of note.
Breakdown of Definitions
Reasonably foreseeable misuse (3.15): “Use of a product or system in a way not intended by the manufacturer, but which can result from readily predictable human behaviors.”
This new definition states that if any misuse of the product can come from predictable human behavior, then it needs to be accounted for in your use-related risk analysis. The term “reasonably foreseeable” can be either intentional or unintentional, including scenarios that could leave you thinking, “Why in the world would anyone ever do that?” Risk control measures have to be applied, and evidence must be collected during usability testing to prove that these mitigations are effective.
Benefit (3.2): “Positive impact or desirable outcome of the use of a medical device on the health of an individual, or a positive impact on patient management or public health.”
This term and definition were minimally covered in ISO 14971:2007 and EN ISO 14971:2012 and are updated and clarified in the third edition. The understanding of the benefits of a device falls on the manufacturer’s shoulders. It includes assessing clinical data, administering a review of literature, or speaking with health care providers and patients to fully comprehend all beneficial aspects of the device. These include, but are not limited to, clinical, financial, and perceived benefits. Compiled feedback of benefits should be taken into consideration when determining whether the risks are acceptable for the device. The clarified definition now lines up with the terminology used in many regulations.
State of the art (3.28): “Developed stage of technical capability at a given time as regards products, processes and services, based on the relevant consolidated findings of science, technology and experience.”
This term can be ambiguous, and it is notable that it had never been formally defined before, despite appearing 12 times in the EU MDR and 20 times in the IVDR. ISO 14971:2019 borrowed the definition found in ISO/IEC Guide 63:2019, quoted above.
State of the art embodies what is currently and generally accepted good practice in technology and medicine. It does not necessarily mean “most technologically advanced.” It can include published data surrounding the application of the medical device under development, the availability of alternative methods, or similar devices on the market.
Production and Post-Production Activities
The majority of the new additions and changes to requirements were related to production and post-production activities and clauses. To put it in perspective, the requirements in this section grew from just under half a page to nearly a page and a half. It now interlocks with the ISO 13485:2016 section 8 requirements for feedback, analysis of data, and CAPA. (ISO 13485 is a standard governing change management.) ISO 14971 adds more stringent requirements specific to the collection and review of information about your device.
Simply put, manufacturers need to be more regular and proactive about gathering data on the usability of their devices once they go to market, and feed that data back into their risk assessment to give a more comprehensive view of residual risks.