ISO 14971: a risk file that stays alive after launch
A risk file written for submission and then shelved will fail its next audit. Here is how to keep it connected to what happens after launch.
In Short
- Keep hazard, hazardous situation and harm separate.
- Prefer design controls over warnings where practicable.
- Feed complaints and service data back into the file.
The Medical Device Production Guide
Built to revision. Inspected. On record.
- What the QMSR changed in February 2026
- Supplier to finished build
- Inspect, review, correct
- Labels, UDI and traceability
Plus Evidence map and four worksheets.
Get the medical device guideWe ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Medical Device Production Guide
Built to revision. Inspected. On record.
ISO 14971:2019 is the international standard that, in ISO's public summary, specifies terminology, principles and a process for risk management of medical devices, including software as a medical device and in vitro diagnostics. It is a voluntary standard that regulators widely recognise. The licensed text was not opened for this guide, so it describes common practice rather than quoting requirements; check your copy for the exact wording. It covers the parts that most often go wrong: vocabulary, choosing controls, and feeding real-world information back into the file.
Words that matter
Harm is injury or damage to health, property or the environment. A hazard is a potential source of harm.
From hazard to harm
Sample identifier: Energy → Heater stays on → Skin contact with hot surface → Burn
Thermal energy from the heater.
More on words that matter
A hazardous situation is a circumstance in which people, property or the environment are exposed to a hazard. Risk combines the probability of harm and its severity. Keeping hazard, hazardous situation and harm separate makes the analysis traceable and avoids the common mistake of listing failure modes as if they were harms.
The Plan and the File
Expect a policy for setting risk acceptability criteria and, for each device, a plan covering scope, responsibilities, acceptability criteria, verification and how production and post-production information will be collected and reviewed. ISO's summary notes the standard requires objective acceptability criteria but does not set acceptable risk levels.
More on the Plan and the File
The risk management file holds the records and traceability for each hazard.
Analysis and Evaluation
Risk analysis documents the intended use and reasonably foreseeable misuse, identifies characteristics related to safety, identifies hazards and hazardous situations, and estimates risk for each. Evaluation compares each estimated risk with the criteria in the plan to decide whether risk control is needed.
Choosing Risk Controls
Common practice is to prefer inherently safe design first, then protective measures in the device or process, and only then information for safety such as warnings or training, which should not replace a practicable design control. Check your licensed copy for the exact requirement.
Risk Control: Design First
A widely used design-first approach. Check your licensed copy of ISO 14971 for the exact requirement.
- Removes or reduces the risk at source.
More on choosing Risk Controls
Each control is implemented and verified, and new hazards introduced by controls are assessed.
Overall residual risk and life after launch
After individual controls, the manufacturer evaluates overall residual risk against the benefits of intended use, and a review before release confirms the plan was carried out. The system must then actively collect and review production and post-production information, such as complaints, service data, and published information about similar devices, and update the file when it reveals new hazards or changed risks.
Post-Production Feedback Check
More on overall residual risk and life after launch
Decisions to accept risk are made and signed by the people named in the plan.
Questions
Is ISO 14971 mandatory?
ISO 14971 is a voluntary standard, but regulators expect a documented risk management process and widely recognise ISO 14971 as the way to meet it. ISO 13485 requires risk management in product realisation.
What is the difference between FMEA and ISO 14971?
FMEA is one analysis technique that looks at how parts or steps can fail. ISO 14971 is the overall risk management process. FMEA can feed a 14971 analysis, but it does not cover harms from correct use, foreseeable misuse or overall residual risk by itself.
What is ISO/TR 24971?
ISO/TR 24971:2020 is guidance on applying ISO 14971:2019. It is informative, not a requirement, and gives examples for each step.
When must the risk file be updated?
Whenever production or post-production information shows a new hazard or hazardous situation, or that an estimated risk or its acceptability has changed. The plan says how information is collected and reviewed.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
Keep reading
ICH Q9(R1) Quality Risk Management Guide: Formality, Subjectivity, Decisions
21 CFR 820 to ISO 13485 Crosswalk: Re-citing Procedures Under the QMSR
Calibration Management Program: a Practical Guide
Cosmetic Microbiological Quality (ISO 17516) Readiness Guide
Cosmetic Stability and Preservative Efficacy (ISO 11930)
ISO 13485 Guide: Device QMS and the FDA QMSR (effective 2 Feb 2026)