ISO 14971 Risk Management under the EU MDR: AFAP & A11:2021

The ISO 14971 process

ISO 14971:2019 is short and process-driven. Paraphrased, it asks the manufacturer to work through these steps, recorded in a risk management file:

Clause	What it requires
4 General requirements	A documented process, top management commitment and a policy for criteria of risk acceptability, competent people, a risk management plan, and a risk management file.
5 Risk analysis	Intended use and reasonably foreseeable misuse, characteristics related to safety, hazards and hazardous situations, and an estimate of each risk.
6 Risk evaluation	Compare each risk with the acceptability criteria in the plan.
7 Risk control	Choose and implement control measures in priority order, verify them, evaluate residual risk, weigh benefit against risk where further control is not practicable, check that controls do not create new risks, and confirm all identified hazardous situations are covered.
8 Overall residual risk	Evaluate the residual risk of the whole device against its benefits.
9 Risk management review	Before release for commercial distribution, confirm the plan was carried out, the overall residual risk is acceptable, and methods are in place to collect production and post-production information.
10 Production and post-production	Collect and review information from production and use, and feed it back into the risk file.

Guidance on applying the standard sits in a companion technical report, ISO/TR 24971:2020. In a quality system, ISO 13485 requires documented risk management throughout product realization, and IEC 62304 builds software risk management on top of ISO 14971.

This is a summary in our own words. The authoritative text is the standard, available from ISO.

What the EU MDR adds

The MDR's general safety and performance requirements in Annex I, Chapter I, describe a risk management system that mirrors ISO 14971 step by step. Where they differ is in how far risk reduction must go and how risk connects to benefit and post-market data.

Topic	ISO 14971:2019	EU MDR Annex I
How far to reduce risk	Until risk is acceptable under the manufacturer's policy, which must account for applicable regulations and the state of the art. ALARP is mentioned only as one policy option.	As far as possible without adversely affecting the benefit-risk ratio (§2). Notified bodies interpret this as leaving no room for economic considerations.
Which risks	Risks judged against the acceptability criteria in the plan.	All known and foreseeable risks, including side effects, minimized and acceptable against benefits (§1, §8).
Control priority and disclosure	Inherent safety by design, then protective measures, then information for safety and, where appropriate, training. Significant residual risks are disclosed.	The same order (§4). Users must be informed about any residual risks, not only significant ones.
Benefit-risk	Overall residual risk is evaluated against benefits; an individual benefit-risk analysis may be used where a risk is not acceptable and further control is not practicable.	Every risk must be acceptable when weighed against the benefits, and the benefit-risk analysis is part of the technical documentation.
Post-market data	Production and post-production information reviewed and fed back.	Explicit duty to evaluate post-market surveillance data and update risk estimates, the benefit-risk ratio and controls (§3(e) and (f)).

Annex I §3 lists the risk management system as six steps: plan; identify and analyze hazards; estimate and evaluate risks in intended use and foreseeable misuse; eliminate or control them; evaluate production and post-market information; and amend controls where needed. Article 10(2) makes establishing that system a direct obligation of every manufacturer.

EN ISO 14971:2019+A11:2021

The European edition adds informative Z annexes that map each clause of the standard to the MDR (and IVDR) requirements it supports, and point out where the regulation asks for more. It is listed as a harmonized standard under the MDR, so applying it gives a presumption of conformity with the requirements its Z annex covers.

In our experience, the risk management plan is where MDR reviews start. Acceptability criteria that let cost limit risk reduction, or a benefit-risk method that does not match the clinical evaluation, are common reasons for questions.

The post-market loop

A risk file that stops changing at release does not meet the MDR. Complaints, vigilance reports, trend data, post-market clinical follow-up and the literature all feed the post-market surveillance system (MDR Articles 83 to 86). The MDR requires that information to update the risk estimates and benefit-risk conclusions, and the periodic safety update report (for Class IIa and above) or the post-market surveillance report (Class I) summarizes the result.

Design changes run the same loop from the other side: every change must be checked against the risk file before release. See our guide to design change control and, for software, risk management of software changes under IEC 62304.

Worked example: the catheter tip change, seen from the risk file

An illustrative case. Revision C of a steerable catheter's tip changes the angle from 15° to 22°. Here is what risk management has to show before release.

Step	What happens	Evidence
Analyze	The steeper tip could raise contact force on the vessel wall; vessel trauma is reviewed as a hazardous situation.	Updated hazard analysis
Estimate	Severity and probability are re-estimated using bench data for the new geometry.	Risk estimate with rationale
Control	A softer distal segment is kept and verified; the instructions for use add a caution on advancement force.	Verification report, IFU change
Reduce further?	The team documents why no further reduction is possible without losing the steering benefit.	AFAP justification
Benefit-risk	Improved access to tortuous anatomy is weighed against the residual risk, consistent with the clinical evaluation.	Benefit-risk statement
Post-market	Complaint codes for vessel injury are watched for the new revision.	PMS plan update

None of this happens if the risk team never hears about the change. The interactive demo shows this change being caught.

What auditors check

A risk management plan with acceptability criteria that do not use cost to limit risk reduction
Hazards traced from intended use, foreseeable misuse and use errors
Risk controls applied in priority order, each verified for implementation and effectiveness
A documented reason for every risk where no further reduction was made
An overall benefit-risk conclusion consistent with the clinical evaluation
Residual risks disclosed in the instructions for use
Evidence that complaints, vigilance and post-market data updated the risk file
Risk review of every design change before release

How Omni Octa keeps the risk file current

The risk file usually falls behind because the events that should update it happen elsewhere: a CAD revision, a supplier change, a complaint trend. Omni Octa detects those events, links them to the hazards and controls they touch, asks the risk owner for a review, and blocks release until the file reflects the change.

Book a demo Try the interactive demo

Frequently asked questions

Is ISO 14971 mandatory under the EU MDR?

Not by name. The MDR requires a risk management system (Article 10(2) and Annex I §3). EN ISO 14971:2019+A11:2021 is the harmonized standard for it, so applying it is the usual way to show conformity.

What is the difference between ALARP and AFAP?

ALARP, as low as reasonably practicable, lets cost and practicality limit risk reduction. The MDR requires risks to be reduced as far as possible (AFAP) without adversely affecting the benefit-risk ratio. Notified bodies interpret AFAP as leaving no room for economic considerations, so a policy built on ALARP needs revising for the EU.

What did the A11:2021 amendment change?

It did not change the ISO text. It added European Z annexes that map the standard's clauses to the MDR and IVDR requirements and show where the regulations ask for more.

How often should the risk file be updated?

Whenever new information affects it: design changes, production issues, complaints, vigilance, post-market clinical follow-up and periodic safety update reports. The MDR expects the update to be continuous across the device's life.

Does FDA require ISO 14971?

FDA recognizes ISO 14971 as a consensus standard but does not incorporate it into the QMSR. ISO 13485, which the QMSR does incorporate, requires documented risk management. Read our QMSR guide.

Sources

This page is general information, not legal or regulatory advice for a specific device.

ISO 14971 risk management under the EU MDR