Medical device risk management

Medical device risk management concerns possible harm associated with a device and the evidence used to understand and control it. The device’s intended use, users, operating environment and reasonably foreseeable conditions affect the analysis. ISO 14971 covers a lifecycle process, including software and in vitro diagnostic devices within its stated scope. It does not decide whether a particular clinician should use a device for an individual patient, and it is not a framework for managing a manufacturer’s general commercial risks.

The family links identification of hazards with risk estimation, evaluation, control and information gathered after production. That relationship makes the risk file more than an isolated scoring table. A change in material, software or intended use can alter both the hazards and the evidence supporting controls. ISO Open Data describes the standard’s lifecycle scope and makes clear that it does not prescribe universal acceptable risk levels. Device-specific acceptance criteria need an explicit and justified basis.

Selected records: ISO 14971:2019 (edition 3, publication record 2019-12-10). These were checked on 19 October 2026 using ISO Open Data. The selected international record is ISO 14971:2019. FDA recognition record 5-125 identifies that edition. Recognition is a particular regulatory mechanism, not publication by FDA or automatic approval of every device assessed using it. Related application guidance and device-specific FDA documents have distinct identities and purposes.

An infusion device example connects these elements. An incorrect delivery can arise from hardware, software, user interaction or a combination of conditions. A design control has value when its implementation and effectiveness can be linked to the hazardous situation it addresses. Verification evidence, usability work and production information may contribute different parts of that argument. When complaints reveal a new failure pattern, the organization needs to determine whether the existing assumptions and controls still describe the device in actual use.

FDA’s recognition record 5-125 identifies ISO 14971:2019. Recognition does not replace the applicable device pathway or submission requirements. The sheet’s cybersecurity note is particularly relevant: FDA distinguishes exploitability from a probability-of-harm model when estimating cybersecurity risk and points to its February 2026 premarket cybersecurity guidance. A general risk-management file therefore cannot simply transfer the same probability assumptions to every security scenario. The actual device, intended use and specialized regulatory expectations remain necessary to interpret the evidence.

Look for traceability from a hazardous situation to the selected control, its implementation evidence and the assessment of remaining risk. Are use conditions, assumptions and affected configurations identified? Does the analysis address risks introduced by a control itself? Is production and post-production information connected to review decisions? A list of tests without that reasoning may leave the central risk question unanswered. Conversely, a numerical score with no defined consequence or evidence basis cannot explain why a control is adequate.

The important boundary is between a structured risk process and a predetermined safety conclusion. Applying a standard does not make the result independent of data quality, clinical context or technical judgment. A risk file can be extensive while overlooking a changed use condition. This reference explains the relationships visible in licensed scope data and FDA recognition information. It does not set acceptable risk levels, perform a clinical benefit-risk evaluation or determine conformity of a specific medical device.

Use ISO 13485 to connect risk work with quality system controls. Biological evaluation and medical electrical equipment address particular technical evidence. The general risk management reference offers organizational context, but it does not replace the device-specific process. Read the device’s intended use, configuration and lifecycle information before comparing risk files from different products.

Sources were checked on 19 October 2026. ISO is credited for deliverables metadata used under ODC Attribution License 1.0; its full standards are not reproduced here. FDA’s recognition sheet provides the recognition scope and related regulatory materials. The ISO metadata supports the standard’s identity; the analysis here does not reproduce its risk management procedure. Use authorized publisher channels for the complete document. A correction request can identify the reference, disputed statement and supporting official source.