Things to Know About ISO 14971, 3rd Edition

Medical device manufacturers need to identify the hazards associated with their products in order to estimate, evaluate and control the associated risks and monitor the effectiveness of the controls. ISO 14971 provides guidance for the application of risk management for medical devices. 

In order to comply with standard IEC 60601-1 Edition 3.1 2012-08: Medical electrical equipment – Part 1: General requirements for basic safety and essential performance, manufacturers are obliged to prepare and maintain the risk management documentation according to ISO 14971. Historically, ISO 14971 originates from norms EN 1441 (1997) and ISO 14971-1 (1998). The first edition of ISO 14971 was published in 2000 while the second edition, which is currently referenced by most of the standards, was published in 2007. To follow up, the ISO 14971 third edition was released in 2019.

The six most important changes brought by ISO 14971 third edition are:  

• Addition of system security to scope of the risk management — The Medical electrical equipment manufacturer shall now also consider risks related to cybersecurity.
• Wider harm definition — The word “physical” was removed from the definition. ISO 14971 third edition does not consider physical injury or damage as the only kind of harm. With the newest edition, manufacturers shall also consider other forms of harm like mental discomfort due to false positive diagnoses, leakage of medical records, etc.
• The edition enforces risk control priority order — Inherently safe design in manufacturing remains the first and most important feature of the risk control option analysis. If it is not practicable to achieve accessible risk level by inherently safe design, manufacturers are allowed to apply protective measures such as barriers or alarms. The third and the least preferred option is to provide information for safety such as a written warning or contraindication.
• Economic advantage cannot be taken under consideration for risk-benefit analysis — This comment was already in the second edition of the EN version of ISO 14971. Clause 7.4 now states clearly that risk-benefit analysis cannot be used to weigh residual risks against economic advantages.
• The manufacturer shall now inform users of significant residual risks — Clause 8 states that for an overall residual risk that is judged acceptable, the manufacturer shall decide which information is necessary to include in the accompanying documents in order to disclose the overall residual risk to the users.
• Additional guidance document ISO 24971 — The new document provides guidance on the application of ISO 14971. In the document, you can find additional explanations for each clause from ISO 14971, guidance on identification of hazards and characteristics related to safety and other guidance that will help you prepare proper risk management documentation for your products.

When comparing the third edition to the second edition, the newer edition is an evolution of the norm and not a revolution in the requirements. The manufacturer who prepared their documentation according to requirements from ISO 14971 second edition and truly focused on proper application of the requirements would not need to invest much effort to comply with the third edition.