ISO 14971: medical device risk management, explained

Before ISO 14971, medical device risk management guidance was fragmented across national and sector-specific documents — its own drafting history traces back to EN 1441, a 1997 European risk-analysis standard, and ISO/IEC Guide 51 and Guide 63's general work on safety aspects in standards. ISO 14971 consolidated that into a single, auditable process: a manufacturer runs the same risk analysis → evaluation → control → residual-risk review cycle for every device, regardless of what kind of harm is in scope. Per ISO's own catalogue listing, covered risk categories explicitly include biocompatibility, data and systems security, electricity, moving parts, radiation, and usability — the standard treats a cybersecurity vulnerability that could cause patient harm as just another hazard type feeding the same process, which is why AAMI SW96's security-specific risk management explicitly operates "within the risk management framework defined by ISO 14971" rather than building a separate parallel system.

Per the FDA's own recognized-standard record, ISO 14971 requires manufacturers to "identify the hazards associated with medical devices, including in vitro diagnostic (IVD) medical devices, to estimate and evaluate the associated risks, to control these risks, and to monitor the effectiveness of the controls." That requirement runs across 10 main clauses (per the standard's published clause structure): Clause 4 sets general requirements for the risk management system itself; Clause 5 is risk analysis; Clause 6, risk evaluation; Clause 7, risk control; Clause 8, evaluation of overall residual risk (not just risk-by-risk, but the combined picture); Clause 9, a risk management review; and Clause 10, production and post-production activities — the requirement to keep monitoring a device's real-world risk profile after it ships, not just at design time. Three informative annexes (rationale, process overview, fundamental concepts) explain the clauses but impose no separate obligations of their own.

Two exclusions are stated directly in both ISO's and FDA's own descriptions, and both trip up manufacturers who assume the standard is broader than it is. First, ISO 14971 "does not apply to decisions on the use of a medical device in the context of any particular clinical procedure" — it governs the device's designed risk profile, not a clinician's case-by-case judgment calls. Second, it explicitly excludes business risk management — commercial, reputational or financial risk to the manufacturer is out of scope; this is purely a patient/user/third-party harm framework. FDA's guidance adds a practical caveat on top of the standard's own exclusions: because ISO 14971 is process-oriented rather than prescriptive, a bare declaration of conformity to it is often not sufficient supporting evidence on its own in a premarket submission — reviewers still expect to see the actual risk management file's substance.

FDA's recognized-consensus-standards database lists ISO 14971 Third Edition 2019-12 (FR Recognition Number 5-125, FR Recognition List Number 053, Date of Entry 12/23/2019) as identically adopted by ANSI/AAMI as ANSI/AAMI/ISO 14971:2019. That recognition arrived as part of a larger batch — more than 100 other consensus standards from ISO, AAMI, ANSI, ASTM International and USP were recognized in the same action, per contemporaneous reporting. FDA set a firm transition deadline for the standard it replaced: declarations of conformity to the superseded ISO 14971:2007 were accepted only "until 25 December 2022. After this transition period, declarations of conformity to [ISO 14971:2007] will not be accepted." Any current FDA submission relying on ISO 14971 conformity needs to cite the 2019 edition.

ISO/TR 24971 is the practical how-to companion — a Technical Report, not a requirements standard — that FDA's database lists as Second Edition 2020-06, "Medical devices — Guidance on the application of ISO 14971," adopted identically as AAMI/ISO TIR24971:2020. It explains how to actually run the clauses (worked examples, guidance on risk acceptability criteria ISO 14971 itself deliberately leaves undefined) without adding new obligations. AAMI SW96 sits differently: it is a normative security-specific standard, not guidance, and it is explicitly scoped to extend ISO 14971 rather than duplicate it — see our AAMI SW96 guide for its security risk management process, plan and file structure, and our guides to IEC 62304 and IEC 80001-1 for how the software-lifecycle and networked-device standards likewise plug into the same ISO 14971 risk management file rather than running a separate process.

SoftWSP's device and firmware security work is built to feed directly into an existing ISO 14971 risk management file — vulnerability findings mapped to hazards, severity and residual-risk language your quality and regulatory teams already use. See device & firmware security services for how that scope covers security risk inputs alongside a conventional firmware assessment.

This guide is based on FDA's own recognized-consensus-standards database record for ISO 14971:2019, ISO's own catalogue listing for the standard (scope, clause structure, page count), and RAPS's contemporaneous reporting on FDA's December 2019 recognition action and the 2007-edition transition deadline. ISO 14971's full normative text is paywalled and was not independently read for this guide; clause-level wording beyond what is quoted here should be confirmed against the purchased standard.