Implementation walkthrough
How to implement ISO 14971: video walkthrough
A walkthrough of establishing an ISO 14971 risk management process and building risk management files for medical devices.
Key takeaways
- ISO 14971 is a risk management process standard for all medical devices.
- Manufacturers set their own criteria for risk acceptability.
- Each device needs a risk management plan and file.
- Analysis, evaluation, control and residual risk review precede release.
- There is no standalone ISO 14971 certificate; files are audited within ISO 13485 and regulatory audits.
Risk management across the device life cycle
ISO 14971 is the international standard for the application of risk management to medical devices. It specifies terminology, principles and a process by which a manufacturer identifies the hazards associated with a device, estimates and evaluates the risks, controls them and monitors whether the controls work, from first concept to decommissioning and disposal. It applies to every kind of medical device, including software as a medical device and in vitro diagnostic devices.
Two features shape its use. The manufacturer sets its own objective criteria for what risk is acceptable; the standard does not prescribe those levels. And it is a process standard, not a management system standard, so there is no ISO 14971 certificate: the process and files are examined within ISO 13485, MDSAP and notified body audits. This short film walks through how the process is put in place.
Process, plan, file and the decisions behind them
Define what the process needs to cover: the devices and families, their life-cycle stages and the regulatory routes in which the files will be read. Top management then provides resources and competent people, defines the policy for establishing criteria for risk acceptability and reviews the process, with competence recorded.
For each device, a risk management plan sets the scope, responsibilities, acceptability criteria and verification activities, and a risk management file brings the records together. Risk analysis identifies the intended use, foreseeable misuse, safety characteristics and hazards, and estimates risks; risk evaluation compares them with the criteria; risk control selects and verifies measures; and the overall residual risk is evaluated before a review confirms the plan was carried out ahead of release. After release, production and post-production information keeps the file alive. Engineers build the files; the criteria and decisions remain the manufacturer's, which is what makes the file defensible.
Sterling's expert and experienced consultants design the process with your management and build the files with your engineers under Sterling OS™. ISO 14971:2019 is the current edition, harmonised in Europe under the MDR and the IVDR.
ISO 14971 at a glance
- Purpose
- Medical device risk management: a process to identify hazards, estimate and evaluate risks, control them and monitor the controls across a device's life cycle
- Relevant to
- Manufacturers of medical devices, software as a medical device and in vitro diagnostic devices, and the contract manufacturers and suppliers who feed their files
- Edition
- ISO 14971:2019, the third edition, confirmed by ISO in 2025; in Europe EN ISO 14971:2019+A11:2021, harmonised under the MDR and the IVDR
- Certification
- None on its own. ISO 14971 is not certified as a standalone standard; your process and files are audited within ISO 13485, MDSAP and notified-body audits
- Sterling's role
- Process design with your management, files built with your engineers, Effivity, training and audit readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 14971 risk management process depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
ISO 14971: questions people ask
Can an organisation be certified to ISO 14971?
No. There is no accredited certification scheme for ISO 14971 and no "ISO 14971 certificate" that a regulator, notified body or customer recognises. It is a process standard applied by the manufacturer, and conformity is examined within the audits you already undergo: the ISO 13485 audit, the MDSAP audit and the notified body's assessment. A provider offering one is selling its own paper.
Is ISO 14971 mandatory?
The standard is voluntary; the requirements it serves are not. The EU MDR and IVDR require a system for risk management, and EN ISO 14971:2019+A11:2021 is the harmonised standard that gives a presumption of conformity for the requirements it covers; ISO 13485 requires documented risk management processes in product realisation; MDSAP audits are built on a foundation of risk management requirements.
How does ISO 14971 relate to ISO 13485?
ISO 13485 is the certifiable quality management system standard for medical devices; ISO 14971 is the risk management process inside it. Clause 7.1 of ISO 13485:2016 requires documented processes for risk management in product realisation, with records, and ISO 14971 provides the process. ISO 14971 does not itself require a quality management system, but your ISO 13485 auditor examines your files against it.
What changed between ISO 14971:2007 and ISO 14971:2019, and do old files need rewriting?
The 2019 edition gave more weight to benefit-risk analysis, brought data and systems security into scope, clarified the evaluation of overall residual risk and restructured production and post-production into a system for collecting, reviewing and acting on information; several annexes moved to ISO/TR 24971:2020. Old files rarely need starting again, but the plan, criteria, benefit-risk reasoning and post-production loop usually need rework.
What is EN ISO 14971:2019+A11:2021, and what does harmonisation mean?
It is the European adoption of ISO 14971:2019 with a 2021 amendment adding the informative Annexes ZA and ZB that relate the standard to Regulation (EU) 2017/745 and Regulation (EU) 2017/746. The Commission listed it in the Official Journal in May 2022 as a harmonised standard under both. Using it is voluntary, but it gives a presumption of conformity with the requirements it covers, so notified bodies expect it.
Keep exploring
Related to this video
The complete guide
Everything on ISO 14971
Start with the ISO 14971 page, or go straight to the guide you need.
On the ISO 14971 page
More videos: Healthcare, medical devices and life sciences
- How to implement ISO 13485Implementation walkthrough · 3 min 24 s
- ISO 13485 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22716Implementation walkthrough · 3 min 24 s
- ISO 22716 requirements explainedTwo-minute brief · 2 min
- ISO 7101 requirements explainedTwo-minute brief · 2 min
- How to comply with ADHICS in Abu DhabiCompliance walkthrough · 3 min 15 s
- ADHICS requirements explainedTwo-minute brief · 2 min
- How to comply with the EU IVDR (Regulation 2017/746)Compliance walkthrough · 3 min 15 s
- EU IVDR requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 14971 implementation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice