Two-minute brief
ISO 14971 requirements explained: video brief
A two-minute brief on the clauses of ISO 14971:2019, which follow the sequence of the risk management process.
Key takeaways
- ISO 14971 clauses 4 to 10 follow the risk management process.
- Top management defines the policy for risk acceptability criteria.
- Risk control includes verifying measures and evaluating residual risk.
- A risk management review comes before release.
- Post-production information keeps the risk file current.
A process written as requirements
ISO 14971:2019 is written as requirements, with shall statements from clause 4 to clause 10, and follows the sequence of the process itself rather than the harmonised structure of the management system standards. Clause 4 sets up the process, the plan and the file; clauses 5 to 8 run analysis, evaluation and control through to the overall residual risk; clause 9 reviews the whole before release; and clause 10 keeps the file alive after it. This short film walks through that sequence.
Clause 4 requires an ongoing risk management process for the whole life cycle; top management providing resources and competent people, defining the policy for the criteria for risk acceptability and reviewing the process; competent personnel, with records; a risk management plan for each device; and a risk management file.
From analysis to post-production
Clause 5, risk analysis, covers the intended use and reasonably foreseeable misuse, characteristics related to safety, the identification of hazards and hazardous situations, and risk estimation. Clause 6 evaluates each risk against the acceptability criteria. Clause 7 covers risk control: selecting control options, implementing and verifying measures, evaluating residual risk, benefit-risk analysis where needed, risks arising from control measures and completeness of control. Clause 8 evaluates the overall residual risk, clause 9 is the risk management review before release, and clause 10 covers production and post-production activities, collecting and reviewing information and acting on it.
ISO 14971:2019 is the third edition, confirmed by ISO in 2025; in Europe EN ISO 14971:2019+A11:2021 is harmonised under the MDR and the IVDR. It applies to manufacturers of medical devices, software as a medical device and in vitro diagnostic devices. It is not certified on its own; the process and files are audited within ISO 13485, MDSAP and notified body audits.
Inside ISO 13485, which requires documented processes for risk management in product realisation, ISO 14971 is the risk management process itself; ISO/TR 24971 gives guidance on applying it without adding requirements.
ISO 14971 at a glance
- Purpose
- Medical device risk management: a process to identify hazards, estimate and evaluate risks, control them and monitor the controls across a device's life cycle
- Relevant to
- Manufacturers of medical devices, software as a medical device and in vitro diagnostic devices, and the contract manufacturers and suppliers who feed their files
- Edition
- ISO 14971:2019, the third edition, confirmed by ISO in 2025; in Europe EN ISO 14971:2019+A11:2021, harmonised under the MDR and the IVDR
- Certification
- None on its own. ISO 14971 is not certified as a standalone standard; your process and files are audited within ISO 13485, MDSAP and notified-body audits
- Sterling's role
- Process design with your management, files built with your engineers, Effivity, training and audit readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 14971 risk management process depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
ISO 14971: questions people ask
Can an organisation be certified to ISO 14971?
No. There is no accredited certification scheme for ISO 14971 and no "ISO 14971 certificate" that a regulator, notified body or customer recognises. It is a process standard applied by the manufacturer, and conformity is examined within the audits you already undergo: the ISO 13485 audit, the MDSAP audit and the notified body's assessment. A provider offering one is selling its own paper.
Is ISO 14971 mandatory?
The standard is voluntary; the requirements it serves are not. The EU MDR and IVDR require a system for risk management, and EN ISO 14971:2019+A11:2021 is the harmonised standard that gives a presumption of conformity for the requirements it covers; ISO 13485 requires documented risk management processes in product realisation; MDSAP audits are built on a foundation of risk management requirements.
How does ISO 14971 relate to ISO 13485?
ISO 13485 is the certifiable quality management system standard for medical devices; ISO 14971 is the risk management process inside it. Clause 7.1 of ISO 13485:2016 requires documented processes for risk management in product realisation, with records, and ISO 14971 provides the process. ISO 14971 does not itself require a quality management system, but your ISO 13485 auditor examines your files against it.
What changed between ISO 14971:2007 and ISO 14971:2019, and do old files need rewriting?
The 2019 edition gave more weight to benefit-risk analysis, brought data and systems security into scope, clarified the evaluation of overall residual risk and restructured production and post-production into a system for collecting, reviewing and acting on information; several annexes moved to ISO/TR 24971:2020. Old files rarely need starting again, but the plan, criteria, benefit-risk reasoning and post-production loop usually need rework.
What is EN ISO 14971:2019+A11:2021, and what does harmonisation mean?
It is the European adoption of ISO 14971:2019 with a 2021 amendment adding the informative Annexes ZA and ZB that relate the standard to Regulation (EU) 2017/745 and Regulation (EU) 2017/746. The Commission listed it in the Official Journal in May 2022 as a harmonised standard under both. Using it is voluntary, but it gives a presumption of conformity with the requirements it covers, so notified bodies expect it.
Keep exploring
Related to this video
The complete guide
Everything on ISO 14971
Start with the ISO 14971 page, or go straight to the guide you need.
On the ISO 14971 page
More videos: Healthcare, medical devices and life sciences
- How to implement ISO 13485Implementation walkthrough · 3 min 24 s
- ISO 13485 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22716Implementation walkthrough · 3 min 24 s
- ISO 22716 requirements explainedTwo-minute brief · 2 min
- ISO 7101 requirements explainedTwo-minute brief · 2 min
- How to comply with ADHICS in Abu DhabiCompliance walkthrough · 3 min 15 s
- ADHICS requirements explainedTwo-minute brief · 2 min
- How to comply with the EU IVDR (Regulation 2017/746)Compliance walkthrough · 3 min 15 s
- EU IVDR requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 14971 implementation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice