ISO 14971 · Risk management for medical devices
ISO 14971 implementation consulting for devices whose risks are known, controlled and defensible.
Build the risk management process and the files that ISO 14971:2019 requires, in the form your ISO 13485 auditor, MDSAP auditing organisation and notified body expect to see. Sterling's expert and experienced consultants design the process with your management, build the files with your engineers and stay with you until post-production information flows back into them, in 60+ countries. ISO 14971 is not certified on its own: there is no certificate to chase, only a file that must stand up in every audit. We ensure our clients put the standard in place successfully.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced medical device risk management consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the process with you; there is no ISO 14971 certificate to issue
8,100+ client engagements in 60+ countries.
ISO 14971 client experience
What it is
What is ISO 14971 and what is it used for?
ISO 14971 is the international standard for the application of risk management to medical devices. It specifies terminology, principles and a process by which a manufacturer identifies the hazards associated with a device, estimates and evaluates the risks, controls them and monitors whether the controls work, from first concept to decommissioning and disposal. It applies to every kind of medical device, including software as a medical device and in vitro diagnostic medical devices, and to every risk a device can carry.
Two features shape how it is used. It requires the manufacturer to set its own objective criteria for what risk is acceptable and does not prescribe those levels. And it is a process standard, not a management system standard: risk management can be part of a quality management system, but ISO 14971 does not itself require one. It produces a risk management file for each device, and that file is what regulators, notified bodies and auditors read.
Current edition. ISO 14971:2019, published on 10 December 2019, is the third edition and replaced ISO 14971:2007, with more weight on benefit-risk analysis, data and systems security in scope and a restructured production and post-production clause. ISO confirmed the 2019 edition on 7 March 2025, so it remains current and no transition is running. In Europe the standard is EN ISO 14971:2019 with amendment A11:2021, whose Annexes ZA and ZB relate it to Regulation (EU) 2017/745 and Regulation (EU) 2017/746; it is listed in the Official Journal as a harmonised standard under both, giving a presumption of conformity for the requirements it covers. ISO/TR 24971:2020 is flagged for revision, with ISO/TS 24971-1 registered as a new project in July 2026 and no date announced. ISO 14971 explained, clause by clause
Who it is for
Who needs ISO 14971 risk management?
ISO 14971 was written for manufacturers of medical devices, and everything around a device points to it: ISO 13485 requires documented risk management processes in product realisation, the EU MDR and IVDR require a system for risk management, MDSAP audits are built on risk management requirements, and IEC 60601-1, IEC 62304 and IEC 62366-1 tie their risk work to it. Clients come to Sterling from four starting points:
- You are bringing a device to market. CE marking, an FDA submission, an MDSAP audit or a registration in the Gulf, India, the Philippines or Australia all require a risk management file reviewers can follow.
- An auditor has raised findings on risk management. Files built on the 2007 edition, criteria nobody applies, no benefit-risk analysis, or complaints that never reach the file.
- Your device contains software or depends on its user interface. IEC 62304 requires the software risk management process to be embedded in the device process according to ISO 14971, and IEC 62366-1 ties use-related risk to the same method; analyses that disagree are a finding waiting to happen.
- You supply the manufacturer. Contract manufacturers, component and software suppliers and original equipment developers are asked for risk management inputs their customers can incorporate, and the customer's auditor checks how they were made.
The intended benefit is a device whose risks are understood before it reaches a patient, with evidence of that understanding. Results depend on engineers using the process during design and on post-production information flowing back, not on the file existing.
Business benefits
How ISO 14971 protects patients, products and market access
A risk management process earns its place when it changes a design, a label or a manufacturing control before a patient is exposed. We start from the decisions your engineers and management take about each device, and build the process so those decisions carry a risk view and the file records it.
- Safer devices, with the reasoning on recordHazards, hazardous situations, controls and residual risks traced from intended use to verification evidence, so a reviewer sees why the device is safe.
- Conformity assessment that movesA file whose plan, analyses, benefit-risk conclusions and report answer the questions notified bodies and regulators ask, instead of a round of deficiencies.
- Fewer audit findingsISO 13485 auditors, MDSAP auditing organisations and notified bodies check the same process; one method, applied to every device family, answers them all.
- Design decisions made in the right orderInherent safety by design first, protective measures second, information for safety last, with evidence that each control works.
- Post-market information that changes somethingComplaints, service reports, supply-chain data and the state of the art reviewed for their effect on the file, and the file, device or process updated when it matters.
- One method for software, usability and electrical safetyThe IEC 62304, IEC 62366-1 and IEC 60601-1 risk work embedded in one ISO 14971 process, so the analyses agree.
Choose a few measures that reflect these outcomes, such as questions raised at conformity assessment or complaints reviewed against the file on time. A thicker file is not a business result.
Requirements
What are the main ISO 14971 requirements?
ISO 14971:2019 is written as requirements, with "shall" statements from clause 4 to clause 10, and follows the sequence of the process itself rather than the harmonised structure of the management system standards. Clause 4 sets up the process, the plan and the file; clauses 5 to 8 run analysis, evaluation and control through to the overall residual risk; clause 9 reviews the whole before release; clause 10 keeps the file alive after it. The table is a plain-language map; your process and each file are checked against the 2019 edition, clause by clause.
| Clause | What it requires of you | What it looks like in practice |
|---|---|---|
| 4 General requirements for risk management system | An ongoing risk management process for the whole life cycle (4.1); top management providing resources and competent people, defining the policy for the criteria for risk acceptability and reviewing the process (4.2); competent personnel, with records (4.3); a plan per device covering scope, responsibilities, reviews, the criteria for risk acceptability, the method for overall residual risk, verification and the collection and review of production and post-production information (4.4); a file with traceability for each hazard (4.5) | A procedure owned by management, a written policy for risk acceptability, a plan per device family, competence records, and a file in which every hazard leads to its controls and evidence |
| 5 Risk analysis | Document the intended use and reasonably foreseeable misuse (5.2), identify the characteristics related to safety (5.3), identify the hazards and the sequences of events that lead to hazardous situations (5.4), and estimate the risk of each hazardous situation from the available information and data (5.5) | A hazard analysis that names the hazard, the sequence of events, the hazardous situation and the harm, with severity and probability on the plan's scales and the sources recorded |
| 6 Risk evaluation | Decide, for each hazardous situation, whether the estimated risk is acceptable against the criteria in the plan, and therefore whether risk reduction is required | A documented decision for every hazardous situation, on the criteria management approved, not on a colour chosen after the fact |
| 7 Risk control | Identify risk control measures in the priority order of inherently safe design and manufacture, protective measures in the device or the manufacturing process, and information for safety (7.1); implement them and verify implementation and effectiveness (7.2); evaluate the residual risk (7.3); where it is not acceptable, carry out a benefit-risk analysis (7.4); check whether controls introduce new hazards or affect other risks (7.5); confirm every hazardous situation is addressed (7.6) | Design changes, alarms, guards, software safeguards and labelling recorded against the hazards they control, verification attached, benefit-risk analyses where needed, and a completeness check |
| 8 Evaluation of overall residual risk | Evaluate the overall residual risk of the device using the method and criteria in the plan; where it is not acceptable, consider the benefit-risk of the device as a whole; inform users of significant residual risks in the accompanying documentation | A documented overall residual risk evaluation with its justification, and the disclosures carried into instructions for use and labelling |
| 9 Risk management review | Before commercial release, review the execution of the plan and record the results as the risk management report: the plan was implemented, the overall residual risk is acceptable and the methods to collect and review production and post-production information are in place | A report signed by the people the plan makes responsible, held in the file and cited in the technical documentation |
| 10 Production and post-production activities | A system to actively collect and review information about the device from production and monitoring, from users and those who install and maintain it, from the supply chain and from public information and the state of the art (10.1, 10.2); review it for relevance to safety, including previously unrecognised hazards and changed risk estimates (10.3); act on the device and the process when it matters (10.4) | Complaints, service records, field data, supplier notices and literature reviewed on a schedule against the file, a decision recorded each time, and the file, device, labelling or process updated when the review says so |
What does useful ISO 14971 evidence look like?
A plan for each device, a hazard analysis that reads as a chain of events rather than a list of failure modes, risk control measures with verification of implementation and effectiveness, benefit-risk analyses where the criteria are not met, an overall residual risk evaluation, the risk management report, and post-production review records that show information reaching the file and changing it. We help identify the records your devices need, without creating documents to fill folders, and they live in Effivity from the first workshop so the file runs alongside design rather than being assembled before an audit.
ISO 14971 explained: the risk management process and the file, clause by clauseImplementation route
How do you implement ISO 14971?
There is no ISO 14971 certification body and no ISO 14971 certificate. The process is established, the files are built, and their conformity is examined by the people who already audit you: the ISO 13485 certification body under clause 7.1, the MDSAP auditing organisation and the notified body that assesses your quality system and technical documentation. Sterling designs and builds with you; the criteria and the decisions are yours, which is what makes the file defensible.
- 01Define what the process needs to cover.Confirm the device families, the jurisdictions, the standards that interface with the file, such as IEC 60601-1, IEC 62304 and IEC 62366-1, and the audits and submissions ahead.
- 02Gap analysis: review current practice against ISO 14971:2019.The gap analysis compares your procedure, policy, plans and files with the 2019 clauses, keeps what is sound and agrees actions, owners, dates and resources.
- 03Establish the process, the policy and the plan.Management sets the policy for the criteria for risk acceptability and the responsibilities; the procedure, plan template, scales, file structure and competence requirements are designed around how you develop devices.
- 04Build the risk management files with your engineers.Intended use and foreseeable misuse, hazards and hazardous situations, estimation and evaluation, risk control in the required priority, verification, benefit-risk analysis where needed and the overall residual risk.
- 05Review, report and address the findings.The risk management review and report for each file, an internal audit of the process, and gaps closed with evidence before the auditor arrives.
- 06Production and post-production review.Complaints, service data, supplier information and the state of the art reviewed against the files on a schedule, and the files updated when the review says so, with Sustain™ supporting each cycle.
Check what you are being sold, not just the price. ISO 14971 is applied and audited inside your quality system and your submissions, so an "ISO 14971 certificate" is a document of the seller's own design. Ask instead how the files will be built with your engineers, who will own the criteria for risk acceptability, and what will exist in daily work when the consultant leaves. How to choose a credible ISO 14971 provider · The certification buyer's checklist
Cost
How much does ISO 14971 implementation cost?
There is no useful universal price for ISO 14971 implementation. A distributor that has become the legal manufacturer of one Class I device needs a different scope from a developer with an implantable device, embedded software and a user interface. What we can promise is a proposal in which every component is visible and nothing is added later, with no certification fee, because none exists.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Current maturity, the number of device families, the software, usability and electrical interfaces, the jurisdictions, deliverables and how much of the work your team takes on (Design™ or Drive™) |
| Independent assessment | There is no ISO 14971 certificate and no separate ISO 14971 audit. The file is examined within your ISO 13485, MDSAP and notified-body audits, whose fees remain theirs |
| Internal resources | Engineering, regulatory, clinical and production time for the analyses and reviews, management time for the policy and criteria, and any design, labelling or process changes the files call for |
| Software and learning | Included in a Sterling engagement: Effivity for the process, files and post-production reviews, and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Post-production reviews, file updates for changes and new jurisdictions, internal audits, refresher learning and revised editions under Sustain™ |
What moves the price
- Number of device families, and the classes and jurisdictions they are placed in
- Software, user interface and medical electrical content, each with its own standard to embed
- Whether files exist today, and how much of the 2007-edition analysis can be kept
- The submission or audit deadline, and how much of the work your engineers can carry
- Languages, sites and whether suppliers or contract manufacturers are in scope
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- No certification fee, because none exists; your certification body, auditing organisation and notified body fees remain theirs
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO 14971 implementation take?
The realistic timeline depends on your starting point, the number and complexity of the device families, the availability of the engineers who know the devices and the audit or submission ahead. It is measured in months, not days, typically three to six: a file has to be built with the people who designed the device, verified against real test evidence and reviewed before anyone can sign a risk management report. We plan around those reviews, with milestones tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to the design history, existing files, complaint and service records and the people who know the devices |
| Process, policy and plan | How quickly management can agree the policy for the criteria for risk acceptability, the responsibilities and the scales |
| Risk management files | The number of device families, the depth of the software, usability and electrical analyses, the verification evidence available and the changes the files call for |
| Review, report and audit readiness | The risk management review for each file, the internal audit slot, the time to close findings and the date of the next audit |
If a submission date, a notified-body audit or a customer deadline sets the pace, share it at the start. We will tell you what is achievable and which decisions cannot wait. A file promised in weeks, before anyone has met your engineers, is a sales tactic, not a project plan.
Challenges
Common ISO 14971 implementation challenges
Most medical device risk management programmes stall for the same five reasons. Each has a practical answer.
The file is a failure mode table, not a risk analysis.
An FMEA lists what can break; ISO 14971 requires what harm can reach a patient or user and by what sequence of events. We rebuild the analysis around hazards, hazardous situations and harm, keep the FMEA as an input, and give every row the traceability clause 4.5 expects.
The criteria for risk acceptability are a colour code nobody can defend.
Management sets the policy for the criteria in writing, the scales and thresholds follow from it, and benefit-risk analysis is written where the criteria are not met, so an auditor who asks why a risk was accepted gets a reason, not a shade of green.
Software, usability and electrical safety are analysed in three places that disagree.
The IEC 62304 software risk process, the IEC 62366-1 use-related analysis and the IEC 60601-1 risk work are embedded in one ISO 14971 process with one file per device family, so the analyses share estimates and controls.
Complaints are handled, but nothing ever reaches the file.
The production and post-production system is designed as a review, not a mailbox: sources named, frequency set, relevance to safety decided and recorded, and the file, device or process updated when the review says so, with Effivity holding the trail.
Your engineers have no time and no training for another process.
Agree a support model with clear tasks for Sterling and for your team. Design™ gives your engineers the structure, templates and coaching to build the files themselves; Drive™ has Sterling carry the agreed analysis and documentation work.
Your engagement
What your ISO 14971 engagement includes
Your agreed scope brings together everything a working process, defensible files and a prepared team need. Most firms deliver a template and a training day; a Sterling engagement is the whole journey, from one team, under one all-inclusive proposal.
Scope, gap analysis and implementation plan
Devices, jurisdictions, interfacing standards, responsibilities, dates and decision owners agreed before the first workshop.
Process, policy and documentation
The procedure, the policy for the criteria for risk acceptability, the plan template, the scales and the file structure, built with your management and engineers on Sterling's template sets.
Effivity ISO & GRC software
Your process, files and post-production reviews run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for the people who will audit the process, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Risk management files built with your engineers
Facilitated analysis sessions for each device family, from intended use to overall residual risk, with the verification evidence and benefit-risk analyses the file needs.
Review, report and audit readiness
The review and report for each file, an internal audit of the process and support through the ISO 13485, MDSAP or notified-body audit that examines it.
There is no ISO 14971 certificate to issue and none is promised; audit and conformity assessment decisions remain with the bodies that make them.
How we deliver
How Sterling supports your ISO 14971 implementation
Every ISO 14971 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Pick the level of support your engineering capacity allows; the method, the software and the accountability do not change.
- 01Design™Guided implementation: your engineers build the process and the files with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed analysis, facilitation and documentation work with your engineers and management.
- 03Sustain™After release: scheduled post-production reviews, file updates, internal audits, refreshers and new-hire training, year after year.
- 04Automate™The process running in Effivity: plans, hazard analyses, controls, verification, benefit-risk analyses, reports, complaints and reviews in one workspace.
- 05Revise™Adoption of the next edition of ISO 14971 or of ISO/TS 24971-1 when published, and changes in devices, jurisdictions or regulation.
Before work starts we agree the engagement team, the weekly working session, the deliverables and who decides what. Progress is reviewed against those commitments, so gaps show early rather than in a deficiency letter.
How Sterling OS™ worksOften combined with
Standards organisations pair with ISO 14971
- 21 CFR Part 11 / EU Annex 1121 CFR Part 11 and Annex 11 compliance for GxP systems: requirements, validation, audit trails and e-signatures, with evidence ready for FDA and EU inspectors.
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CAP accreditationCAP accreditation readiness for laboratories: checklist gap analysis, method records, self-inspection and peer inspection support.
- EU IVDR 2017/746EU IVDR compliance consulting for IVD manufacturers: performance evidence, QMS, traceability and post-market follow-up prepared for your notified body.
- EU MDR 2017/745EU MDR compliance consulting for CE marking: QMS, technical documentation, traceability and post-market surveillance prepared for your notified body.
- FDA QMSR (21 CFR 820)FDA QMSR compliance consulting for device makers selling in the US: a quality management system ready for FDA inspection, wherever you manufacture.
Effivity · ISO 14971 risk management software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO 14971:2019.
Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries, is part of every Sterling ISO 14971 engagement. Your consultant configures the risk management workspace within the agreed scope, so plans, hazard analyses, risk controls and their verification, benefit-risk analyses, reports, complaints and post-production reviews live in one place, and an auditor reads a live file rather than a spreadsheet. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.
Procedure, policy, plans and competence
The procedure with its approvals, the policy for the criteria for risk acceptability, a plan per device family and the competence records of the people who analyse and review.
Hazards, sequences and hazardous situations
Intended use, foreseeable misuse and the characteristics related to safety recorded per device, and each hazard captured with its sequence of events, hazardous situation, harm, severity and probability.
Criteria applied consistently
The scales and criteria from the plan configured once and applied to every hazardous situation, with the decision recorded against each, so evaluations from different teams mean the same thing.
Controls, verification and residual risk
Risk control measures classified by priority and linked to the design outputs, tests and labelling that implement them, with verification, residual risk and benefit-risk analysis on the same record.
The device-level conclusion
The overall residual risk evaluation for each device with its method, justification and disclosures, reported from the file rather than rewritten for each submission.
Reports and release
The risk management report generated from the plan, the analyses and the verification records, with the sign-offs the plan requires, so the review before release is a screen, not a hunt through folders.
Complaints and reviews back into the file
Complaints, service reports, supplier notices and literature reviews logged, assessed for relevance to safety and linked to the hazards they affect, with actions tracked to closure.
Your own analyses, forms and reports
Forms, fields, workflows and reports adapted to how you develop devices, without code; ISO 13485 records, CAPA, design changes and internal audits beside the files they feed.
What this means at the audit
Whoever examines your risk management, the ISO 13485 auditor, the MDSAP auditing organisation or the notified body, asks for the plan, the hazard analysis, the verification evidence, the benefit-risk analyses, the report and the record of what post-production information changed. In Effivity each is a screen, with dates, owners and evidence attached, not a binder assembled before the audit. After release, Sustain™ runs in the same workspace, so the file never stops.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your existing files and complaint records migrated, not retyped
- Admin and user training for your team
- Modules for the ISO 13485 QMS, ISMS, EMS and OHSMS when systems share the workspace
ISO 14971 client experience
Client letters on file, available on request.
Signed client letters for ISO 14971 are available on request. The client feedback wall lists every letter by standard.
Programmes with ISO 14971 in scope
How an integrated medical device programme runs.
- 01How integrated programmes run
Risk management inside an ISO 13485 quality system
ISO 14971 is commonly implemented as the risk management process of an integrated medical device programme covering ISO 13485, the technical documentation for CE marking under the EU MDR or IVDR, an MDSAP audit and, for devices with software or a user interface, IEC 62304 and IEC 62366-1. In such a programme management sets one policy for risk acceptability, each device family has one file that every analysis feeds, and complaints and post-production review run as one loop.
Sterling Academy · ISO 14971 e-learning
Train every employee on ISO 14971, not just the engineers who write the file.
Sterling Academy delivers e-learning for the whole workforce and for the people who run the process: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- ISO 14971 awareness for every employee, so production and service staff recognise what the file needs
- Practitioner courses for design engineers, regulatory staff, the quality lead and the people who chair reviews
- Internal auditor training for the people who will audit the process, as applicable to your standard, as part of the engagement
- Learner progress by department and a training status report for any auditor
- New hires trained as they arrive, so competence evidence is current at every audit
- A Sterling consultant reachable when a learner needs one
Sterling Academy courses for an ISO 14971 programme
The courses your people take, and who takes them.
ISO 14971 Medical Device Risk Management
What hazard, hazardous situation, harm, risk and residual risk mean, why a manufacturer manages risk across the life cycle, how the process and the file fit together and what each person is expected to notice and report. The competence evidence for the whole workforce.
View the courseDocumented Information Management
Creating, controlling and using the procedure, the plans, the files and the reports, so the traceability ISO 14971 expects from each hazard to its evidence stays accurate and current at every audit.
View the courseNonconformity Management
What to do when a complaint, a nonconforming product or a field report arrives: capturing the event, finding the cause, taking corrective action and feeding the lesson back into the file.
View the courseRisk Management
Analysing, evaluating and controlling risk with the ISO 14971 process, setting criteria for risk acceptability that management can defend, writing a benefit-risk analysis and an overall residual risk evaluation, and the review and report behind release.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will audit the process, with practical exercises on your own files and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO 13485, ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001 and more, so an integrated system trains one workforce on one platform.
See all coursesSterling consulting clients arrange access through their consultant. Sterling Academy certificates are training certificates for individuals; ISO 14971 carries no certification of the organisation or the device.
Keep exploring
Explore more about ISO 14971
Watch a video on how to implement ISO 14971 here.
Watch a video on ISO 14971 requirements here.
Why Sterling
Want ISO 14971 files that satisfy every auditor? Come to Sterling.
Whether you are building your first file or aligning risk management across sites and contract manufacturers in several countries, Sterling helps you establish one process with clear ownership. We work through differences in jurisdiction, device class and engineering practice, so the files agree without flattening the risks each device carries.
Risk management in 60+ countries since 2003
Risk processes and the risk clauses of every major management system standard implemented for device manufacturers, healthcare providers, laboratories and technology companies, with one engagement team accountable in every country you operate in.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with no certification fee because none exists; your auditors' fees remain theirs. No surprises, ever.
A process your engineers can use
Less documentation and maximum effect: criteria in plain terms, analyses that run inside design reviews and complaint handling, and files built for the reviewer who reads them.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003, and who build your risk management process properly the first time, so the first audit finds a file that works.
The Sterling Promise
What our ISO 14971 implementation success guarantee means
We stay with you until your agreed ISO 14971 implementation outcome is achieved: the process established, the files built and reviewed for the agreed device families, the reports signed and the findings of the audit that examines them resolved. Clear explanations, practical delivery, included software and learning turn the investment into lasting capability rather than a file on a shelf.
The engagement identifies the standard, scope, outcome and responsibilities. Your organisation supplies accurate information, decides the criteria for risk acceptability and the risk decisions and puts the agreed process into use. ISO 14971 carries no certification, so no certificate is promised; the conclusions of your certification body, auditing organisation, notified body or regulator remain theirs. Our commitment concerns the agreed consulting support, not a promise that no harm will ever occur or that every submission passes without questions.
After implementation
What happens after ISO 14971 implementation?
The process should keep working as devices change, markets are added and information arrives from the field. Complaints, service data, supplier notices and the state of the art are reviewed against the files on the schedule the plan sets, design changes reopen the analysis they affect, and the report is updated when the overall residual risk conclusion moves. The certification body returns for surveillance audits, the MDSAP cycle continues, and the notified body reviews the file when the device changes.
Under Sterling OS™ Sustain™ we facilitate the post-production reviews, update the files for changes and new jurisdictions, audit the process and train the people who join, so the files stay alive between audits rather than being revived before one.
FAQs
Frequently asked questions about ISO 14971
Can an organisation be certified to ISO 14971?
No. There is no accredited certification scheme for ISO 14971 and no "ISO 14971 certificate" that a regulator, notified body or customer recognises. It is a process standard applied by the manufacturer, and conformity is examined within the audits you already undergo: the ISO 13485 audit, the MDSAP audit and the notified body's assessment. A provider offering one is selling its own paper.
Is ISO 14971 mandatory?
The standard is voluntary; the requirements it serves are not. The EU MDR and IVDR require a system for risk management, and EN ISO 14971:2019+A11:2021 is the harmonised standard that gives a presumption of conformity for the requirements it covers; ISO 13485 requires documented risk management processes in product realisation; MDSAP audits are built on a foundation of risk management requirements.
How does ISO 14971 relate to ISO 13485?
ISO 13485 is the certifiable quality management system standard for medical devices; ISO 14971 is the risk management process inside it. Clause 7.1 of ISO 13485:2016 requires documented processes for risk management in product realisation, with records, and ISO 14971 provides the process. ISO 14971 does not itself require a quality management system, but your ISO 13485 auditor examines your files against it.
What changed between ISO 14971:2007 and ISO 14971:2019, and do old files need rewriting?
The 2019 edition gave more weight to benefit-risk analysis, brought data and systems security into scope, clarified the evaluation of overall residual risk and restructured production and post-production into a system for collecting, reviewing and acting on information; several annexes moved to ISO/TR 24971:2020. Old files rarely need starting again, but the plan, criteria, benefit-risk reasoning and post-production loop usually need rework.
What is EN ISO 14971:2019+A11:2021, and what does harmonisation mean?
It is the European adoption of ISO 14971:2019 with a 2021 amendment adding the informative Annexes ZA and ZB that relate the standard to Regulation (EU) 2017/745 and Regulation (EU) 2017/746. The Commission listed it in the Official Journal in May 2022 as a harmonised standard under both. Using it is voluntary, but it gives a presumption of conformity with the requirements it covers, so notified bodies expect it.
What is ISO/TR 24971 and do we need it?
ISO/TR 24971:2020 is the guidance on applying ISO 14971:2019: without adding requirements, it explains how to set a policy for risk acceptability, run a benefit-risk analysis and apply the process to in vitro diagnostic devices. ISO has flagged it for revision and registered ISO/TS 24971-1 as a new project in July 2026, with no publication date.
Does ISO 14971 apply to software as a medical device and to IVDs?
Yes. The scope of ISO 14971:2019 covers medical devices including software as a medical device and in vitro diagnostic medical devices. IEC 62304 requires the software risk management process to be embedded in the device process according to ISO 14971, and IEC 62366-1 and IEC 60601-1 tie their risk work to the same process.
Does Sterling issue any ISO 14971 certificate?
No. Sterling designs and builds the process with you, builds the files with your engineers, trains your people and supports you through the audit that examines them. Sterling Academy issues training certificates to individuals; those show personal competence, not certification of the organisation or the device.
What do you need to prepare an ISO 14971 proposal?
The device families, their classes and target markets, whether they contain software, a user interface or medical electrical parts, what procedure and files exist today, which audits you hold or face, and your deadline. That is enough for a scoped, all-inclusive proposal; there is no need to write a risk management plan first.
Before the first call
Prepare a useful ISO 14971 readiness brief
You do not need a risk management plan before the first discussion. Bring a short account of the devices, the markets and where risk management is missing or failing. Seven questions are enough:
- Which device families are in scope, what class are they, and which markets and regulations apply to each?
- Who is asking for the file: a notified body, a regulator, an MDSAP auditing organisation, your certification body or a customer? Or, if nobody has asked, what prompted the question?
- Do the devices contain software, a user interface or medical electrical parts, and which standards apply?
- What procedure, policy, plans and files exist today, which edition were they built on, and who uses them?
- What have complaints, service reports, audit findings or deficiency letters told you about what the current approach missed?
- Who in management can decide the criteria for risk acceptability, and which engineers can give time to analysis and review?
- Is there a submission date, an audit date, a design transfer or a customer deadline to plan around?
These answers let us scope the work and prepare a realistic proposal. They prepare a discussion, not a scored assessment or a verdict on your files.
Don’t be fooled by certification scams
If it ends with an "ISO 14971 certified" logo, it is not ISO 14971.
ISO 14971 is applied by the manufacturer and examined inside ISO 13485 audits, MDSAP audits and notified-body assessments; no accredited certification scheme exists for it on its own. That has not stopped a market in "ISO 14971 certified" badges and ten-day risk files from another company's template. They cost less, until a notified body or a regulator asks who decided the risk was acceptable, and why.
How to choose a credible ISO 14971 provider
- Walk away from any offer of an "ISO 14971 certificate" for your organisation or your device. There is no accredited certification to ISO 14971; a document with that title is the seller's own creation.
- Ask who in your management will set the policy for the criteria for risk acceptability, and how. A provider that arrives with the criteria filled in is selling a template.
- Ask how the hazard analysis will reach the engineers who designed the device, and how many working sessions are planned. A file produced by a consultant alone describes the consultant's assumptions.
- Identify who carries each task, which audits will examine the file and when, and what support exists when findings are raised.
- Ask what your people will learn and what software the process will run in. No training and no system means the file stops the day the consultant leaves.
- Be cautious of "ISO 14971 compliant in ten days" and one invoice for the file and a certificate. A file has to be built on real design and test evidence, and there is no certificate to invoice for.
Keep exploring
More on ISO 14971 and related standards
More in Healthcare, medical devices & life sciences
Talk to a consultant
Plan your ISO 14971 implementation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice