www.nevilleclarke.com

ISO 14971 (Medical devices – Application of Risk Management to Medical Devices) CHANGED?If you ask whether ISO 14971 standard requirements have changed, the answer would be YES and NO.

In August 2012, EN ISO 14971:2012 has been released and superseded EN ISO 14971:2009 to support the Directives. The changes are described in Annex ZA, ZB and ZC, the core text of the standard remains unchanged. This is triggered when compliance with the normative clauses in ISO 14971 does not ensure conformity with the Essential Requirements (ERs) of the Directives. In this latest development, EN ISO 14971:2012 has listed a total of 7 Content Deviations to further explain the requirements from the ER.

Therefore, YES… EN ISO 14971 has changed and if a manufacturer has products associated with the European market and need to comply with the Directives, the manufacturer shall conduct a detailed review of current risk management processes in reference to the applicable Annex ZA, ZB, or ZC in EN ISO 14971:2012 to plan for any updates to risk-related procedures as necessary.

However, for the rest of the world, NO… There is no change in the requirements and their risk management process shall conform to the ISO 14971:2007 standard requirements.

The 7 Content Deviations are listed below: 1. Treatment of Negligible Risks:

• ISO 14971 allows negligible risks to be ignored.• The Directives require all risks to be reduced as far as possible and to be subject to risk-benefit analysis.

2. Risk Acceptability Assessment:• ISO 14971 allows risks that meet the manufacturer’s definition of “acceptable” to be excluded from overall risk-benefit

analysis.• The Directives require all risks to be reduced as far as possible and to be subject to risk-benefit analysis.

3. Risk Reduction Economic Considerations: • ISO 14971 allows risks to be reduced “as low as reasonably practicable” (ALARP).• The Directives require all risks to be reduced as far as possible (AFAP) without economic considerations.

4. Risk-Benefit Analysis Not Optional:• ISO 14971 only requires risk-benefit analysis for risks that do not meet the manufacturer’s definition of “acceptable.”• The Directives always require risk-benefit analysis, regardless of risk levels. The analysis must consider all individual risks

and their impact on overall residual risk acceptability, weighing all risks combined against patient benefit.5. Risk Control Options:

• ISO 14971 describes three risk control options to be exercised at the manufacturer’s discretion—(1) inherent safety by design, (2) protective measures, and (3) information for safety—and implies that further controls are not required if the risk is reduced to acceptable levels.

• The Directives require risks to be reduced until further control measures do not result in risk reduction.6. First Risk Control Option:

• ISO 14971 describes the first risk control measure as “inherent safety by design” without further detail.• The Directives provide additional detail by mentioning that device design and construction just conform to safety

principles, taking account of the generally acknowledged state of the art and that risks must be eliminated or reduced as far as possible through inherently safe design and construction.

7. Labeling Information Cannot Influence Residual Risk:• ISO 14971 describes three risk control options: (1) inherent safety by design, (2) protective measures, and (3) information

for safety.• The Directives view the third option as providing information on residual risk rather than reducing risk.

ISO 14971 May 2014 Page 1