The residual risk of a medical device is the risk that remains after all risk control measures have been implemented. ISO 14971 distinguishes two levels: the residual risk of each individual hazardous situation, which under Clause 7.3 of the standard is checked against the acceptability criteria defined in the risk management plan, and the overall residual risk of the product, whose acceptability must be assessed separately under Clause 8 using a dedicated method defined in the plan. Legally, Annex I, Section 3 of Regulation (EU) 2017/745 requires a continuous risk management system, and Section 8 of the Annex requires that all known and foreseeable risks be reduced to an acceptable level. Residual risks are not a deficiency of the process, but its documented outcome.
Individual residual risk and acceptability criteria
For each identified hazardous situation, the risk is derived from the probability of occurrence and the severity of harm. After implementing risk control measures, the remaining individual residual risk is re-estimated and compared with the acceptability criteria that the manufacturer has defined in advance in the risk management plan, typically as a matrix of severity and probability classes. If a residual risk remains above the acceptability threshold, ISO 14971 does not allow it to be accepted without further consideration: the manufacturer must first evaluate additional control measures and may justify the risk via a benefit–risk analysis under Clause 7.4 only if further reduction is not practicable. Risks that arise from the control measures themselves, as well as the completeness of risk control, must also be assessed.
Overall residual risk and disclosure
Overall residual risk is not the sum of the individual values, but an independent assessment of the product in its context of use. It considers the interaction of multiple acceptable individual risks, the accumulation of similar warnings and use limitations, comparison with the state of the art and with similar products on the market, as well as insights from the literature and use experience. If the overall residual risk is deemed acceptable, this results in a duty to inform: the manufacturer must inform users about significant residual risks and include the required information in the accompanying documentation. From a regulatory perspective, this is reflected in Annex I, Chapter III, Section 23.4(g) of Regulation (EU) 2017/745, which requires the instructions for use to include residual risks, contraindications, and undesirable side effects, including information to be passed on to the patient. Disclosure is therefore the final stage of the risk control hierarchy, not a substitute for design-related or protective measures.
Distinction from harm, hazard, and residual risk under pharmaceutical law
Harm is the impairment to the health of persons that has occurred, or damage to property; a hazard is the potential source of harm. Residual risk, by contrast, is an evaluative measure based on probability and severity after implementation of control measures. Residual risk differs from the concept of a side effect in that it is an ex ante assessment rather than an observed event. In pharmaceutical law, a functionally comparable concept is addressed via the risk management plan and risk minimisation measures, but without the two-stage assessment of individual and overall residual risk required by standards and without linkage to a product life cycle with conformity assessment. Mixing terms from both domains risks inconsistencies between the risk management file and the clinical documentation.
Relevance for clinical trials
In clinical investigations of medical devices, residual risks are the substantive starting point for study planning. They determine which safety endpoints are collected, which inclusion and exclusion criteria and precautionary measures are required, what content must be included in the patient information, and how the benefit–risk assessment is justified in the clinical investigation plan. Residual risks whose assessment is based on insufficient data are typically precisely those for which clinical data must be generated; ISO 14155 therefore requires that the clinical investigation plan and investigator’s brochure reflect the known risks and the control measures taken.
Conversely, study results feed back into risk management: newly observed events, use errors, and frequency estimates lead to a re-evaluation of individual and overall residual risk and, where necessary, to adjustments to the instructions for use, warnings, or design. This feedback continues after placing on the market through surveillance, vigilance, and post-market clinical follow-up. Full-service CROs such as Mediconomics support manufacturers and sponsors in consistently reflecting residual risks in the clinical investigation plan, patient information, and safety reporting, and in preparing study data to update the risk management file.
Frequently Asked Questions (FAQ)
May a residual risk remain above the acceptability threshold?
Only in exceptional cases. The manufacturer must first evaluate additional control measures; if further reduction is not practicable, the residual risk may be justified by a documented benefit–risk analysis.
Is a warning in the instructions for use sufficient to reduce risk?
No. Safety information is at the end of the control hierarchy and must not replace design measures or protective devices. It is a means of disclosing remaining risks, not of eliminating them.
Who defines the acceptability criteria?
The manufacturer, in advance in the risk management plan, including the method for assessing overall residual risk. The criteria must meet applicable regulatory requirements, the state of the art, and relevant standards, and are subject to review by the Notified Body.
Regulatory References
- ISO 14971:2019, Clauses 4.4, 7.3, 7.4, 7.5, 7.6 and 8 – risk management plan, residual risk assessment, overall residual risk
- ISO/TR 24971:2020 – guidance on the application of ISO 14971
- Regulation (EU) 2017/745, Annex I, Sections 1 to 4 and 8 – risk management and risk control
- Regulation (EU) 2017/745, Annex I, Chapter III, Section 23.4(g) – residual risks in the instructions for use
- ISO 14155 – Clinical investigation of medical devices in human subjects
