Risk management for medical devices is the continuous, documented process by which manufacturers identify product hazards, estimate and evaluate the associated risks, control these risks, and monitor them throughout the entire life cycle. Legally, Annex I Section 3 of Regulation (EU) 2017/745 requires such a system as part of an iterative process; Section 4 mandates risk control measures according to a specific hierarchy. Methodologically, the process is implemented almost without exception according to ISO 14971:2019, the European version of which is listed as a harmonized standard for the Regulation with amendment A11:2021. The result is the risk management file, which is one of the central components of the technical documentation.
Legal Requirements of the Regulation
Annex I Section 3 describes the process in seven steps, ranging from the establishment of a risk management plan to the identification of hazards and the estimation of risks during intended use and reasonably foreseeable misuse, the elimination or control of these risks, the evaluation of information from the production phase and post-market surveillance, and the necessary modification of control measures. Section 4 establishes the hierarchy: first, inherently safe design and manufacture; second, protective measures in the product or manufacturing process; and finally, safety information and user training. Annex I Section 8 additionally requires consideration of the benefit-risk ratio, while Annex II Section 5 requires the inclusion of benefit-risk analysis and risk management in the technical documentation. Article 10(9)(e) obliges manufacturers to maintain risk management as an element of their quality management system.
Process Steps According to ISO 14971
The standard structures the process into a risk management plan, risk analysis (including determination of the intended purpose and safety-related characteristics), identification of hazards and hazardous situations, risk estimation, risk evaluation based on predefined acceptance criteria, risk control with verification of implementation and effectiveness, evaluation of overall residual risk, a risk management report, and monitoring of production and post-market information.
Risk Management File and Traceability
It is essential to evaluate new risks arising from the control measures themselves and to check whether measures contradict one another. The guidance document ISO/TR 24971:2020 provides assistance on acceptance criteria, determining the state of the art, and product-specific considerations. The risk management file must establish traceability for every risk, from the hazard through the measure to the verification evidence.
Integration with Post-Market Data and Change Control
The process does not end with CE marking. Complaints, incidents, trend reports, clinical follow-up results, and findings on comparable products must be reviewed for their impact on the risk assessment. If a hazard appears more frequently or more severely than assumed, control measures must be adjusted, potentially via corrective and preventive actions (CAPA) or a field safety corrective action. Conversely, the risk analysis provides the thresholds and indicators used by the post-market surveillance plan according to Annex III. Every change to the product, material, supplier, or process triggers a review of the file; without this feedback loop, the file becomes obsolete and is regularly flagged during audits.
Distinction from Medicinal Product Risk Management Plans
Despite the similar name, the Risk Management Plan for medicinal products is a different instrument. According to Article 8(3) of Directive 2001/83/EC, it is submitted to the authority with the marketing authorization application, is subject to regulatory assessment, and documents the safety specification, the pharmacovigilance plan, and risk minimization measures for a specific authorization; its format and content are regulated in Implementing Regulation (EU) No 520/2012 and the Good Pharmacovigilance Practices (GVP) guidelines. The reference point is the risk in the target population, and the result is implemented through product information, training materials, and restrictions on use. In contrast, risk management for medical devices is design-related, is not approved by authorities but reviewed during the conformity assessment procedure, and primarily acts through design and manufacturing. The requirement in medical device law to reduce risks as far as possible without adversely affecting the benefit-risk ratio has no direct equivalent in pharmaceutical law.
Relevance for clinical trials
Before a clinical investigation begins, the risk analysis must characterize the state upon which the investigation is based. The Investigator’s Brochure (IB) relies on it when describing residual risks, warnings, and handling instructions, and the Clinical Investigation Plan (CIP) must address those risks for which clinical evidence of control is required. Annex XV requires corresponding information for the application for authorization, and ethics committees review the appropriateness of the benefit-risk assessment for the participants.
During the study, adverse events and product defects must be mirrored against the analysis; newly identified hazards lead to changes in the file and, if necessary, the investigation plan. Full-service CROs like Mediconomics support manufacturers and sponsors in linking the risk analysis with the investigation plan, investigator information, and event evaluation, and in documenting the feedback of study results into the risk management file in a traceable manner.
Frequently Asked Questions (FAQ)
Is the application of ISO 14971 mandatory?
The process according to Annex I Section 3 of the Regulation is mandatory. However, the European version of the standard is harmonized, so its application creates a presumption of conformity for the relevant requirements; a different methodology would have to be proven equivalent.
Are residual risks allowed to remain?
Yes, provided they cannot be further reduced after applying the prescribed hierarchy of measures, are disclosed, and the overall benefit-risk ratio remains acceptable. Disclosure is made via the instructions for use and labeling.
Who reviews the risk management file?
For Class IIa to III products, the Notified Body reviews the file as part of the assessment of the technical documentation. Competent authorities may request it as part of market surveillance.
Regulatory References
- Regulation (EU) 2017/745, Annex I Sections 3, 4, and 8
- Regulation (EU) 2017/745, Annex II Section 5 and Article 10(9)(e)
- ISO 14971:2019 and EN ISO 14971:2019/A11:2021 as a harmonized standard
- ISO/TR 24971:2020, Guidance on the application of ISO 14971
- Directive 2001/83/EC, Article 8(3), and Implementing Regulation (EU) No 520/2012 on the medicinal product risk management plan
