- Author
- MDRpilot Editorial Team
- Reviewer
- Independent regulatory review not yet assigned
- Last updated
- Applies to
- ISO 14971:2019 · EU MDR 2017/745 Annex I
The process step by step
| Step | What to do |
|---|---|
| Plan (clause 4.4) | Scope, lifecycle phases, responsibilities, review requirements, acceptability criteria, verification activities, production and post-production information |
| Analyse (clause 5) | Document intended use and reasonably foreseeable misuse, identify safety characteristics, hazards and hazardous situations, estimate risks |
| Evaluate (clause 6) | Compare each estimated risk with the acceptability criteria |
| Control (clause 7) | Choose controls, implement them, verify implementation and effectiveness, evaluate residual risk and benefit-risk, check for new risks |
| Overall residual risk (clause 8) | Evaluate the combined residual risk against the benefits |
| Review (clause 9) | Confirm before release that the plan was implemented and methods are in place for post-production information |
| Post-production (clause 10) | Collect and review information, and feed it back into the file |
Risk control priority
Clause 7.1 and MDR Annex I Section 4 require controls to be considered in a fixed order: eliminate or reduce risks through safe design and manufacture; take protective measures, including alarms, in the device or the manufacturing process; and provide information for safety and, where appropriate, training. Relying on an IFU warning when a design solution was practicable is a common finding.
Under MDR, reduce risks as far as possible
MDR Annex I Section 2 requires risks to be reduced as far as possible without adversely affecting the benefit-risk ratio. EN ISO 14971:2019+A11:2021 explains in its Annex Z how the standard relates to this requirement. The practical effect is that economic considerations alone cannot justify stopping risk reduction.
What auditors check in a risk file
- Acceptability criteria documented in the plan and applied consistently
- Hazard identification that covers the whole lifecycle, including transport, cleaning and disposal
- Traceability from each hazard to controls and to verification evidence
- Residual risks disclosed in the IFU
- Evidence that complaints and PMS data were reviewed against the risk file
How MDRpilot supports ISO 14971
MDRpilot drafts the risk management plan from company and product data, records risk items in an FMEA-style table with severity, probability and a calculated risk level, and records verification of control when a passing test report is confirmed against a risk item. Complaints, CAPA and PMS documents are in the same workspace for post-production review. Acceptability criteria and risk judgements remain your team's decisions.
References
- ISO 14971:2019 Medical devices — Application of risk management to medical devices — International Organization for Standardization.
- Regulation (EU) 2017/745 on medical devices (MDR) — EUR-Lex, Publications Office of the European Union.
Always check the consolidated text of the regulation and the current version of each guidance document before relying on it.
This guide is general information about the regulation and standards named above. It is not legal or regulatory advice for a specific device.
MDRpilot is documentation and workflow software. It is not a medical device, not a notified body and not a regulatory authority. It does not certify devices or guarantee compliance; AI-generated drafts must be reviewed and approved by qualified people in the manufacturer's organisation.