Revision of risk management standard released for public comment

Revision of ISO 14971 released as Draft International Standard

The International Standard ISO 14971:2007 - Medical devices — Application of risk management to medical devices - is a critical horizontal standard supporting the regulation of medical devices. It was decided in late 2016 that the international standard ISO 14971:2007 would be revised. The comments on the draft circulated to national committees have been reviewed. The revision process has now reached the Draft International Standard (DIS) stage where the document is available from late July for public comment through national standards organizations such as BSI.

The main changes compared to the previous edition are:

• A normative references clause has been included even though no normative references are cited. This means that most clause numbers have been changed compared to the previous edition.
• The defined terms have been updated to provide consistency with other standards. A definition of benefit has been introduced.
• More attention is given to the benefits that are expected from the use of the medical device. The term benefit-risk analysis is aligned with terminology the European Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR).
• It is highlighted that the process described in ISO 14971 can be used for managing all types of risks associated with medical devices, including those related to data and systems security.
• The requirements for the evaluation of overall residual risk have been refined. The method for the evaluation of the overall residual risk as well as the criteria for its acceptability need to be defined in the risk management plan. The evaluation method can include gathering and reviewing data and literature for the medical device and similar devices on the market. The criteria for the acceptability of the overall residual risk can be different from the criteria for acceptability of individual risks.
• The requirements to disclose residual risks are merged into one requirement. If the overall residual risk is judged acceptable, the manufacturer has to decide which residual risks to disclose and what information to include in the accompanying documentation.
• Before release of the medical device for commercial distribution, the execution of the risk management plan has to be reviewed. The results of the review are recorded in a risk management report. The manufacturer needs to determine when reviews and updates of the risk management report are to be undertaken.
• The clause on production and post-production information has been clarified and restructured. More detail is given on the information to be collected and the actions to take when the collected information is determined to be relevant to safety.
• More information and a rationale for the requirements of ISO 14971 is provided in an annex to the standard. Several informative annexes that were included in the previous edition of the standard have been moved to the separate guidance document ISO/TR 24971. ISO/TR 24971 is being revised in parallel.
• A cross-reference table between the clauses of the previous edition of the standard and this latest revision are also included in an annex.

The DIS text include drafts of the European Annex Zs, showing the relationship between the clauses of the standard and the requirements of the European Directives for medical devices, as well as the MDR and IVDR. These drafts are rudimentary and likely to undergo some modifications when they are reviewed on behalf of the European Commission.

This is the last opportunity to review, assess the implications of the changes and provide comments if you want to influence the development of this key standard.

Author: Eamonn Hoxey, of E V Hoxey Ltd, UK, is a writer, trainer and consultant on a range of life science areas including regulatory compliance, quality management, sterility assurance and standards development