Use-related risks of medical devices lie at the intersection of two standards: ISO 14971 (risk management) and ISO 62366 (application of usability engineering to medical devices). These two standards are complementary — ISO 62366 provides the method for identifying and analysing use errors, while ISO 14971 provides the framework for evaluating and controlling the risks that these errors create.
A technical documentation file that ignores ISO 62366 and addresses use-related risks only through a generic FMEA is incomplete. The notified bodies that review files for active devices, or for devices requiring significant interaction with the user, systematically request the usability documentation.
What ISO 62366 covers
ISO 62366 defines a usability engineering process intended to ensure that the medical device can be used safely and effectively by its intended users, in their actual use environments. It covers analysis of the use context, identification of use scenarios, task analysis, generation of interface prototypes, and formative and summative usability testing.
Its primary objective is to identify and eliminate foreseeable use errors — the errors that qualified users make not out of negligence, but because the device interface is confusing, ambiguous or counter-intuitive.
What ISO 62366 does not cover
ISO 62366 does not define risk acceptability criteria and does not produce a benefit/risk report. These elements remain the remit of ISO 14971. ISO 62366 identifies foreseeable misuse scenarios and documents the design measures adopted to eliminate or mitigate them.
How the two standards articulate within the technical documentation
The usability process under ISO 62366 feeds the ISO 14971 list of hazards: the foreseeable misuse scenarios identified during usability studies are potential hazards that enter the FMEA.
The control measures adopted through interface design (levels 1 and 2 of the ISO 14971 hierarchy) are validated by the summative usability tests of ISO 62366. These tests constitute the effectiveness verification of the control measures for use-related risks.
In the technical documentation, both files — the ISO 14971 risk management file and the ISO 62366 usability file — must reference each other. The foreseeable misuse scenarios must appear in both.