The 2019 version of ISO 14971 is the version applicable under MDR. It was accompanied by technical report ISO/TR 24971:2020, which provides practical guidance on its application. Between the 2012 version and the 2019 version, the changes are not cosmetic — they reflect a fundamental evolution in the way medical device risk management is approached.
Many manufacturers updated their risk management procedure by changing the document header without revising the method. This is a mistake that auditors identify by reading the analysis itself.
Change 1: the risk management policy becomes an explicit requirement
The 2012 version implied a risk policy without requiring it by name. The 2019 version makes it mandatory: top management must establish, implement and maintain a risk management policy defining the criteria for risk acceptability.
This policy must be documented and approved. It is operationally reflected in the definition of acceptability criteria — the risk matrix, with its acceptability thresholds and the bases on which they are set. A risk matrix without a risk management policy approved by top management is non-compliant with the 2019 version.
Change 2: clinical benefits integrated into the benefit/risk evaluation
The 2012 version focused mainly on the identification, evaluation and control of risks. The 2019 version formalises the integration of clinical benefits into the overall evaluation. The manufacturer must demonstrate that the expected clinical benefits outweigh the residual risks — not merely that the risks are acceptable in absolute terms.
This change aligns the standard with the requirement of GSPR no. 1 of Annex I of the MDR. It creates an explicit link between risk management and clinical evaluation: to reach a conclusion on the benefit/risk ratio, the manufacturer needs clinical data on the expected benefits, not just an analysis of failure modes.
Change 3: the “overall residual risk” as a distinct concept
The 2019 version introduces the evaluation of overall residual risk — the assessment of all residual risks taken collectively, after applying all risk control measures. It is no longer sufficient for each individual risk to be acceptable: the accumulation of multiple residual risks, even where each is acceptable in isolation, must be evaluated as a whole.
Change 4: reinforced post-production information collection
Section 10 of the 2019 version strengthens the requirements on the collection and analysis of information in the post-production phase. The risk management process does not stop at placing on the market. Post-market data — complaints, vigilance data, clinical publications, PMCF data — must be analysed to identify unanticipated risks and, where necessary, to trigger a review of the risk management report.
This change creates the formal link between risk management and PMS — a link that notified bodies verify during the audit.
What this means for an MDR technical file
A risk management file compliant with the 2019 version must contain: a risk management policy approved by top management, an overall benefit/risk report (not only per individual risk), a conclusion on the overall residual risk, and a documented review process based on post-production data.
Regulatory source: ISO 14971:2019 — iso.org