The 2019 version of ISO 14971 is the version applicable under MDR. It was accompanied by technical report ISO/TR 24971:2020, which provides practical guidance on its application. Between the 2007 edition (EN ISO 14971:2012) and the 2019 version, the changes are not cosmetic — they reflect a fundamental evolution in the way medical device risk management is approached. A useful clarification: EN ISO 14971:2012 is not a new ISO edition but the European adoption of ISO 14971:2007, of which it only changes the Z annexes.
Many manufacturers updated their risk management procedure by changing the document header without revising the method. This is a mistake that auditors identify by reading the analysis itself.
Change 1: the method and acceptability criteria for overall residual risk, set in the plan
Neither the risk management policy nor the evaluation of overall residual risk is new in 2019. The 2007 edition (EN ISO 14971:2012) already required top management to define and document a policy for establishing the criteria for risk acceptability (clause 3.2), and required the acceptability of overall residual risk to be evaluated (clause 7).
The real 2019 change lies elsewhere: the risk management plan must now define the method for evaluating overall residual risk and the criteria for its acceptability, based on the manufacturer’s policy (clause 4.4). These criteria are distinct from those applied to each individual risk. A risk matrix with its thresholds is therefore not enough: it only covers risks one at a time. The accumulation of multiple residual risks, even where each is acceptable in isolation, must be evaluated (clause 8) using a method and criteria established in advance. A plan that does not define them is non-compliant with the 2019 version.
Change 2: clinical benefits integrated into the benefit/risk evaluation
The 2007 edition (EN ISO 14971:2012) focused mainly on the identification, evaluation and control of risks. The 2019 version formalises the integration of clinical benefits into the overall evaluation. The manufacturer must demonstrate that the expected clinical benefits outweigh the residual risks — not merely that the risks are acceptable in absolute terms.
This change aligns the standard with the requirement of GSPR no. 1 of Annex I of the MDR. It creates an explicit link between risk management and clinical evaluation: to reach a conclusion on the benefit/risk ratio, the manufacturer needs clinical data on the expected benefits, not just an analysis of failure modes.
Change 3: reinforced post-production information collection
Section 10 of the 2019 version strengthens the requirements on the collection and analysis of information in the post-production phase. The risk management process does not stop at placing on the market. Post-market data — complaints, vigilance data, clinical publications, PMCF data — must be analysed to identify unanticipated risks and, where necessary, to trigger a review of the risk management report.
This change creates the formal link between risk management and PMS — a link that notified bodies verify during the audit.
What this means for MDR technical documentation
A risk management file compliant with the 2019 version must contain: a risk management policy approved by top management, a risk management plan defining the method and acceptability criteria for overall residual risk, an overall benefit/risk report (not only per individual risk), a conclusion on the overall residual risk against those criteria, and a documented review process based on post-production data.
Regulatory source: ISO 14971:2019 — iso.org