Clause 6 of ISO 14971 defines the requirements relating to risk control. It imposes a logic for risk treatment that is not optional: risk control measures must follow a precise hierarchy, be verified for their effectiveness, and not introduce new risks.
The hierarchy of risk control measures
ISO 14971:2019 requires risk control measures to be applied in a defined order of priority.
Level 1: inherent safety by design. Eliminating or reducing the hazard at the source. Changing the material to avoid toxicity, modifying the geometry to eliminate the risk of cutting, replacing a hazardous energy source with a safe one. This is the most robust risk control measure — it reduces the risk without depending on user behaviour.
Level 2: protective measures. Physical barriers, alarms, automatic cut-off systems, protective devices built into the product or its packaging. These measures reduce the risk even if the user takes no particular precautions.
Level 3: information for safety. Warnings in the IFU, statements on the label, user training, contraindications. This is the least robust risk control measure — its effectiveness depends entirely on user behaviour.
The hierarchy applies in this order: if a Level 1 measure is practicable, it must be selected before considering a Level 2 measure, which in turn takes priority over a Level 3 measure. A manufacturer who selects only Level 3 measures (information/warning) for risks that could have been addressed in design must justify why Levels 1 and 2 were not practicable.
Effectiveness verification: the step many skip
Clause 6.3 of ISO 14971 is explicit: the effectiveness of each risk control measure must be verified. This verification must be documented with objective evidence — not a statement of intent.
What “effectiveness verification” means in practice depends on the type of measure.
For a design measure: mechanical, chemical or electrical testing demonstrating that the hazard is effectively eliminated or the risk effectively reduced according to the defined criteria.
For a protective device: functional testing of the alarm, the cut-off system, or the physical barrier under representative conditions of use.
For an information measure: usability validation in accordance with IEC 62366 — do the intended users understand the warning and apply it correctly? A comprehension test or a usability study is the expected form of verification.
Risks introduced by risk control measures
Clause 6.4 requires verifying that the risk control measures selected do not themselves introduce new risks. An emergency stop button can create a risk of accidental stoppage during a critical procedure. An audible alarm can cause a startle reaction. A surface coating can present a risk of allergy.
These new risks must be assessed and treated through the same process. This is an iterative loop that must be documented.