ISO 14971:2019 Application of risk management to medical devices

What the standard covers

ISO describes ISO 14971 as a framework for identifying the hazards associated with medical devices, estimating and evaluating the associated risks, controlling them and monitoring the effectiveness of the controls. It applies to medical devices, including software as a medical device and in vitro diagnostic medical devices, from initial conception to decommissioning and disposal, and covers risks such as those related to biocompatibility, data and systems security, electricity, moving parts, radiation and usability.

According to ISO, the 2019 edition puts more focus on benefit-risk analysis and expands the requirements for production and post-production activities.

What it does not do

• It does not set acceptable risk levels: it requires manufacturers to establish objective criteria for risk acceptability.
• Quality management systems for medical devices are the subject of ISO 13485; ISO notes that risk management can be integrated into quality management systems based on ISO 13485.
• Guidance on applying the standard is published separately, as ISO/TR 24971:2020.

Edition in force and status

ISO 14971:2019 is the third edition (December 2019, 36 pages, ISO/TC 210) and replaced ISO 14971:2007. Its last systematic review closed on 5 March 2025, and ISO confirmed it on 7 March 2025, so the 2019 edition remains current.

Where it appears in medical gas work

• Portugal's ACSS ET 03/2006 (V.2024) says the location of shut-off valves in the distribution network should agree with what the ISO 14971 risk analysis defines.
• In UNDP procurement, the technical and regulatory requirements for oxygen plants (REQ-OXY-001, version V01, effective 1 January 2025) ask bidders to submit a risk management report in compliance with ISO 14971:2019 for all medical device products.