ISO 14971 risk management file: the review points in MDR Annex I and VII

The term risk management file does not appear anywhere in the MDR. The regulation speaks of a system for risk management, a risk management plan and "the results of the risk management". In the MDCG templates for the PMCF plan and the PMCF evaluation report, the file is called "Risk Management File (date and version)".

When preparing for an audit, this is more than a question of terms. Anyone who reads the file only against the standard misses what the regulation itself requires and how it describes the notified body's review. Methods such as FMEA or FTA are covered in our articles on choosing a method and on hazard and risk analysis. This article is about what has to become of their output.

What the MDR requires before the standard comes in

Article 10(2) MDR obliges manufacturers to "establish, document, implement and maintain a system for risk management as described in Section 3 of Annex I". Annex I Section 3 states that risk management "shall be understood as a continuous iterative process throughout the entire lifecycle of a device, requiring regular systematic updating", and lists six steps. Manufacturers shall

• (a) establish and document a risk management plan for each device,
• (b) identify and analyze the known and foreseeable hazards associated with each device,
• (c) estimate and evaluate the risks associated with the intended use and with reasonably foreseeable misuse,
• (d) eliminate or control those risks in accordance with Section 4,
• (e) evaluate the impact of information from the production phase and from post-market surveillance on hazards, risks, overall risk, benefit-risk ratio and risk acceptability,
• (f) amend control measures if necessary.

Section 4 sets the priorities: first safe design and manufacture, then protection measures including alarms, and last information for safety and, where appropriate, training. The aim is that "the residual risk associated with each hazard as well as the overall residual risk is judged acceptable". The term overall residual risk appears exactly once in the regulation, in this sentence.

How far risks must be reduced is defined by the MDR itself. Under Annex I Section 2, the requirement to reduce risks as far as possible means reducing them as far as possible "without adversely affecting the benefit-risk ratio". This requirement has to be taken into account when justifying risk reduction. The acceptability of the remaining risks has to be evaluated taking into account the requirements of Annex I Sections 1, 4 and 8.

The IVDR contains the same obligation, with the same six steps, in Article 10(2) and Annex I Section 3.

Where the standard comes in

EN ISO 14971:2019, together with amendment A11:2021, is harmonized under both regulations: under the MDR since May 17, 2022 (Implementing Decision (EU) 2022/757) and under the IVDR since May 12, 2022 (Implementing Decision (EU) 2022/729). In the Commission's summary list, generated on June 17, 2026, neither entry shows an end of legal effect.

Under Article 8(1) MDR, devices that conform to such a standard are presumed to conform to the requirements of the regulation "covered by those standards or parts thereof". The presumption therefore reaches only as far as that coverage, and the yardstick remains Annex I. Under Annex II Section 5, the technical documentation contains the benefit-risk analysis under Annex I Sections 1 and 8 and "the solutions adopted and the results of the risk management referred to in Section 3 of Annex I". The file is therefore read against the regulation.

What the notified body reviews in the file

Annex VII sets out what a notified body has to do in conformity assessment. Section 4.5.1 expressly requires it to "address the interface between the manufacturer's risk management process and its appraisal and analysis of the pre-clinical and clinical evaluation". In the review of the pre-clinical evaluation (4.5.4) and of the clinical evaluation (4.5.5), the interface with the risk management process appears again as a separate review point. The notified body also ensures that the clinical evaluation "is appropriately aligned with the risk management requirements".

Under Section 4.8, its procedures must enable it to "decide, based on the results of its assessment of the clinical evaluation and risk management, whether the post-market surveillance plan, including the PMCF plan, is adequate". For the assessment of the technical documentation under Annex IX Section 4, which covers class III devices among others, Section 4.6 lists, among the points to be considered when verifying the clinical evaluation, the benefit-risk determination, the risk management, the instructions for use, the user training and the post-market surveillance plan.

Even where the manufacturer considers demonstration of conformity based on clinical data under Article 61(10) MDR not appropriate, risk management plays an essential role. Where demonstrating conformity on the basis of clinical data is not deemed appropriate, Article 61(10) requires an adequate justification "based on the results of the manufacturer's risk management", given in the technical documentation.

In our reading, this produces five transitions at which a file has to be traceable:

1. Plan to hazard: the risk management plan for each device (MDR Annex I Section 3 a) sets out, among other things, the planned risk management activities and the criteria and methods for risk evaluation (EN ISO 14971:2019, Section 4.4).
2. Hazard to risk: for identified hazards (3 b), the relevant hazardous situations and possible harms are determined, and the resulting risks are estimated and evaluated, including for reasonably foreseeable misuse (3 c).
3. Risk to measure: the measure follows the priorities set in Section 4. Where a file starts with warnings, it should show why design and protection measures were not an option.
4. Measure to residual risk: under Section 4, risk management aims to ensure that the residual risk for each hazard and the overall residual risk are judged acceptable, and both are weighed against the benefit (Sections 1 and 8). Under EN ISO 14971:2019 Section 8, the evaluation of the overall residual risk has to be carried out and documented as a separate step in the risk management process.
5. Residual risk to information: residual risks that must be communicated appear as limitations, contraindications, precautions or warnings in the information supplied by the manufacturer (Annex I Section 23.1(g)) and in the instructions for use (23.4(g)).

The file after placing on the market

Points (e) and (f) of Section 3 turn the file into a document that is never finished. The regulation links it to field data through three instruments.

PMS plan. Under Article 83(3)(a) MDR, post-market surveillance data are used "to update the benefit-risk determination and to improve the risk management". Annex III Section 1(b) requires the PMS plan to contain "suitable indicators and threshold values" for the continuous reassessment of the benefit-risk analysis and of the risk management.

PMCF. Under Annex XIV Part B Section 6.2(d), the PMCF plan contains a reference to the risk management, and under Section 8 the conclusions of the PMCF evaluation report are taken into account in the risk management. The templates MDCG 2020-7 (Section D) and MDCG 2020-8 (Section E) put this into practice: the plan names the risk management file with date and version, and the report records what is to be entered in the updated file.

PSUR. Under Article 86(1), manufacturers of class IIa, IIb and III devices summarize, among other things, the conclusions of the benefit-risk determination in the periodic safety update report, at least annually for class IIb and III and at least every two years for class IIa.

Practical example. A medical electrical device can cause burns if it overheats.

• Risk analysis identifies the corresponding hazardous situation and evaluates the risk.
• Risk control starts with design measures, for example a temperature limit.
• The remaining risk is evaluated and, where necessary, addressed through appropriate information for safety.
• The risk feeds into the evaluation of the overall residual risk.
• Findings from complaints or other PMS data are then reviewed for their impact on the risk evaluation and the effectiveness of the measures.

Three questions for next week

Three points in your own file can be checked without much effort. The selection is ours:

• Can any hazard be followed without gaps, from the plan through the measure to the residual risk, and is the evaluation of the overall residual risk documented in the file as a separate step (EN ISO 14971:2019 Section 8)?
• Do the indicators and threshold values of the PMS plan point to specific risks in the file, so that it is clear which value triggers which reassessment?
• Does the PMCF plan name the file with date and version, and does the latest PMCF report state what flowed back into the file?

We support building the system in Risk Management. The interface with clinical evaluation sits in Clinical Evaluation, the feedback from the field in Post-Market Surveillance.