The risk management file is the set of records your ISO 14971 process produces for a device. ISO 14971:2019 calls for it in clause 4.5. It holds the plan, the analysis, the controls, the verification and the residual-risk decisions, and it has to let a reader follow each risk from start to finish. Under the EU Medical Device Regulation (MDR, 2017/745), the file is how you show that you comply with Article 10(2): "Manufacturers shall establish, document, implement and maintain a system for risk management as described in Section 3 of Annex I" (MDR, EUR-Lex).
A notified body does not look at the file on its own. Annex II §5 requires the technical documentation to contain the benefit-risk analysis and the solutions adopted and results of risk management. Annex IX 4.6 (for devices assessed under Annex IX) then has the notified body assess the technical documentation, including whether the benefit-risk determination is adequate. In practice, your risk file is read next to your clinical evaluation, your instructions for use (IFU) and your post-market surveillance (PMS) plan, and the reviewer checks whether they agree.
This guide is for manufacturers and regulatory teams preparing MDR technical documentation. It covers the current version of the standard, a document-by-document checklist, the checks reviewers apply, a worked trace table and the points where the MDR asks for more than the standard. For where risk management sits in the wider project, see our overview of the MDR compliance process.
Photographs in this article are illustrative and AI-generated; the diagram is an original MEGACERT graphic.
Key takeaways
- Current version: ISO 14971:2019 is still current; ISO confirmed it on 7 March 2025. In the EU, EN ISO 14971:2019+A11:2021 is harmonised under the MDR by Implementing Decision (EU) 2022/757.
- Guidance is changing: ISO/TR 24971:2020 moved to the "to be revised" stage on 6 July 2026 and will be replaced by ISO/AWI TS 24971-1.
- The file is assessed as part of the technical documentation (MDR Annex II §5, Annex IX 4.6), not as a standalone report.
- Reviewers check consistency: intended purpose, risk analysis, clinical evaluation, IFU and PMS should tell the same story, and each risk should link to GSPRs and verification evidence.
- The MDR adds its own wording: risks must be reduced "as far as possible" (AFAP), controls follow the Annex I §4 priority order, and users must be told about residual risks.
- The file is never finished: PMS data must feed back into risk management through defined indicators and thresholds (Annex III 1.1(b), Article 83).
What is the latest version of ISO 14971?
The latest version is ISO 14971:2019, Medical devices: Application of risk management to medical devices, the third edition, published in December 2019. ISO reviewed it and confirmed it on 7 March 2025, and the catalogue lists no amendment or revision in progress (ISO 14971:2019).
For the EU market, the version that matters is EN ISO 14971:2019+A11:2021. CEN published amendment A11 in December 2021. It adds the European Z annexes and does not change the normative part of the standard (ISO/TC 210 news, 10 June 2022). Commission Implementing Decision (EU) 2022/757 of 11 May 2022 added it to the list of harmonised standards under the MDR by amending Decision (EU) 2021/1182 (EUR-Lex; European Commission, harmonised standards for medical devices).
The companion guidance is moving. ISO/TR 24971:2020, the guidance on applying ISO 14971, reached the "to be revised" stage on 6 July 2026. It is to be replaced by ISO/AWI TS 24971-1 (Part 1: General), registered the same day (ISO/TR 24971:2020; ISO/AWI TS 24971-1). The standard itself is unchanged. When the new guidance is published, check whether it changes how you document your process.
What goes into the risk management file?
The file holds the outputs of every step of the ISO 14971 process. It does not have to be one document. It can be a set of controlled records tied together by an index or a trace matrix. What matters is that a reviewer can find each output and follow the links between them.
The table maps each typical record to its ISO 14971:2019 clause and the MDR requirement it supports. Clause titles are paraphrased.
| Document or record | ISO 14971:2019 clause | MDR link |
|---|---|---|
| Risk management policy and criteria for risk acceptability; management review records | 4.2 Management responsibilities | Annex I §1 and §2 (benefit-risk, AFAP) |
| Competence records of the people doing the risk work | 4.3 Competence of personnel | Article 10(2) (risk management system) |
| Risk management plan for each device | 4.4 Risk management plan | Annex I §3(a) |
| Intended use and reasonably foreseeable misuse | 5.2 | Annex I §3(c) |
| Characteristics related to safety | 5.3 | Annex I §3(b) |
| Hazard analysis: hazards, sequences of events, hazardous situations | 5.4 | Annex I §3(b) |
| Risk estimation (probability and severity) | 5.5 | Annex I §3(c) |
| Risk evaluation against the acceptability criteria | 6 Risk evaluation | Annex I §3(c), §1 |
| Risk control option analysis and implementation | 7.1, 7.2 | Annex I §3(d), §4 priority order |
| Verification of implementation and effectiveness of controls | 7.2 | Annex I §3(d); Annex II §5(b) |
| Residual risk evaluation | 7.3 | Annex I §4 (inform users of residual risks) |
| Benefit-risk analysis | 7.4 | Annex I §1 and §8; Annex II §5(a) |
| Risks arising from risk control measures | 7.5 | Annex I §3(d) |
| Completeness of risk control | 7.6 | Annex II §5(b) |
| Evaluation of overall residual risk | 8 | Annex I §1; Annex II §5 |
| Risk management review (report) | 9 | Annex II §5(b) |
| Production and post-production information and updates | 10 | Annex I §3(e) and (f); Article 83; Annex III |
Two links in this table need the most care, and both appear among the recurring problems DQS lists: files that are not linked to the GSPRs, and files that are not linked to PMS. The first is between the hazard analysis and the GSPR checklist: each general safety and performance requirement that addresses a risk should point to the risk records that cover it. The second is between clause 10 and your PMS system, which we cover below. Our guide to MDR compliance documents shows where the risk file sits among the other technical documentation.
What notified bodies look for
Reviewers judge the file by whether it supports the benefit-risk determination that Annex IX 4.6 asks them to assess (for devices assessed under Annex IX). Team-NB sets out expectations for MDR technical documentation in its Best Practice Guidance, version 4, dated 21 April 2026 (Team-NB BPG V4). DQS summarised practical lessons from that revision in July 2026 (DQS blog, 29 July 2026).
The checks below come from those documents and the MDR text. Read them as questions a reviewer is likely to ask, not as audit statistics.
### Acceptability needs a justification, not just a score
DQS notes that risk acceptability should not rest only on a risk priority number (RPN). An RPN, typically the product of ratings in a failure mode and effects analysis (FMEA), hides what drives it: a rare but catastrophic harm can score the same as a frequent minor one. Reviewers expect to see the acceptability criteria from your risk policy applied to each risk, with reasoning, and a benefit-risk argument where a risk stays high.
### Does every document tell the same story?
DQS lists misalignment between the device description, the intended purpose and the risk analysis as a recurring problem. Reviewers cross-read. If the IFU names a patient population that the risk analysis never considered, or the clinical evaluation reports a side effect missing from the hazard list, the file looks incomplete. Check these five sources against each other before submission:
- Intended purpose and device description
- Risk analysis, including reasonably foreseeable misuse
- Clinical evaluation and its list of risks and side effects
- IFU and labelling: warnings, precautions, contra-indications
- PMS plan and its indicators
The risk class also has to match. Our guide to medical device classification explains how the classification rules depend on the same intended purpose.
### The file should be linked, not fragmented
DQS also flags fragmentation: risk files that stand apart from the GSPR checklist, verification and validation (V&V), clinical evaluation and PMS. A reviewer should be able to start at a GSPR, find the risks it addresses, open the control measure and land on a test report ID. Unique IDs for hazards, controls and evidence, used the same way in every document, make that possible.
### Are residual risks disclosed to users?
Reviewers check that residual risks are disclosed to users in the IFU or labelling, because Annex I §4 says: "Manufacturers shall inform users of any residual risks." A residual risk that exists only inside the risk file fails that check.
### Does PMS feed back into the file?
Article 83(3)(a) says PMS data are used "to update the benefit-risk determination and to improve the risk management as referred to in Chapter I of Annex I." Annex III 1.1(b) requires the PMS plan to set indicators and threshold values for continuously reassessing benefit-risk and risk management. Reviewers look for that loop: named indicators linked to specific risks, thresholds that trigger a review, and evidence that the file was updated when new data arrived.
### The risk policy should use the MDR's wording
Annex I §2 defines risk reduction "as far as possible" (AFAP). A risk policy written around ALARP ("as low as reasonably practicable"), or, as we read Annex I §2, one that accepts risks on cost grounds, does not match the MDR. Reviewers read the policy, so align its wording with Annex I §2.
Example trace table: an infusion pump
The table below shows how one chain of records can run from hazard to post-market indicator. It is a hypothetical example for a volumetric infusion pump. The probability and severity ratings use an illustrative qualitative scale, and the evidence and IFU references are made up. Your own scale comes from your risk policy.
| Hazard | Sequence of events | Hazardous situation | Harm | Probability / severity (before control) | Risk control (Annex I §4 tier) | Verification evidence ID | Probability / severity (after control) | Residual risk | IFU / label reference | PMS indicator |
|---|---|---|---|---|---|---|---|---|---|---|
| Drug delivered without rate control (free flow) | User opens the door and removes the set while the line is still open | Patient receives the drug at an uncontrolled rate | Overdose | Occasional / critical | Anti-free-flow clamp built into the set (a: safe design) | VER-012 clamp test report | Improbable / critical | Acceptable after control; disclosed | IFU 5.2 loading steps | Complaints mentioning free flow, trended against the PMS plan threshold |
| Air in the fluid line | Container runs empty or the set is not primed | Air delivered into the vein | Air embolism | Remote / critical | Air-in-line detector that stops the pump and sounds an alarm (b: protection measure with alarm) | VER-027 detector sensitivity test | Improbable / critical | Acceptable after control; disclosed | IFU 4.3 priming; warning on alarm response | Air-in-line alarm reports and related complaints |
| Drug delivered above the prescribed dose | User enters a rate far above the prescribed one (use error) | Patient receives the infusion at an excessive rate | Overdose | Occasional / critical | Rate limits with confirmation screen (a), plus warning and user training (c: information for safety) | VAL-004 usability validation report | Remote / critical | Acceptable after control; disclosed | IFU 3.1 warning; training material | Programming-error complaints and vigilance reports |
Note the third row. Foreseeable use errors belong in the hazard analysis; Annex I §3(c) requires risks to be estimated for intended use and reasonably foreseeable misuse. The control combines a design measure with information for safety. The warning supports the design; it does not replace it, which matches the Annex I §4 order.
MDR-specific points the standard alone does not cover
ISO 14971 is a process standard used around the world. The MDR adds specific legal wording on top of it. Where the two differ, the MDR requirements apply. Annex ZA of EN ISO 14971:2019+A11:2021 relates the standard to the MDR's general safety and performance requirements, and, as we read it, it replaced the "content deviations" of the 2012 European edition with that mapping. Check the Annex ZA text in your purchased copy rather than relying on summaries.
### Reduce risks as far as possible
Annex I §2 reads: "The requirement in this Annex to reduce risks as far as possible means the reduction of risks as far as possible without adversely affecting the benefit-risk ratio." The test is the benefit-risk ratio, not economic practicability. If you stop reducing a risk, the file should explain why further reduction would harm the benefit-risk ratio.
### Follow the Annex I §4 priority order
Annex I §4 sets an order for risk control:
- Eliminate or reduce risks as far as possible through safe design and manufacture.
- Where appropriate, take adequate protection measures, including alarms if necessary.
- Provide information for safety (warnings, precautions, contra-indications) and, where appropriate, training.
Record the tier for each control, as in the trace table above. A reviewer who sees a warning as the only control for a serious risk will ask why design or protection measures were not possible.
### Tell users about residual risks
The same section requires manufacturers to inform users of any residual risks. Link each disclosed residual risk to the exact IFU or label section, so the reviewer can confirm it without searching.
### Show the benefit-risk balance
Annex I §1 requires that risks be acceptable when weighed against the benefits to the patient, compatible with a high level of protection of health and safety, and in line with the state of the art. Annex II §5(a) puts the benefit-risk analysis in the technical documentation. Your overall residual risk evaluation (clause 8) and your clinical evaluation should reach the same conclusion from the same evidence.
### Keep the process continuous
Annex I §3 describes risk management as "a continuous iterative process throughout the entire lifecycle of a device, requiring regular systematic updating." It also requires you to evaluate information from production and PMS and to amend control measures if necessary. A file whose last update predates your latest PMS findings will raise questions.
Frequently asked questions
What is the difference between ISO 13485 and ISO 14971?
ISO 13485:2016 is the quality management system standard for medical devices; ISO confirmed it on 31 October 2025 (ISO 13485:2016). Clause 7.1 requires documented risk management processes in product realization. ISO 14971 describes that risk management process itself. In short, ISO 13485 says you need risk management in your quality system, and ISO 14971 says how to do it. Our guide on what ISO 13485 is covers the quality system side.
Is ISO 14971 harmonised under the MDR?
Yes. EN ISO 14971:2019+A11:2021 was added to the MDR harmonised standards list by Commission Implementing Decision (EU) 2022/757, published in the Official Journal on 17 May 2022 (EUR-Lex). Where the standard and the MDR differ, the MDR requirements apply.
How often should the risk management file be updated?
Annex I §3 does not set a calendar interval. It requires "regular systematic updating" throughout the device lifecycle. In practice, update the file whenever new information changes a risk: design changes, complaints, vigilance reports, PMS findings that cross a threshold, or new state-of-the-art information. Article 83 and Annex III 1.1(b) expect your PMS plan to define the indicators and thresholds that trigger those reviews.
Can I download ISO 14971 as a free PDF?
Not legally. ISO 14971 is copyrighted. ISO sells the international edition. The EN ISO edition is sold by the national standards bodies that are CEN members. Avoid free PDFs found online: you cannot confirm that they are authorised or current. The MDR itself is free on EUR-Lex. !Hands flipping through a thick technical file binder with coloured tabs, a laptop showing a risk matrix behind it Illustrative image, AI-generated.
Next steps
Before submission, cross-read the file against your intended purpose, clinical evaluation, IFU and PMS plan, confirm each control has a tier and a verification ID, and check that the risk policy uses AFAP wording. For the full list of documents a technical file needs, see MDR compliance documents. If you want a second pair of eyes on your risk file before it goes to your notified body, contact us (page in Turkish).
Sources
- ISO 14971:2019, Medical devices: Application of risk management to medical devices, ISO catalogue entry (confirmed 2025); accessed 23 October 2026.
- ISO/TC 210, Recognition of EN ISO 14971 as a harmonised standard, 10 June 2022; accessed 23 October 2026. Scope of amendment A11.
- Commission Implementing Decision (EU) 2022/757, OJ L 138, 17.5.2022; accessed 23 October 2026.
- European Commission, harmonised standards for medical devices; accessed 23 October 2026.
- ISO/TR 24971:2020, Guidance on the application of ISO 14971, ISO catalogue entry ("to be revised" 2026); accessed 23 October 2026.
- ISO/AWI TS 24971-1, Part 1: General, ISO catalogue entry (registered 2026); accessed 23 October 2026.
- ISO 13485:2016, Medical devices: Quality management systems, ISO catalogue entry (confirmed 2025); accessed 23 October 2026.
- Regulation (EU) 2017/745 (MDR), consolidated text of 10.01.2025. Articles 10 and 83, Annexes I, II, III and IX; accessed 23 October 2026.
- Team-NB, Best Practice Guidance for the submission of technical documentation under the MDR, V4, 21 April 2026; accessed 23 October 2026.
- DQS, Improving MDR technical documentation: practical lessons from new Team-NB guidance revision, 29 July 2026; accessed 23 October 2026. Secondary source for reviewer expectations.
About the author
Ersin Çetin is an MDR / CE Marking Consultant at MEGACERT, advising medical device manufacturers on technical documentation, MDR compliance and EU market entry. That advice draws on a background in food engineering and more than 25 years as a lead auditor, including for ISO 9001, ISO 14001, ISO 22000, ISO 45001, ISO 50001, ISO/IEC 27001 and ISO 14064. Reviewed by Eren İşman, a mechanical engineer and lead auditor with more than 25 years of experience. Eren İşman is a MEGACERT employee, so this is an internal review. Photographs in this article are illustrative and AI-generated. Last updated: 24 October 2026. This article reflects EU legislation, ISO catalogue entries and the guidance listed above as of 23 October 2026; it does not reproduce the text of ISO 14971. MEGACERT is a consultancy: it is not a notified body and does not issue CE certificates or assess conformity. For help preparing your risk management file, contact us (page in Turkish).
Editorial standards: we cite EU legislation, ISO catalogue entries and notified body guidance directly and date every source. If you find an error, tell us through the contact page (page in Turkish) and we will correct it.