ISO/TC 210/JWG 1 - Joint ISO/TC 210-IEC/SC 62A WG : Application of risk management to medical devices

This document provides guidance on the development, implementation and maintenance of a risk management system for medical devices according to ISO 14971:2019. The risk management process can be part of a quality management system, for example one that is based on ISO 13485:2016[24], but this is not required by ISO 14971:2019. Some requirements in ISO 13485:2016 (Clause 7 on product realization and 8.2.1 on feedback during monitoring and measurement) are related to risk management and can be fulfilled by applying ISO 14971:2019. See also the ISO Handbook: ISO 13485:2016 — Medical devices — A practical guide[25].

This document specifies terminology, principles and a process for risk management of medical devices, including software as a medical device and in vitro diagnostic medical devices. The process described in this document intends to assist manufacturers of medical devices to identify the hazards associated with the medical device, to estimate and evaluate the associated risks, to control these risks, and to monitor the effectiveness of the controls. The requirements of this document are applicable to all phases of the life cycle of a medical device. The process described in this document applies to risks associated with a medical device, such as risks related to biocompatibility, data and systems security, electricity, moving parts, radiation, and usability. The process described in this document can also be applied to products that are not necessarily medical devices in some jurisdictions and can also be used by others involved in the medical device life cycle. This document does not apply to: — decisions on the use of a medical device in the context of any particular clinical procedure; or — business risk management. This document requires manufacturers to establish objective criteria for risk acceptability but does not specify acceptable risk levels. Risk management can be an integral part of a quality management system. However, this document does not require the manufacturer to have a quality management system in place. NOTE Guidance on the application of this document can be found in ISO/TR 24971[9].

This document provides requirements and recommendations to writers of medical device standards on the inclusion of aspects related to safety in International Standards, based on well-established risk management concepts and methodology. This document is applicable to any aspect related to the safety of people, property, the environment, or a combination of these. In this document, the term "product" includes a medical device or a system consisting of one or more medical devices, possibly combined with non-medical devices.

ISO 14971:2007 specifies a process for a manufacturer to identify the hazards associated with medical devices, including in vitro diagnostic (IVD) medical devices, to estimate and evaluate the associated risks, to control these risks, and to monitor the effectiveness of the controls. The requirements of ISO 14971:2007 are applicable to all stages of the life-cycle of a medical device.

ISO/TR 14969:2004 provides guidance for the application of the requirements for quality management systems contained in ISO 13485. It does not add to, or otherwise change, the requirements of ISO 13485. It does not include requirements to be used as the basis of regulatory inspection or certification assessment activities. This guidance can be used to better understand the requirements of ISO 13485 and to illustrate some of the variety of methods and approaches available for meeting the requirements of ISO 13485.

ISO 13485:2003 specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer requirements and regulatory requirements applicable to medical devices and related services. The primary objective of ISO 13485:2003 is to facilitate harmonized medical device regulatory requirements for quality management systems. As a result, it includes some particular requirements for medical devices and excludes some of the requirements of ISO 9001 that are not appropriate as regulatory requirements. Because of these exclusions, organizations whose quality management systems conform to this International Standard cannot claim conformity to ISO 9001 unless their quality management systems conform to all the requirements of ISO 9001. All requirements of ISO 13485:2003 are specific to organizations providing medical devices, regardless of the type or size of the organization. If regulatory requirements permit exclusions of design and development controls, this can be used as a justification for their exclusion from the quality management system. These regulations can provide alternative arrangements that are to be addressed in the quality management system. It is the responsibility of the organization to ensure that claims of conformity with ISO 13485:2003 reflect exclusion of design and development controls. If any requirement(s) in Clause 7 of ISO 13485:2003 is(are) not applicable due to the nature of the medical device(s) for which the quality management system is applied, the organization does not need to include such a requirement(s) in its quality management system. The processes required by ISO 13485:2003, which are applicable to the medical device(s), but which are not performed by the organization, are the responsibility of the organization and are accounted for in the organization's quality management system.