Back in June, it was reported by TC 210, the committee responsible for medical device standards such as ISO 14971 and ISO 13485, that the European standard EN ISO 14971:2019 with its amendment A11:2021 had finally been cited in the Official Journal of the European Union (OJEU) as a harmonized standard in support of the European regulations (EU) 2017/745 for medical devices and (EU) 2017/746 for in vitro diagnostic medical devices. The citations were made public by Commission Implementing Decisions 2022/757 for MDR and 2022/729 for IVDR, both published in May 2022.

For those not familiar with the standard, according to its own introduction, ISO 14971 contains the requirements to provide manufacturers with a framework to systematically manage risks associated with medical devices based on established principles of risk management that have evolved over many years, and is meant to be used as guidance in the processes of managing risks, wither they are related to injury of patients, users, or other persons, or risks related to damage to property or environment.  

(EN) ISO 14971 provides terminology, principles, and a process for applying risk management to medical devices and in 2019 it had been updated to align with changes in several regulations worldwide with an increased focus on benefits for the patient and on the balance between those benefits and the residual risks. While it is the author’s opinion that the medical device industry has a lot to learn about risk management from standards developed by AIAG & VDA for DFMEA/PFMEA for the automotive industry, this standard is often lauded as the definitive standard for risk management and the only tool that is needed in the industry to build a robust framework for risk management.  Indeed, the standard, according to TC 210, provides a complete process for the identification, assessment, control, and monitoring of all risks associated with medical devices.

The amendment A11 is specific for the EU; it adds Annexes Z that provide information about which parts of the legislation are addressed by the standard, but, of note, Amendment A11 does NOT modify the normative part of the referenced ISO 14971.  Harmonization and citation in the OJEU confirm that the risk management process of EN ISO 14971 represents the generally acknowledged state of the art and it will likely provide peace of mind to medical device manufacturers that the standard can be used to demonstrate compliance with the risk management requirements of MDR and IVDR, which, I suppose, is the most important aspect of this news.  Even if the standard itself is not prescriptive enough to truly lead manufacturer’s to build effective risk management programs, it will at least provide them with enough to claim global regulatory compliance.