ISO 14971 Risk Management for Medical Devices: A Practical Overview

ISO 14971 is the international standard specifying terminology, principles, and a process for risk management of medical devices, including software as a medical device. Source

ISO/TS 24971 provides supporting guidance on applying ISO 14971 in practice, including specific considerations for software and for AI/ML-enabled devices as that guidance has been updated. Source

Risk management as a lifecycle activity

ISO 14971 frames risk management as continuing across the device’s entire lifecycle — from initial design through post-market surveillance — rather than as a single risk analysis performed once before launch and then filed away.

Core elements of the process

• Risk analysis: identifying hazards and estimating the associated risk for each.
• Risk evaluation: deciding whether each identified risk is acceptable.
• Risk control: implementing measures to reduce unacceptable risk, then verifying those measures actually work.
• Evaluation of overall residual risk, after individual controls are in place.
• Production and post-production information: feeding real-world data back into the risk file.

What AI/ML adds to the risk picture

An AI/ML-enabled device can change its behavior after deployment — through retraining, model updates, or drift in the real-world data it encounters — in ways a traditional fixed-logic device cannot. That means the risk file needs an ongoing answer to how post-market changes in model behavior are detected and fed back into risk management, not only a pre-market risk analysis.

Questions to ask about a device risk file

• Is the risk management file treated as a living document, updated with post-market data, or as a one-time deliverable?
• For an AI/ML component, how would we detect a shift in its real-world performance after launch?
• Are risk controls verified to actually reduce the risk, not just documented as implemented?
• Does the residual risk evaluation consider the device as a whole system, not just its individual components?