An investigation of the current status quo of ISO 14971 risk management challenges in the medical device industry

Medical devices are amongst the most regulated products in the world. Medical device regulations aim to protect patients and users by ensuring device safety, performance and efficacy (Daryanani et al., 2025). However, in recent years, reports of critical device failures involving heart valves, breast implants, hip prostheses and heart simulators have raised questions about the effectiveness of regulatory frameworks in minimizing risk (Greco, 2015).

However, despite these strict global regulations for medical devices, the United States Food and Drug Administration (FDA) announced in 2023 that its most serious device recalls, or class I recalls, were at an all-time high (See et al., 2024). These recall issues may be partly attributed to the underestimation of risks during the design and manufacturing of these devices as well as to notified bodies certifying and approving devices, primarily due to their lack of product knowledge and experience (McDermott and Kearney, 2024).

Patient and user safety requirements means that manufacturers must establish a Quality Management System (QMS) with integrated risk management assurance processes (Linders, 2020). Adverse events associated with the use of medical devices be apparent until they are post market and in use. Therefore, estimating product safety risks is complex and subjective based on an individual's experience and perception of risk (Jakimovska et al., 2013).

The International Standard, ISO 14971, “Medical devices – Application of risk management to medical devices,” is a voluntary standard considered by regulatory authorities in the United States, Europe, Canada, Australia, Japan and others as the “official standard” for medical device risk management. Accordingly, regulatory agencies worldwide expect device manufacturers to apply its requirements to support approvals and manage product safety risks throughout the product lifecycle (Bills, 2021a; José, 2017).

EN ISO 14971+A11:2021 is the harmonized version of the standard. Once a standard is published in the Official Journal of the European Union (OJEU), it is recognized as harmonized, and representative of the state-of-the-art risk management standard for device approval in the EU, and compliance is expected. Amendment A11 is specific to the EU, as it adds annexes Z, which provides information on which parts of the EU MDR 2017/745 and the European Union's In Vitro Diagnostic Regulation (EU IVDR, 2017/746) are addressed by the standard (Bills, 2022).

Historically, the flexible process framework provided by ISO 14971 has been the subject of considerable controversy, largely due to diverging interpretations, as stakeholders in the MedTech industry (e.g. manufacturers, notified bodies, competent authorities) have struggled to implement the standard's requirements effectively (Flood et al., 2015).

This was particularly evident from the confusion in the industry caused by the “content deviations” between the now superseded harmonized European version of this standard and the Medical Device Directives (MDD), specifically EN ISO 14971:2012 (José, 2017). The Notified Bodies Recommendation Group (NBRG) responded to this confusion by issuing a position paper in October 2014 to better educate stakeholders on the interpretation of the “content deviations” contained in the “Z” annexes of EN ISO 14971:2012 (Notified Bodies Recommendation Group, 2014).

Effective medical device risk management presents numerous challenges, as evidenced by the increasing number of adverse events and recalls over nearly 2 decades. Nolan and McDermott (2025) found in their study on risk management practices in the MedTech industry that there is an opportunity to improve risk management expertise and competency. They found that MedTech companies are not providing adequate risk management training, and it can be challenging for small- and medium-sized enterprises (SMEs) to find clinical, functional support.

It has been stated that many MedTech companies may not be meeting the requirements of ISO 14971 correctly, as they misunderstand the terms and definitions therein, as well as the requirements, and are selective about what they do to comply (Bills, 2022; Caines et al., 2015; Nolan and McDermott, 2025).

There is limited literature addressing the practical challenges of implementing ISO 14971 risk management for medical devices (Kirkire et al., 2015; Onofrio et al., 2015; Xavier et al., 2025).

Thus, this study aims to investigate the current challenges associated with risk management implementation in the medical device industry, both generally and specifically in the context of ISO 14971 and compliance with the EU MDR 2017/745 for medical devices intended for marketing in Europe. This study will be the first of its kind in the literature to assessing the challenges of risk management (RM) implementation under the standard. The specific research questions (RQs) for the study are:

1. What are the main challenges concerning the implementation of ISO 14971:2019 and concerning EU MDR 2017/745?

2. What suggested changes and recommendations to ISO 14971 compliance and the standard in general are recommended by MedTech stakeholders to better assist with implementation?

Section 2 outlines the literature review, Section 3 outlines the methodology deployed and Section 4 elucidates the results. Finally, Sections 5 and 6 discuss the results and conclusion.

ISO 14971 provides a holistic process integrated throughout the entire product lifecycle. It is not an explicit requirement of the standard that a QMS needs to be established to embed risk management requirements (ISO, 2019). However, Annex I General Safety and Performance Requirements (GSPRs) of the EU MDR and IVDR regulations, require risk management requirements to be implemented as part of a QMS (Jos van Vroonhoven, 2022).

To market a medical device in the United States (US), device manufacturers must demonstrate compliance with the Code of Federal Regulations (CFR) Title 21, part 820 of the Quality System Regulation (QSR) to support that the medical device is safe and effective for its intended use (José, 2017). FDA is transitioning from the QSR to the Quality Management System Regulation (QMSR) which is a revision of 21 CFR part 820 incorporating by reference the QMS requirements of ISO 13485:2016 (Food and Drug Administration, 2025a). This shift places more emphasis on integrating risk management activities as part of a QMS compared to the QSR, where “Risk Analysis” is included as an explicit requirement as part of Design Controls Design Validation requirement per 21 CFR 820.30(g) only (Bills et al., 2024).

ISO 14971:2019 is a recognized voluntary consensus standard (Recognition Number 5–125, 23-December- 2019) in the US by the FDA (Food and Drug Administration, 2025b), and therefore may be used to support premarket submissions to facilitate device approvals (Food and Drug Administration, 2018).

Additionally, any device manufacturers certified to the QMS standard for medical device manufacturers ISO 13485:2016 for market approval of their products must comply with the risk management requirements, and an explicit reference to ISO 14971 is included in sub-clause 7.1 (Planning of product realization) within this standard (BSI, 2021a).

Prior to the publication of ISO 14971, approaches to demonstrating device safety in regulatory submissions varied widely and lacked consistency (Elahi, 2021). Integrating risk management into the QMS is now considered best practice and the preferred approach (Elahi, 2021). ISO 14971 provides a flexible, non-prescriptive framework, allowing manufacturers to tailor their risk processes based on the medical device's intended use (ISO, 2019). However, establishing and integrating appropriate processes as part of the QMS remain challenging (Jovanoska et al., 2020; Sharma and Luthra, 2023). Ultimately, manufacturers are responsible for defining acceptable risk levels based on the device's intended use (Elahi, 2021).

Sharma and Luthra (2023) discuss the benefits of effective risk management offered by the application of ISO 14971, including enhanced patient safety, compliance with regulatory requirements, reduced liability and improved product quality.

A comparison of the key ISO 14971 revisions, risk management requirements per EU MDR 2017/745 and associated regulatory challenges and gaps found to be reported in the literature is presented per Table 1.

The revisions to the latest version of ISO 14971 were initiated during an ISO systematic review in 2016 and primarily focused on providing more guidance and clarification to the normative requirements for clauses on the evaluation of overall residual risk, risk management review and report, and production and post-production information (Krenc, 2018). The evolving global regulatory landscape and increased regulatory burden on manufacturers provided an opportunity to ensure better alignment of ISO 14971 with changing regulations, such as the EU MDR 2017/745 (Bills, 2022; Jovanoska et al., 2020). There was an increased focus on understanding the benefits based on the intended use of the medical device, and the process of completing the benefit–risk analysis and clarification of scope and cybersecurity risks (Bills, 2021a).

Key to the application of ISO 14971 is the correct and consistent interpretation and understanding of risk management terminology such as “hazard,” “hazardous situation” and “harm” often misinterpreted (Caines et al., 2015). New terms and definitions included in the 2019 version of the standard were “Benefit”, “Reasonably Foreseeable Misuse” and “State of the art” (Trevino, 2019).

The term “risk–benefit analysis” had previously been used in the first and second editions of the standard but regulators wanted emphasis placed on device manufacturers' understanding and ability to support the benefits of a medical device, hence the shift to the updated terminology of “benefit-risk analysis” (Bills, 2021a). The 2020 version of ISO/TR 24971, “Medical devices – Guidance on the application of ISO 14971”, now includes 2.5 pages of guidance for the requirements for completing a benefit–risk analysis.

While “Benefit” is a new term introduced in the 2019 version of ISO 14971, the term used in the Regulations is “Clinical Benefit.” There may also be situations where a term or definition is included per ISO 14971, for example, “State of the Art”, but is not defined in the Regulations. In this case, the definition per the standard may be used (Lafferty, 2021).

Many of the Informative Annexes previously contained as part of ISO 14971:2007 were restructured as part of the second edition of the associated Technical Report ISO/TR 24971, published in June 2020 (ISO, 2019). The process framework has not undergone significant modification since the standard's inception in 2000. Clarifications and more guidance have been provided in response to the systematic reviews completed (Stern et al., 2020).

The European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC) published EN ISO 14971:2019+A11:2021 in the Official Journal of the European Union (OJEU) on 17 May 2022 as a harmonized standard. It is the state-of-the-art standard for device approvals in the EU (European Commission, 2022).

Two informative annexes, Annex ZA and Annex ZB, are included. Annex ZA documents the relationship between this European standard and the GSPRs of the EU MDR 2017/745 and Annex ZB with the IVDR 2017/746. In Annex ZA, several explanatory notes associated with the application of ISO 14971 to comply with the requirements of EU MDR 2017/745 are summarized (BSI, 2021b).

The EU MDR 2017/745 GSPRs require that manufacturers comply with their risk acceptability; that risks have to be “reduced as far as possible” (AFAP), “reduced to the lowest possible level”, “reduced as far as possible and appropriate”, “removed or reduced as far as possible”, “eliminated or reduced as far as possible”, “removed or minimized as far as possible”, or “minimized”, according to the wording of the corresponding GSPR” (BSI, 2021b).

GSPR 2, which Annex ZA does not cover with respect to Table ZA.1, states the following:

“The requirement in this Annex to reduce risks as far as possible means the reduction of risks as far as possible without adversely affecting the benefit–risk ratio” (EUR-Lex, 2017). The requirement of GSPR 2 is stricter than the standard. However, as there are several variations of terms per NOTE 1, this may confuse manufacturers regarding the policy for determining the criteria for risk acceptability (Bills, 2022).

GSPRs 3, 4, 5 and 8 are listed in Table ZA.1 of Annex ZA accompanied by the following statement: “Covered with respect to the process requirements. Device-specific execution of the process is not covered” (BSI, 2021b). This implies that device manufacturers must apply exactly the requirements stipulated by the referenced clause(s) or subclause(s) of the standard to satisfy the GSPR requirement and have the necessary product records available as objective evidence of compliance (BSI, 2021b). GSPR 9, which relates to products without a medical purpose, is listed as being covered “provided that the criteria for risk acceptability are established in accordance with GSPR 9” (BSI, 2021b). GSPR 1 includes requirements related to Performance and Safety, demonstrating that the benefits outweigh the risks, the need for a high level of protection of health and safety and taking into account the generally acknowledged state of the art. GSPR 2 requires the reduction of risk as far as possible (AFAP) without adversely affecting the benefit–risk ratio. GSPR 6 includes requirements for the characteristics and device performance during the lifetime of the device to not be adversely impacted to such a degree that the health or safety of a patient or user would be compromised when under the stresses of “normal conditions of use.” GSPR 7 relates to risks associated with device packaging, transportation and storage (Lafferty, 2021).

The regulations' requirements related to risk and risk management are stricter and contain increased requirements compared to ISO 14971. However, the Z Annexes of EN ISO 14971:2019+A11:2021 do not acknowledge any wording differences (Lafferty, 2021).

For example, the term “benefit–risk ratio” referenced in EU MDR 2017/745 seems to imply the calculation of a numerical value based on the word “ratio.” However, Elahi (2021) asserts that the word “ratio” as part of this definition is not intended to be “interpreted as arithmetic.” Freyer et al. (2025) findings from a systematic review of benefit–risk analysis methodologies of medical devices, identified 16 methods, most of which are quantitative, such as multi-criteria decision analysis (MCDA) and probabilistic modelling, but also include qualitative and semi-quantitative approaches. This diversity highlights regulatory flexibility but also leads to variability and uncertainty in meeting benefit–risk requirements.

FDA has published four guidance documents on benefit–risk using qualitative examples, which further supports a non-arithmetic interpretation (Bills, 2021a).

There are sparse empirical studies related to ISO 14971 and Medical device Risk management. Many authors have written about the standard, particularly the 2019 revision and its requirements, but these are more discussions of the standard (Gübitz and Klinger, 2023). Knag Il Kyu (2022) presented a study of ISO 14971:2019 and how it might be applied to meet PMS requirements. Some studies have demonstrated case studies in how ISO 14971:2019 was adhered to in the approval of new devices, e.g. an EEG monitor (Yakymets et al., 2023) whilst others have referred to the use of risk tools to comply with ISO 14971:2019 (Hyun Joon et al., 2023). Nolan and McDermott (2025) carried out a qualitative study investigating best practices in risk management tool use and application in the medical device industry and tool limitations in meeting ISO 14971:2019 risk identification requirements. However, no peer-reviewed literature has investigated the challenges of ISO 14971:2019 compliance, especially in the context of the new MDR and IVDR, using industry stakeholders to obtain the voice of the sector.

A qualitative study embedded in grounded theory was utilized to address the research questions. Grounded theory, as an inductive approach, aided in drawing conclusions and real-world examples from the qualitative interviewees' experiences and interview findings using memoing and coding described below (Achora and Matua, 2016). Qualitative interviews meant accessing a rich source of opinions, experience and knowledge from the interviewee group who are experts in risk management (in the area, sector and across different stakeholders) (Altheide and Johnson, 1994). As the scope of this research was focused on Risk Management practitioner's experiences and challenges with the application of ISO 14971, and exploratory in nature, therefore, qualitative interviews were deemed appropriate (O'Brien et al., 2014).

Purposive sampling was used to identify interviewees (Tongco, 2007). Interviewees were selected from the authors' network, from LinkedIn, the world's biggest professional networking site. Participants were selected based on their expertise in risk management regulations and ISO 14971, meeting criteria such as (1) Extensive practical knowledge of the application of risk management requirements, (2) Senior roles (Manager/Director level) with over ten years' experience and (3) Representation across diverse roles, including consultants, notified bodies and members of ISO Technical Committee (TC) 210 Joint Working Group (JWG) 1. Notably, two participants were directly involved in authoring the ISO 14971 standard. The study captured global perspectives through participants based in Ireland, the United Kingdom (UK) and the United States (US). Table 2 includes details of the participant roles, organization type and geographical location.

Qualitative research applies the sampling concept of data saturation or redundancy, which is regarded as the “gold standard” and implies that there is “no new data”, “no new themes” and “no new codes.” Boddy (2016) and Vasileiou et al. (2018) agree with the concept of data saturation in qualitative research and propose that practical research demonstrates that samples of 12 may be cases where data saturation is reached among a relatively homogeneous population. Therefore, as a purposive sampling method was applied for the selection of interview participants, the data were considered saturated after the 10th interview was conducted as no new findings emerged from the interviews (Creswell and Poth, 2024; Patton, 2015).

The questions were designed to answer the research questions:(1) What are the main challenges concerning the implementation of ISO 14971:2019 and concerning EU MDR 2017/745? (2) What suggested changes and recommendations to ISO 14971 compliance and the standard in general are recommended by MedTech stakeholders to better assist with implementation?

The interview questions were informed by the gaps that emerged as part of the literature review per section 2. To ensure that a robust interview guide was created, two risk management professionals completed a pilot or review of the proposed interview guide questions in advance of conducting the actual interviews (Ball, 2019). Based on their feedback, the questions were revised as required before scheduling and conducting the interviews. The interview questions are outlined in Table 3.

Ethical practices were adhered to during the conduct of the interviews, considering confidentiality, informed consent and anonymity (Adhabi and Anozie, 2017). All interviews were completed and recorded online using Microsoft Teams, with an average duration of 60 min. Consent was obtained to record the interviews for the purposes of enabling the researchers to provide an accurate summary of the interview. The purpose of the study was explained, along with the participants' right to anonymity and the option to withdraw from the study at any time. To preserve anonymity, all interviewees were given pseudonyms or participant numbers (Israel and Hay, 2006).

Once completed, the interviews were transcribed verbatim, and ATLAS.ti software was utilized to code the results into the different data themes and subthemes related to the questions. Memoing and coding were utilized to help understand the themes and ensure the correct means were derived from the data (Birks et al., 2008). Memoing is the act of recording reflective notes about what the researcher is learning from the data and is an important element of grounded theory (Cascio et al., 2019). Coding allows assigning of labels to data to help understand themes (Hruschka et al., 2004). “Open” coding was utilized initially assigning themes related to the research questions to comments or responses with the memoing comments. Axial coding then allowed the grouping or connection of different codes or themes and how they interact with each other. Selective coding then helped review the themes again and see the very top level themes emerging and their associations (Parameswaran et al., 2020). Subsequently, interrater reliability was measured by the researchers to ensure the consistency of theme coding, and it was found to be 0.93, which is very strong (Fleiss et al., 2003).

A detailed analysis of the 12 interviews resulted in the identification of four main themes.

Table 4 presents the relationship between the four main themes and their sub-themes, as well as the linkage to the research questions outlined in Section 1 (Introduction). Representative interview participant quotes are included to exemplify the theme.

The majority of interview participants stated that the main drivers for the 2019 version of ISO 14971 were “the alignment with the changing regulatory environment with respect to the Medical Device Regulations”. Also, “the elimination of the content deviations of EN ISO 14971:2012 caused much confusion in the medical device industry” in terms of the application of the standard. As all interviewees were experts and experienced in RM, they attended several advisory sessions both internally and externally on the updates and read regulatory website updates to ensure they were informed.

It was discussed that many of the existing Annexes (Informative) were restructured and revised as part of the associated guidance document, ISO/TR 24971, as the “authors wanted to have a faster way to update, recommendations, knowledge.” The reasons for the revision of the standard discussed by the interviewees aligned with the literature (Bills, 2018; Krenc, 2018).

The majority of interviewees agreed that there was a high level of awareness regarding the publication of the 2019 version of ISO 14971, particularly among device manufacturers focused on EU MDR and IVDR compliance. At the same time, three of the interview participants who were in consultant roles expressed a low level of awareness among their clients, who were SMEs and did not have mechanisms in place to monitor changes to standards. Therefore, the impact of a revised standard may not always be fully evaluated as part of ongoing Technical File maintenance.

Respondents talked about risk management being “reactive”. This implies that larger organizations stay abreast with regulatory compliance activities to ensure no issues with existing approved devices, while small- to medium-sized companies are primarily focused on device approval timelines.

All the medical device manufacturer organizations commented that a “gap analysis was completed to understand the changes between the 2007 and 2019 version of the standard”. It was discussed that the larger multinational companies addressed planning activities earlier as part of EU MDR activities.

One consultant discussed that the changes to the EN ISO 14971:2012 version of the standard, “where we lost as low as reasonably practical (ALARP),” were a much bigger change in comparison to the 2019 version, where “a lot of clarity is being added.”

Several of the interview participants discussed that initially, there was “a lot of confusion” regarding the version of ISO 14971 to follow to conform to the state of the art in the absence of a harmonized standard to EU MDR. For example, some Notified Bodies were asking for compliance with both EN ISO 14971:2012 and ISO 14971:2019. This confusion was attributed to the absence of a definition for what constitutes the “state of the art standard”; subsequently clarified with the publication of EN ISO 14971:2019+A11:2021.

The discussions revealed that the compliance status to the 2019 version of ISO 14971 was being questioned by Notified Bodies during surveillance audits from a high-level perspective confirming its reference in QMS Procedures and demonstrating that there was a transition plan in place and evaluation of the revised standard. It was commented that “they are starting with the subtle stuff where incorrect references may be in procedures” related to the Annexes. There is also an expectation from the Notified Bodies that there was an awareness of the change to the 2019 version of the standard included as part of Management Review Meetings. It was commented that “most auditing organizations will and have pushed for what the transition plan is and if that is in line with the 3-year requirement.”

From a Technical File review perspective, “A common question that is coming up relates to residual risk and communicating that to the users.” It was discussed that this is a focus area for several Notified Bodies, i.e. British Standards Institution (BSI), National Standards Authority of Ireland (NSAI) and TUV SUD.

From the perspective of the FDA, there has been no focus on compliance with the 2019 version, most likely attributed to the 3-year transition date at that time, which was up to the end of 2022. To meet the requirements of FDA's Quality System Regulation, “compliance to ISO 14971 is good practice, expected and state of the art, but it is not a legal regulatory requirement.”

Therefore, based on the interview participants' experience interacting with notified bodies and regulatory agencies such as the FDA, no depth of review of compliance with the standard requirements was challenged at the time of its transition.

Interview participants were asked to provide the areas of change that have already occurred or that they anticipate in the future, to present challenges with respect to ISO 14971:2019 compliance based on their own individual experiences.

The interview participants identified 13 different challenges; see Figure 1.

The challenges identified by the interview participants, per Figure 1, were aligned with the applicable clauses of ISO 14971 (Table 5).

The key challenges associated with these areas of risk management implementation were discussed as follows.

Post-market surveillance requirements and integration as part of the risk management system discussed that not all companies had addressed this as intended by ISO 14971, even to support the previous versions of the standard, and there is an increased focus on this area now. ISO 14971 requires that product safety risks be continuously monitored throughout the entire product lifecycle, from the perspective of ensuring state-of-the-art and review of changes to residual risks. However, the focus has been more on reactive mechanisms, such as complaint vigilance reporting, which is a regulatory requirement, not fully addressing the production and post-production monitoring requirements. It was discussed that the Technical Report ISO/TR 24971:2020 provides useful information regarding meeting post-market surveillance requirements.

The actual process of completing a benefit–risk analysis and “how you consolidate the residual risks to do an individual benefit–risk analysis and then overall benefit–risk analysis” to include all risks from the perspective of meeting ISO 14971:2019 requirements and the alignment with Regulation (EU) MDR 2017/745 was a challenge. The challenge arises because the individual residual risk must be considered in the context of the specific benefit it is related to, rather than the overall benefit of the device.

Several of the interviewees commented that the FDA has developed beneficial guidance documents regarding the process of completing a benefit–risk analysis.

In terms of risk acceptability criteria, the standard includes three approaches to risk control, “As low as reasonably practicable (ALARP), as low as reasonably achievable (ALARA) and as far as possible (AFAP).” However, for devices intended to be commercialized in Europe, manufacturers don't have a choice but to comply with the GSPRs of EU MDR, “all risks must be reduced as far as possible without adversely affecting the benefit–risk ratio.” One of the challenges discussed in this case pertains to the expectations from the Notified Bodies in terms of how to document this as part of the Risk Management Plan. Several interview participants commented that they had not seen anyone use either the ALARP or ALARA approaches for risk control. The more stringent requirements of the EU MDR appear to be adopted by device manufacturers to facilitate global market commercialization strategies.

The challenge that was discussed was related to the process of meeting the intent of the standard with respect to the disclosure of residual risks. It was commented that “I don't think anyone really knows how to do that correctly, I don't think it is clear. It ends up in the instructions for use, high-level statements.” One representative from a Notified Body provided his perspective with respect to caution on the method applied by reference to the current guidance document, “In ISO/TR 24971, they have pointed out that too many disclosures of residual risks mask more important ones.”

Interview participants commented on reasonably foreseeable misuse (sub-clause 5.2 of ISO 14971), which, while not a new requirement, now had a definition of this term and provided greater clarity with respect to how this is intended to be addressed as part of the risk analysis process.

This is linked to the Risk Management Plan (sub-clause 4.4, d), criteria for risk acceptability and the challenge related to this is being able to demonstrate “if you are effectively reducing a risk” and “when I reduce risk as far as possible, where is my endpoint?” While not a new requirement, as it was present in content deviations of EN ISO 14971:2012, but the lack of available guidance at the time confused (Notified Bodies Recommendation Group, 2014). It also emerged that Notified Bodies may have different expectations and interpretations related to the application of risk control measures. One example “If you say on the left-hand side as you are doing your FMEA, for example, that the risk is reduced as far as possible, it is inherent; therefore, I have no additional controls, the notified body will still insist that you put in a control on the right hand side.”

One interview participant commented that “everyone is using FMEA, and FMEA does not meet the requirements.” Another participant stated, “People find it difficult to do risk analysis in the right way to show traceability throughout the entire risk management cycle and as part of the risk management file.”

One interview participant commented that the requirement to have a risk management policy was never addressed by device manufacturers as intended by ISO 14971, “This was confused with the risk acceptability criteria, they haven't understood the difference between those.” It was discussed that the Risk Management policy must define the approach for risk acceptability, i.e. “is this ALARP, ALARA or AFAP? How do you plan to support the selected approach for risk acceptability? For example, how is AFAP achieved?”

In terms of EN ISO:14,971+A11:2021, the interview participants were asked about any potential implementation challenges they expected or observed to address compliance with this version of the standard. Two participants stated that they expect companies to use this version of the standard as is without making any further updates to existing risk management systems and that Notified Bodies may be accepting of this approach “due to lack of education.”

Areas of potential challenges discussed, aligned with areas previously highlighted in Figure 1 for the 2019 version of the standard. These challenges were completing a benefit–risk analysis for all risks and the inclusion of production risks as part of this analysis; understanding the endpoints or criteria for demonstrating that the risk acceptability has been met with respect to risk reduction as far as possible and requirements for the disclosure of “all risks” per the MDR compared to “significant risks” per ISO 14971.

Lafferty (2021) acknowledged that while the Z Annexes of EN ISO:14,971+A11:2021 do not contain any content deviations, this may not necessarily result in greater clarity or understanding of how the standard meets applicable regulations' requirements. Responses from several of the interviewees align with this perspective due to wording differences that have not been highlighted in Annex ZA. The advice is to read the requirements of Annex ZA and pay close attention to the wording in the GSPRs for differences.

Several of the interviewees commented that the increased focus on benefit–risk analysis was attributed to “EU MDR” and “the regulators, both FDA and the European Commission” and that “EU MDR and ISO 14971 are quite aware of each other and inspired by each other.”

It was discussed that identifying and supporting the benefits of a device is “really difficult for the vast majority of companies to quantify” and that you need to have a mechanism to support the claim “that the benefit outweighs the risk” and the “continued suitability of your device.” It was commented that “more evolution of technique and knowledge” is required with respect to completing a benefit–risk analysis and that “it is a subjective decision.”

Representatives from Notified Bodies commented that “I saw many products where the benefit of the device wasn't there at all” and that from 2015, “the new emphasis that was pushed really hard was Clinical Evaluation and Benefit.”

The common theme regarding the increased focus on benefit–risk was that this shift began in 2012 and became a focus for stakeholders, such as Notified bodies. It has now come to the fore of regulatory requirements as a result of EU MDR, which was driven by user and patient safety issues.

Interview participants discussed that there is no definition for benefit–risk ratio either in the MDR 2017/745 or ISO 14971:2019; therefore, “this is open to interpretation.” The MDR 2017/745 defines the term “benefit–risk determination” and “clinical benefit”, while ISO 14971 includes a definition of “benefit”. The Z annexes of EN ISO 14971:2019+A11:2021 state “that definitions in the EU MDR take precedence over ISO 14971.” It was further highlighted that “there have been debates about whether this should be a number”, “auditors or any regional national agencies couldn't tell you what it was” and “it can be either quantitative or qualitative.” However, the majority of interview participants stated that they were evaluating this from a qualitative perspective.

Other comments related to the understanding of the term “benefit–risk ratio” included that the manufacturer would be advised to define their interpretation of this as part of their risk management system, as “the absence of a definition will get them in trouble.”

Overall, it appears that the interview participants prefer to take a qualitative approach to interpreting the “benefit–risk ratio,” and the best practice would be to define this and how to complete it as part of the risk management system procedures. This approach aligns with what was found and discussed in the literature review, where authors Elahi (2021) and the FDA (Bills, 2021a) recommend a qualitative approach.

The four key areas that the interviewees identified for further opportunities for revisions and/or guidance that were commented on most frequently included benefit–risk analysis, cybersecurity, the need for ISO 14971 to become a normative reference for other standards and regulations, and the language of ISO 14971, which is not user-friendly and is still open to many different interpretations by users of the standard.

Interviewees discussed that more guidance was needed with respect to completing a benefit–risk analysis with regard to how to complete these “data sources” to use and making this analysis “more objective, currently its expert opinion.” One respondent discussed that there is a potential gap in that “if you had the overall benefits outweigh the risks, could you have individual benefits not outweigh the risks?” EU MDR 2017/745 requires a benefit–risk analysis to be completed for both individual and overall residual risks.

Several interviewees commented that cybersecurity “is expected to require more guidance” as “software is always evolving”, with a need to update IEC/TR 80002–1, which guides how to apply the risk management framework per ISO 14971 to medical device software to meet the requirements of IEC 62304.

Interview participants commented on the revised standard that “they are right to leave it as a process,” “it's driving the right behaviour” and “I don't see the overall framework changing.” It was acknowledged that ISO 14971 should become a normative requirement for standards that control risks associated with “the GSPRs or in other regulations” and “IT Networks, Cybersecurity, Artificial Intelligence, Machine Learning, and Data Science.”

Interviewee participants commented with respect to the language of the standard that there were “a lot of confusing words” and “there is language that is not well written.” Examples of what contributed to this included “harms and hazards”, “intended use and intended purpose, pick one” and “terms and the application of those terms.” As a result, the standard may be “open to interpretation” and result in “confusion for the readers.”

It was commented that the Z Annexes of the harmonized European version of the standard, EN ISO 14971:2019+A11:2021, have not “provided enough detail “ in terms of “what is covered and not covered and how to address the gaps.” This will potentially “add to more confusion as there are subtle wording differences”.

As technology in the medical device sector continues to advance, more devices with software are available, and greater clarity is required in the standard with respect to “interoperability” as “it's very ambiguous” in the current version. It was commented that for “some of this new technology”, it would be helpful to have additional guidance, which includes “examples that are broader”, such as “software as a medical device” and “machine to machine learning AI Algorithm.”

One respondent stated they would mandate “the use of P1 and P2” and a “Hazard Analysis” document as part of risk analysis. Annex C (Fundamental risk concepts) of ISO 14971:2019 allows for the probability of Harm to be expressed as a combination of separate probabilities (P1, P2), but this is not a mandatory requirement. Annex B (Techniques that support risk analysis) provides guidance on available techniques that can be used to support risk analysis and includes the use of a preliminary hazard analysis (PHA). However, no risk analysis technique is mandated for use per the requirements of ISO 14971.

One respondent stated that for future revisions of the standard, “the changes won't be massive in terms of the structure or format of the standard.” Still, the focus that is needed relates to “how do we make these risk management systems rather than processes”, with respect to “the utilization of data, it is using more knowledge about triggers.”

One respondent stated that the risk management process requirements should be “linked to the classification of the device” and provided an example of an infrared thermometer being recertified under MDR 2017/745, where the regulatory requirements are much more burdensome than the original submission made per the Medical Device Directive (MDD) and comparable to the requirements for an implant device, stating that “it is driving non-compliance.”

The qualitative interviews conducted as part of this research confirmed a high level of awareness in the medical device industry regarding the publication of the 2019 version of ISO 14971 at the time, particularly among device manufacturers focused on EU MDR 2017/745 compliance. Large multinational companies were seen to address planning for ISO 14971:2019 compliance early as part of EU MDR 2017/745 activities. However, SMEs were found to be poorly informed about changes to external standards, such as ISO 14971, and they relied on regulatory consultants or Notified Body audits to drive the required updates to maintain their existing technical documentation. Similar themes have been seen in relation to regulatory compliance in relation to SMEs in studies by Kearney and McDermott (2023a, b), where SMEs were outsourcing clinical evaluation report writing due to limited resources and expertise issues.

The qualitative interviews revealed that device manufacturers completed gap analyses to understand the changes between the 2007 and 2019 versions of the standard. However, the planning activities completed have been dependent on the industry's understanding of the scope of the changes to ISO 14971. There were mixed responses to the industry's assessment of the changes, from being regarded as having a minimal impact to a major rewrite of the standard (Bills, 2021a). This may be attributed to the level of compliance existing risk management systems demonstrate with the current requirements.

ISO/TR 24971:2020 was found to be an indispensable document that assists with understanding and interpreting the risk management framework. This guidance document is explicitly referenced as part of the 2019 version of the standard. A lack of guidance or poor guidance has been a common complaint among MedTech stakeholders regarding the EU MDR 2017/745 (Kearney and McDermott, 2023a), and good guidance, as exemplified by ISO/TR 24971:2020, is beneficial for the industry.

Overall, at the time of the study, device manufacturers were still working on updating existing risk management systems to comply with the 2019 version of the standard and linking this activity to pending EU MDR 2017/745 submissions.

Regulatory agencies such as Notified Bodies have been satisfied with a gap analysis or a transition plan. However, they do not appear to have conducted a thorough review of product-specific compliance with the 2019 version of the standard during surveillance audits, based on interview feedback. This may or may not be attributed to the much publicized and reported shortage of Notified Body personnel and designated Notified Bodies (Baines et al., 2022; European Commission, 2024).

The qualitative interviews identified 13 different areas of challenges through the combined practical experiences of Risk Management Industry experts. The main areas of challenge that jointly emerged were information feedback from production and post-production activities, and the process of completing a benefit–risk analysis. Industry had requested clarification on the production and post-production clause of the standard as part of the systematic reviews during 2007 and 2016 (Bills, 2021b), and there is no standardized method for benefit–risk analysis for medical devices (Elahi, 2023; Freyer et al., 2025).

Next, the requirements related to the Risk Acceptability Criteria, Disclosure of Residual Risks, Reasonably Foreseeable Misuse, Risk Reduction as far as possible, Risk Analysis and the Risk Management Policy. Again, feedback received from industry highlighted many of these areas as confusing and requiring further information in the 2016 systematic review of the standard (Krenc, 2018). Other challenges discussed included a lack of expertise and understanding of risk management frameworks for cybersecurity risks, the application of the broader definition of harm and demonstrating competence in the execution of risk management tasks. For example, in the assignment of severity ratings, the verification of risk control measures and the integration of usability engineering requirements per IEC 62366–1 was deemed difficult.

Challenges related to the application of risk management requirements, per the harmonized version of EN ISO 14971:2019+A11:2021, were also considered as part of the qualitative interviews conducted as part of this research. While the Z Annexes of EN ISO:14,971+A11:2021 do not contain any content deviations, this may not necessarily result in greater clarity or understanding of how the standard meets the applicable requirements of the Regulations. The main conclusions concerning this review are for the industry to exercise caution concerning the review of Annex ZA of EN ISO 14971:2019+A11:2021 as there are subtle wording differences, and not all of the GSPRs of EU MDR 2017/745 are addressed by the harmonized version of the standard (Lafferty, 2021).

The qualitative interviews identified the following areas as potential challenges specific to Annex ZA of EN ISO 14971:2019+A11:2021:

1. Completing a benefit–risk analysis for all risks (individual and overall) and the inclusion of production risks as part of this analysis.

2. Understanding the endpoints or criteria for demonstrating that the risk acceptability has been met with respect to risk reduction as far as possible.

3. Requirements for the disclosure of all risks per the EU MDR compared to significant risks per ISO 14971.

Team NB (2025) have highlighted specific areas of risk management focus that manufacturers fall short on in their recently updated position paper. These generally align with the 13 different areas of risk management challenges highlighted during this study, as provided per Figure 1.

The literature review supports the global regulatory acceptance of the ISO 14971 process framework for managing product safety risks and its alignment with harmonization efforts (Lafferty, 2021; Bills, 2022). However, the constant response from the national voting committees of ISO and IEC during the systematic reviews of the standard since its inception has been for more guidance concerning the practical application of the requirements to address ongoing implementation challenges (Bills, 2018).

The associated guidance document ISO/TR 24971, first published in 2013, was a positive step for providing the industry with guidance on the application of this framework, albeit it only addressed six clauses of the standard, with clause 5 (the difference between “information for safety” and “disclosure of residual risk”) intended to address the confusion of the related content deviations per the EN ISO 14971:2012 version of the standard (Notified Bodies Recommendation Group, 2014). However, as ISO/TR 24971 was published after ISO 14971:2007, it was not referenced in the standard, so the MedTech industry did not have a high level of awareness of its existence.

This is now resolved as part of the 2019 version of ISO 14971 as a reference to ISO/TR 24971, which is included throughout the applicable clauses (ISO, 2019). The 2020 version of this guidance document is now better structured based on the clauses of ISO 14971 and will allow for more frequent updates in response to the needs of the medical device industry going forward (Krenc, 2018).

Through the qualitative interviews conducted as part of this research, four key areas were identified as opportunities for further guidance and/or revisions. The key areas include benefit–risk analysis and risk management related to cybersecurity. The overall process for completing a benefit–risk analysis, using data sources as input, and how to make this process more objective, as opposed to relying on the opinions of clinical experts, was also of concern (Freyer et al., 2025).

Risks associated with cybersecurity are now in the scope of ISO 14971. While the 2020 version of ISO/TR 24971 offers some initial guidance, further guidance is anticipated to be needed as software as part of medical devices is constantly evolving. A recommendation from the qualitative interviews is for IEC/TR 80002–1 to be updated; this guidance document outlines how to apply the risk management framework specified in ISO 14971 to medical device software, ensuring compliance with the requirements of IEC 62304 – Medical device software – Software life cycle processes.

Other areas identified to enhance the understanding of ISO 14971's application included making it a normative reference for other standards and regulations and improving the language used in the standard, as stakeholders still consider this open to many different interpretations. A member of the ISO technical committee and the US delegation to ISO/TC 210 was quoted as stating that the systematic review, which led to the last standard update in 2019, indicated that most of the comments regarding the decision to revise did not pertain to the normative section (Krenc, 2018).

The areas highlighted for consideration to include ISO 14971 as a normative reference were IT Networks, Cybersecurity, Artificial Intelligence and Machine Learning. Digitalization and software are increasingly part of medical devices in their design, manufacture, function and post-market surveillance (McDermott et al., 2025).

The language used in the standard requires further clarification from the perspective of risk management terminology, such as harms and hazards, and how to interpret and apply this within a risk management system. The confusion in the language of the standard has been previously highlighted and discussed by Caines et al. (2015) and Wu and Kusinitz (2015).

The overall consensus from the interviews is that the process framework provided per ISO 14971 is driving the right behaviours, with device manufacturers placing more focus on risk management systems as part of the QMS (José, 2017).

The interviewees, particularly the consultants and Notified Bodie's, did not expect any significant changes to the process framework provided by ISO 14971 during the next systematic review of the standard (it commenced in October 2024), unless significant changes to regulatory requirements have occurred during the interim period. The outcome of the systematic review of the 2019 version of the standard concluded in March 2025, with a decision to confirm it, endorsing its global acceptance for another 5 years, without revision (International Standards Organisation, 2025).

This research will benefit MedTech stakeholders (such as device manufacturers, regulatory agencies and competent authorities) by enhancing their understanding of medical device risk management, given the global prominence of ISO 14971. Recognizing its role as a normative reference in various horizontal and vertical standards underscores the relevance of this study.

From a practical perspective, a thorough comprehension of the key obstacles related to the application of ISO 14971:2019 (EN ISO 14971:2019+A11:2021) is essential for MedTech stakeholders. Analysing these challenges will enable organizations to critically assess their existing risk management systems and develop strategic plans to mitigate issues that may arise. Successfully overcoming these hurdles is crucial for achieving regulatory submissions and ensuring product safety, which ultimately serves the interests of users and patients who rely on medical devices.

From a regulatory policymaker's perspective, identifying the challenges associated with fulfilling risk management requirements through the lens of ISO 14971 is vital. Such an understanding can inform future revisions of ISO 14971 and its associated guidance document IS0/TR 24971. The outcome of these updates should facilitate improved compliance with global regulatory mandates regarding risk management.

Despite the critical importance of this subject, a notable lack of research exists addressing the practical difficulties encountered in implementing ISO 14971 risk management for medical devices (Kirkire et al., 2015; Onofrio et al., 2015; Xavier et al., 2025). This study aims to bridge this gap and propose future research agendas that emphasize the significance of this area of inquiry.

This research aimed to investigate the current challenges with respect to risk management implementation in the MedTech Industry through the application of ISO 14971 while also considering risk management requirements per EU MDR 2017/745 for medical devices intended to be marketed in Europe. Qualitative interviews were duly justified to answer the following research questions to satisfy the aims of this research:

1. What are the main challenges concerning the implementation of ISO 14971:2019 and concerning EU MDR 2017/745?

2. What suggested changes and recommendations to ISO 14971 compliance and the standard in general are recommended by MedTech stakeholders to better assist with implementation?

The study conclusions related to the research aims are as follows:

1. Planning for compliance with the 2019 version of ISO 14971 was generally perceived as a reactive process and dependent on the size of the organization. For example, the large multinationals linked this to EU MDR and IVDR activities. The multinationals had a high level of awareness of standard changes to ensure no compliance issues with existing approved devices commercially available.

2. Standard compliance is more challenging for small- to medium-sized companies, as they lack mechanisms to monitor changes to standards and rely on regulatory intelligence from external parties. They are primarily focused on device approval timelines.

3. Understanding the scope of the changes to the standard was key to planning for implementation. This understanding varied across MedTech stakeholders, from a minimal impact to a major rewrite of the standard. This may be attributed to how compliant existing risk management systems were with the current requirements.

4. The key areas of challenges emerged as information feedback from production and post-production activities and the process of completing a benefit–risk analysis.

5. The absence of content deviations from the Z Annexes of the harmonized version of the standard, EN ISO:14,971+A11:2021, may not result in greater clarity or understanding of how the standard meets the applicable requirements of the Regulations. A careful review of the subtle wording differences is required, in addition to understanding that not all of the GSPRs of EU MDR 2017/745 are addressed by ISO 14971.

6. The four key areas that the interviewees identified for further opportunities for revisions and/or guidance that were commented on most frequently included benefit–risk analysis, cybersecurity, the need for ISO 14971 to become a normative reference for other standards and regulations, and the language of ISO 14971, which is not user-friendly and is still open to many different interpretations by users of the standard.

7. A recommendation from this research is for IEC/TR 80002–1 to be updated; this is a guidance document with respect to how to apply the risk management framework per ISO 14971 to medical device software to meet the requirements of IEC 62304.

8. More guidance included in ISO/TR 24971, driven by future systematic reviews of the standard, is expected to overcome ongoing challenges, but no significant changes to the process framework provided by ISO 14971 are anticipated.

A limitation of this study may be that only 12 medical device professionals were interviewed; however, they were located across three geographic regions (Ireland, the US and the UK) and, therefore, were representative of global stakeholders in different regulatory jurisdictions.

Future research topics will relate to exploring how MedTech companies are overcoming risk management challenges, especially the key ones identified from this research, i.e. integrating feedback from production and post-production activities as part of their risk management systems, and what methods are being used to complete a benefit–risk analysis to meet the requirements of the standard being accepted by regulatory agencies.