Table 1 A comparison of the key ISO... | Emerald Publishing

Table 1

A comparison of the key ISO 14971 revisions, risk management requirements per EU MDR 2017/745 and associated regulatory challenges/gaps

Aspect of standard	ISO 14971:2007	EN ISO 14971:2012/Medical devices directives	ISO 14971:2019	EN ISO 14971:2019 +A11:2021/EU MDR 2017/745	Regulatory challenges/Gaps
Quality management system (QMS)	Does not require the establishment of a QMS	Does not require the establishment of a QMS	Does not require the establishment of a QMS	Explicit requirement for a Risk Management System per Article 10 (2)/GSPR 3	Integration of risk management as part of a QMS (Jovanoska et al., 2020; Shah, 2024)
Terms and definitions	Based on ISO/IEC guides and standards	Based on ISO/IEC guides and standards	Clarifications and new terms and definitions included for benefit, reasonably foreseeable misuse and state of the art	EU MDR definitions take precedence	Correct application of Terms and Definitions of the standard (Caines et al., 2015: Wu and Kusinitz, 2015)
Competence of personnel	Qualification of personnel	Qualification of personnel	Competence of personnel	Explicit requirement for a Risk Management System per Article 10 (2)/GSPR 3	Demonstrating competence of personnel to support the execution of risk management activities (Nolan and McDermott, 2025; Xavier et al., 2025)
Risk acceptability criteria	Risk reduction as low as reasonably practicable (ALARP)	The reduction of risks as far as possible (AFAP)	Various approaches to risk control specified per subclause 4.2 – manufacturer's responsibility to establish objective criteria	GSPR 2: Requires the reduction of risks as far as possible (AFAP) without adversely affecting the benefit–risk ratio	EU MDR is stricter than ISO, does not allow for economic considerations (Bills, 2022; Krenc, 2018; BSI, 2021b; Bills, 2020)
Benefit–risk analysis	Risk–benefit analysis for overall residual risk only	Individual and overall risk–benefit analyses required	Benefit–risk analysis for overall residual risk	Benefit–risk analysis must be completed for both individual and overall residual risks	No universal method for completing a benefit–risk analysis (Freyer et al., 2025)
Risk control options	One or more risk control options are required in the priority order listed	Requires that all control options be applied cumulatively	One or more risk control options are required in the priority order listed	GSPR4 requires all three options must be applied	Risk control measures applied not compliant with GSPR4 (Team NB, 2025)
Disclosure of residual risks	The manufacturer decides which residual risks to disclose	The manufacturer decides which residual risks to disclose	The manufacturer shall inform users of significant residual risks	GSPR 4 implies that “Manufacturers shall inform users of any residual risks.”	EU MDR requires the disclosure of any residual risks (BSI, 2021b)
Post-Market Surveillance (PMS)	Required	Required	Requirements expanded, to better align with regulatory requirements	GSPR 3 (e) requires monitoring of information from the post-market surveillance system	Integration post-market surveillance with risk management (Stern et al., 2020)

Aspect of standard	ISO 14971:2007	EN ISO 14971:2012/Medical devices directives	ISO 14971:2019	EN ISO 14971:2019 +A11:2021/EU MDR 2017/745	Regulatory challenges/Gaps
Quality management system (QMS)	Does not require the establishment of a QMS	Does not require the establishment of a QMS	Does not require the establishment of a QMS	Explicit requirement for a Risk Management System per Article 10 (2)/GSPR 3	Integration of risk management as part of a QMS (Jovanoska et al., 2020; Shah, 2024)
Terms and definitions	Based on ISO/IEC guides and standards	Based on ISO/IEC guides and standards	Clarifications and new terms and definitions included for benefit, reasonably foreseeable misuse and state of the art	EU MDR definitions take precedence	Correct application of Terms and Definitions of the standard (Caines et al., 2015: Wu and Kusinitz, 2015)
Competence of personnel	Qualification of personnel	Qualification of personnel	Competence of personnel	Explicit requirement for a Risk Management System per Article 10 (2)/GSPR 3	Demonstrating competence of personnel to support the execution of risk management activities (Nolan and McDermott, 2025; Xavier et al., 2025)
Risk acceptability criteria	Risk reduction as low as reasonably practicable (ALARP)	The reduction of risks as far as possible (AFAP)	Various approaches to risk control specified per subclause 4.2 – manufacturer's responsibility to establish objective criteria	GSPR 2: Requires the reduction of risks as far as possible (AFAP) without adversely affecting the benefit–risk ratio	EU MDR is stricter than ISO, does not allow for economic considerations (Bills, 2022; Krenc, 2018; BSI, 2021b; Bills, 2020)
Benefit–risk analysis	Risk–benefit analysis for overall residual risk only	Individual and overall risk–benefit analyses required	Benefit–risk analysis for overall residual risk	Benefit–risk analysis must be completed for both individual and overall residual risks	No universal method for completing a benefit–risk analysis (Freyer et al., 2025)
Risk control options	One or more risk control options are required in the priority order listed	Requires that all control options be applied cumulatively	One or more risk control options are required in the priority order listed	GSPR4 requires all three options must be applied	Risk control measures applied not compliant with GSPR4 (Team NB, 2025)
Disclosure of residual risks	The manufacturer decides which residual risks to disclose	The manufacturer decides which residual risks to disclose	The manufacturer shall inform users of significant residual risks	GSPR 4 implies that “Manufacturers shall inform users of any residual risks.”	EU MDR requires the disclosure of any residual risks (BSI, 2021b)
Post-Market Surveillance (PMS)	Required	Required	Requirements expanded, to better align with regulatory requirements	GSPR 3 (e) requires monitoring of information from the post-market surveillance system	Integration post-market surveillance with risk management (Stern et al., 2020)

Source(s): Authors’ own work