ISO 13485 requires risk management throughout product realization and points to ISO 14971 as the method. ISO 14971:2019, with its guidance document ISO/TR 24971, is the internationally recognized standard for applying risk management to medical devices, including IVDs and software.
The ISO 14971 process
- Risk management plan: scope, responsibilities, criteria for risk acceptability and verification activities
- Risk analysis: define intended use and reasonably foreseeable misuse, identify hazards, hazardous situations and possible harms
- Risk estimation: estimate the probability and severity of each harm
- Risk evaluation: compare against the acceptability criteria
- Risk control: reduce risks using, in order of priority, inherently safe design, protective measures, and information for safety such as warnings and training
- Residual risk and benefit-risk: evaluate each remaining risk and the overall residual risk against the clinical benefit
- Risk management report: confirm the plan was carried out and the overall residual risk is acceptable
- Production and post-production: collect and review field data and update the risk file throughout the device’s life
Risk for diagnostics is different
For an in vitro diagnostic, the patient is rarely harmed by the device itself. Harm comes from an incorrect or delayed result that leads to a wrong clinical decision. False positives, false negatives, sample mix-ups, interference, software errors in variant calling or interpretation, and unclear reports are typical hazards. Risk analysis must follow the result all the way to the clinical decision.
Useful tools
- Preliminary hazard analysis early in design
- Failure mode and effects analysis (FMEA) for design, process and software
- Fault tree analysis for complex failure paths
- Use-related risk analysis linked to usability engineering (IEC 62366-1)
- Security risk assessment for connected and cloud-based products
Linking risk to regulation
Both the EU IVDR and MDR require manufacturers to reduce risks as far as possible without adversely affecting the benefit-risk ratio. Notified bodies expect a living risk file that is clearly connected to design inputs, verification, labeling and post-market surveillance, not a document written once and filed away.
ISO 13485 guide
Overview · Understanding the Standard · Design and Development Controls · Risk Management (ISO 14971) · CAPA, Complaints and Feedback · Suppliers and Outsourcing · Software, Cybersecurity and AI · The Certification Roadmap · ISO 13485 and the FDA QMSR
Need help? Salto Partners guides diagnostics, genomics and medical device companies through ISO 13485 and IVDR. Send us an email and we will set up a conversation.
For general information only; not legal or regulatory advice. Regulations and deadlines change, so confirm current requirements with your notified body or regulatory counsel. Last updated October 2026.