The 3rd Edition of the medical device risk management standard, ISO 14971:2019, was approved May 2019 and replaces the second edition (ISO 14971:2007). FDA has already listed this version as a recognized consensus standard. The prior version, ISO 14971:2007, is still recognized. Typically, a transitional period of three years following official publication is a common practice to allow stakeholders to successfully transition to the new edition.
The major changes include:
- Additional requirements for the Risk Management Plan: the Plan must now describe a method to evaluate the overall risk and the criteria for acceptability of the overall risk. This also includes clarification on the Risk Management Plan execution review that is required prior to commercial distribution. The Plan will now need to include implementation and effectiveness of risk control measures in the verification activities and define the information to be collected during production and post-market activities.
- Clarification on documenting reasonably foreseeable misuse: A definition of reasonably foreseeable misuse (along with terms “benefit” and “state of the art”) has been introduced in the new version. Reasonably foreseeable misuse (including abnormal use) and correct use must be considered and documented.
- Addition of a requirement for assessing hazardous situations: Clarification was provided on hazardous situation assessments by referencing Annex C, taking into account intended use, reasonably foreseeable misuse, and safety related characteristics. Annex C now includes a graphic that describes the relationship of hazard, sequence of events, hazardous situation, and harm after reorganization of the annexes from the previous version. Annex C includes a graphic that describes the relationship of hazard, sequence of events, hazardous situation, and harm (previously in Annex E). Annex C also includes examples of hazards, events and circumstances, the relationship between hazards, foreseeable sequences of events, hazardous situations, and harm that can occur. Many of the previous versions’ informative annexes have been moved to ISO/TR 24917 guidance, which is still in draft. (the publication of this guidance is expected mid 2020)
- Addition of a requirement for disclosure of residual risks: Manufacturers must now include information in the accompanying documentation sufficient to inform users of significant residual risks. The standard stresses the emphasis on overall benefit-risk evaluation and communication to the users; for example, a device treating a serious condition with no other available treatments may have a high overall residual risk, but may still be beneficial. Disclosure of these significant risks should be conveyed to the users.
- Clarification to information collection requirements in production and post-production: More detail is given on the information to be collected and the actions to be taken when the collected information has been reviewed and determined to be relevant to safety. The required actions are now specific to both the medical device and the risk management process as a whole. Evaluation of the impact to previously implemented Risk Management activities now directly links to the management review process as an input for the review of the suitability of the risk management process. Information collected could reveal the need to adapt and improve the medical device, potentially requiring an update to the risk management report.
CMD MedTech can assist in efficiently implementing the changes necessary to comply with this new version. Contact us to learn how we can help you assess or update your quality system processes.