Are You Prepared for EN ISO 14971:2012?

Dennis Rubenacker, Senior Partner, Noblitt & Rueland
Consultants Corner, Autumn 2012

On August 30, 2012, the updated “EN ISO 14971:2012 Medical Devices – Application of risk management to medical devices” standard was published in the Official Journal as harmonized to the Medical Devices Directive, Active Implantable Medical Device Directive, and In Vitro Diagnostic Medical Device Directive and became effective immediately without a transition period. Transition periods typically have been identified for updates to other standards. Many medical device manufacturers were not aware—and many may still not be aware—of recent updates to this European Normalized (EN) standard and how its application might affect their current risk management procedures and implementation of associated documentation for risk assessment, evaluation and control in risk management files and technical files that support their EC certification status for sales in Europe.

The text of the ISO 14971:2007 standard was approved "as is" by CEN without any modification, along with the addition of the monumental informative annexes ZA, ZB, and ZC to be used by Notified Bodies to assess compliance with the Essential Requirements of the applicable directive as related to the appropriateness of the ISO 14971 standard to be used in meeting the Essential Requirements in the directives. These additional informative annexes in EN ISO 14971:2012 include:

  • Annex ZA: Relationship between this European Standard and Requirements of EU Directive 93/42/EEC on Medical Devices
  • Annex ZB: Relationship between this European Standard and Requirements of EU Directive 90/385/EEC on Active Implantable Medical Devices
  • Annex ZC: Relationship between this European Standard and Requirements of EU Directive 98/79/EC on In Vitro Diagnostic Medical Devices

From the perspective of your Notified Body when applying EN ISO 14971: 2012, compliance with the normative (i.e., required) requirements of ISO 14971 does not ensure presumption of conformity with the Essential Requirements in the directives without taking into consideration the informative (i.e., guidance) information in Annexes ZA, ZB, or ZC, as applicable to your medical device products. These annexes provide additional information (i.e., not part of ISO 14971) as related to risk management that should be considered in meeting specific essential requirements. As a summary of key points per the annexes, device manufacturers should consider the following:

  • All risks, even if broadly acceptable, should be evaluated as part of the overall risk benefit to be reduced as far as possible. This includes the use of “As Low As Possible” (ALAP) concepts in risk management procedures versus “As Low As Reasonably Practicable” (ALARP) per ISO 14971 traditional thinking.
  • Undertaking risk-benefit analysis per intended use for individual risks and overall risk-benefit versus device performance should be part of the risk management process. Procedures should address application of all risk “control options” for risk reduction and to not stop if risk is reduced to “acceptable level,” while implementing cumulative risk reduction using inherent safe design, protective measures, and safety information.
  • The risk evaluation and control process should not attribute any additional risk reduction to information given to the users such as “information for safety” including, for example, labeling controls.

In preparation for their next Notified Body audit, manufacturers should conduct a detailed review of current risk management processes versus the applicable Annex ZA, ZB, or ZC in EN ISO 14971:2012 to plan for any updates to risk-related procedures as needed to allow for continued conformance with the Essential Requirements per the applicable directive for CE marking. Updates to procedures may need to address the concept of ALAP versus ALARP in addressing all risks including consideration of all risk control measures in reducing a risk, along with overall risk benefit analysis.

In addition, risk analysis documentation may need to be updated to indicate that risk is not reduced for identified user safety information risk controls. For example, reducing risk with labeling has been a typical practice used for risk control and potentially reducing a risk. If a manufacturer cannot take credit for labeling or safety information in reducing risk, then re-evaluation to determine if additional risk control measures such as inherent safe design or protective measures would then be required to reduce a risk. An alternative method may be to conduct a risk benefit analysis for individual risks or overall risk of the device performance to its intended use. In practice, updating the risk analysis documentation to not allow for risk reduction for safety information, such as labeling, may be a significant effort for many device manufacturers.

Meanwhile, the rest of the world, including US FDA, still acknowledges use of the ISO 14971 standard as an acceptable practice for risk management of medical devices cleared for sale in those markets. What a web the EU does weave, and with no grace period.

Are you prepared?

Dennis Rubenacker is co-founder and senior partner of consulting firm Noblitt & Rueland, which provides consulting and training services for medical device and IVD manufacturers. Visit the company listing on