Post-market surveillance loop feeding complaint and incident data back into the risk management file — new hazards or changed risk estimates trigger file updates.
Active collection is now explicit — proactive monitoring of literature, state of the art, and similar devices required, not just reactive complaint handling.
PMS-to-risk-file linkage — auditors ask for evidence that surveillance reviews triggered risk file updates; a passive complaint inbox with no update decisions fails.
Maps to
ISO 14971: §10 Production and post-production activities
ISO 13485: §8.2.1 Feedback
Pre-QMSR Part 820: §820.198 Complaint files.
Requirement text
The manufacturer must establish, document and maintain a system to actively collect and review information relevant to the medical device in the production and post-production phases. The manufacturer shall review the information collected for possible relevance to safety, especially whether: previously unrecognised hazards or hazardous situations are present; an estimated risk arising from a hazardous situation is no longer acceptable; the overall residual risk is no longer acceptable in relation to the benefits of the intended use; or the generally acknowledged state of the art has changed. If the collected information is determined to be relevant to safety, then concerning the particular medical device the manufacturer must review the risk management file and determine if reassessment of risks and/or assessment of new risks is necessary, and any decisions and actions must be recorded in the risk management file.
Why this clause exists
The risk landscape of a deployed medical device is not static: clinical use patterns evolve, new research emerges, similar devices generate adverse event reports that are relevant to shared hazard mechanisms, and software components receive updates that change the hazard profile. A manufacturer whose risk file accurately reflected reality at design transfer but has not been touched since is functionally operating without risk management after the first product generation. ISO 14971 clause 10 exists because passive complaint handling — waiting for a user to submit a formal complaint — has proven repeatedly insufficient to detect safety signals early enough to prevent serious harm at scale. The 2019 edition restructured this requirement into a four-element framework (Establish, Collect, Review, Act) precisely because notified bodies found that organizations had complaint systems but no documented decision process for evaluating whether complaint data required risk file updates — the data was collected and then terminated in a CAPA log with no bridge back to the risk management file.
What changed
ISO 14971:2019 was a major revision reorganizing the standard from 9 to 10 clauses and moving extensive guidance material into a separate technical report (ISO/TR 24971:2020), making normative requirements clearer and more auditable.
Guidance on risk-acceptability policy moved into an informative NOTE: clause 4.2 NOTE 1 lists reducing risk as low as reasonably practicable (ALARP), as low as reasonably achievable (ALARA), and as far as possible (AFAP) without adversely affecting the benefit-risk ratio as approaches a manufacturer's policy can define. None of the three replaced the others, and the standard mandates no single one of them. Benefit-risk analysis became its own subclause (7.4) with a mandatory record, and three new definitions were added (benefit, reasonably foreseeable misuse, state of the art). Criteria for risk acceptability are a required element of the risk management plan (4.4 d)), and clause 6 evaluates risks against the criteria defined in that plan — though NOTE 4 to clause 4.4 states the plan or parts of it can be developed over time.
Post-production requirements (Clause 10) were substantially expanded into four sub-clauses (Establish, Collect, Review, Act), mandating active collection and review of post-market data rather than passive complaint handling. The overall residual risk evaluation (Clause 8) is a distinct step: the manufacturer evaluates the overall residual risk taking into account the contributions of all residual risks, in relation to the benefits of the intended use, against the method and criteria set in the plan. Clause 4.3 shifted emphasis from personnel qualifications to demonstrated competence. ISO/TR 24971:2020 (informative companion) includes Annex F (Guidance on risks related to security), Annex G (Components and devices designed without using ISO 14971) and Annex H (Guidance for in vitro diagnostic medical devices).
Common gaps (what we see in audits)
- Passive complaint monitoring instead of active data collection — The 2019 revision explicitly requires manufacturers to 'actively collect and review' post-production information rather than passively waiting for complaints. The four-step framework (Establish, Collect, Review, Act) requires proactive monitoring of clinical literature, similar devices, and state-of-the-art developments — not just a complaint inbox.
- Post-market data not feeding back into risk management — BSI and TUV SUD consistently list 'lack of connection between PMS and risk management' as a top 3 major non-conformity. Organizations collect post-market data (complaints, adverse events, literature reviews) but do not have a systematic process to feed this information back into the Risk Management File, triggering re-assessment when new hazards or risk factors are identified.