Product-specific risk management plan with defined scope, named responsibilities, severity/probability scales, and risk acceptance matrix — foundational structure unchanged.
The plan must now specify a method for evaluating the overall residual risk and criteria for its acceptability, and must cover activities for collecting and reviewing production and post-production information.
Acceptability criteria that were fitted to the results. The standard lets the plan be developed over time (4.4 NOTE 4), but risks are evaluated against the criteria in the plan — criteria written after the Risk Table was scored are a common finding.
Maps to
ISO 14971: §4.4 Risk management plan
ISO 13485: §7.1 Planning of product realization
Pre-QMSR Part 820: §820.30(g) Design validation.
Requirement text
The manufacturer shall document a product-specific risk management plan, and that plan shall be part of the risk management file. The plan shall include at least: the scope of the planned risk management activities, identifying and describing the medical device and the life cycle phases for which each element of the plan is applicable; assignment of responsibilities and authorities; requirements for review of risk management activities; criteria for risk acceptability, based on the manufacturer's policy for determining acceptable risk, including criteria for accepting risks when the probability of occurrence of harm cannot be estimated; a method to evaluate the overall residual risk, and criteria for acceptability of the overall residual risk based on that policy; activities for verification of the implementation and effectiveness of risk control measures; and activities related to collection and review of relevant production and post-production information. If the plan changes during the life cycle, a record of the changes shall be maintained in the risk management file.
Why this clause exists
Risk acceptability is not an objective mathematical fact — it depends on severity scales, probability definitions, and threshold choices that must be fixed before analysis begins, not fitted to results afterward. Without a pre-established plan, manufacturers face the temptation — even unconsciously — to define acceptance criteria that accommodate the risk scores their product happens to produce, defeating the entire evaluative purpose of risk management. ISO 14971:2019 clause 4.4 codifies the criteria-first requirement explicitly because the 2007 edition left sequencing ambiguous and notified bodies observed widespread retroactive calibration during audits. The requirement for a product-specific plan (rather than a company-wide template) reflects the further principle that severity scales, intended-use lifetime estimates, and patient population risk tolerance differ meaningfully between, for example, a Class I wearable and a Class III implant — a single matrix cannot be adequate for both.
What changed
ISO 14971:2019 was a major revision reorganizing the standard from 9 to 10 clauses and moving extensive guidance material into a separate technical report (ISO/TR 24971:2020), making normative requirements clearer and more auditable.
Guidance on risk-acceptability policy moved into an informative NOTE: clause 4.2 NOTE 1 lists reducing risk as low as reasonably practicable (ALARP), as low as reasonably achievable (ALARA), and as far as possible (AFAP) without adversely affecting the benefit-risk ratio as approaches a manufacturer's policy can define. None of the three replaced the others, and the standard mandates no single one of them. Benefit-risk analysis became its own subclause (7.4) with a mandatory record, and three new definitions were added (benefit, reasonably foreseeable misuse, state of the art). Criteria for risk acceptability are a required element of the risk management plan (4.4 d)), and clause 6 evaluates risks against the criteria defined in that plan — though NOTE 4 to clause 4.4 states the plan or parts of it can be developed over time.
Post-production requirements (Clause 10) were substantially expanded into four sub-clauses (Establish, Collect, Review, Act), mandating active collection and review of post-market data rather than passive complaint handling. The overall residual risk evaluation (Clause 8) is a distinct step: the manufacturer evaluates the overall residual risk taking into account the contributions of all residual risks, in relation to the benefits of the intended use, against the method and criteria set in the plan. Clause 4.3 shifted emphasis from personnel qualifications to demonstrated competence. ISO/TR 24971:2020 (informative companion) adds Annex G (cybersecurity risk management) and Annex H (legacy device risk file remediation).
Common gaps (what we see in audits)
- Risk acceptability criteria defined retroactively — Clause 6 requires each risk to be evaluated against the criteria for risk acceptability defined in the risk management plan, and clause 4.4 d) makes those criteria a required plan element based on the manufacturer's policy. The standard does not require the whole plan up front — clause 4.4 NOTE 4 permits it to be developed over time — but criteria written after the risk analysis results are known undermine the objectivity of the evaluation, and auditors routinely challenge plans whose criteria appear fitted to the scores.
- No methodology for overall residual risk evaluation — The 2019 edition requires the risk management plan to establish the methodology for evaluating overall residual risk and the criteria for its acceptance. Many plans address individual risk evaluation but lack a defined approach for aggregate residual risk assessment. Plans that state 'if all individual risks are acceptable, the overall risk is acceptable' are rejected.
Related clauses
Join the waitlist to check your documents against this clause →