Post-control residual risk re-estimation for every hazardous situation, using the same acceptance criteria applied in initial risk evaluation — before/after record required.
Benefit-risk analysis is now its own subclause (7.4) with a mandatory record. It is triggered when a residual risk is not acceptable and further risk control is not practicable — not by unacceptability alone — and the conclusion is that the benefits outweigh the residual risk, not that the risk is acceptable.
The benefit-risk record in the Risk Management Report — whether the practicability determination that triggered it is documented, and what evidence the benefit side rests on.
Maps to
ISO 14971: §7.3 Residual risk evaluation, §7.4 Benefit-risk analysis
ISO 13485: §7.1 Planning of product realization
Pre-QMSR Part 820: §820.30(g) Design validation.
Requirement text
After implementing risk control measures, the manufacturer shall evaluate the residual risk for each hazardous situation using the criteria for risk acceptability defined in the risk management plan, and shall record the results in the risk management file. If a residual risk is not judged acceptable, further risk control measures shall be considered. Where the manufacturer determines during risk control option analysis that risk reduction is not practicable, it shall conduct a benefit-risk analysis of that residual risk; in doing so it may gather and review data and literature to determine whether the benefits of the intended use outweigh the residual risk. The results of the benefit-risk analysis shall be recorded in the risk management file.
Why this clause exists
Implementing a risk control measure does not guarantee risk reduction — a software interlock that triggers an audible alarm may reduce one hazard while creating a new one through alarm fatigue. ISO 14971 clause 7.3 requires re-estimation of residual risk after each control is applied because only a documented before-and-after record can demonstrate that the risk management process is actually reducing risk rather than rearranging it. The benefit-risk analysis requirement for unacceptable residual risks reflects the fundamental reality that some medical devices carry irreducible hazards that are nonetheless justified by clinical necessity — an implantable defibrillator carries real risks from inappropriate shocks, but those risks are outweighed by the risk of untreated ventricular fibrillation. Regulators required explicit benefit-risk documentation in the 2019 edition because the prior framework allowed manufacturers to finesse unacceptable residual risks by adjusting acceptance criteria; the shift to a mandatory clinical-evidence-grounded benefit-risk conclusion makes that shortcut auditable and therefore harder to abuse.
What changed
ISO 14971:2019 was a major revision reorganizing the standard from 9 to 10 clauses and moving extensive guidance material into a separate technical report (ISO/TR 24971:2020), making normative requirements clearer and more auditable.
Guidance on risk-acceptability policy moved into an informative NOTE: clause 4.2 NOTE 1 lists reducing risk as low as reasonably practicable (ALARP), as low as reasonably achievable (ALARA), and as far as possible (AFAP) without adversely affecting the benefit-risk ratio as approaches a manufacturer's policy can define. None of the three replaced the others, and the standard mandates no single one of them. Benefit-risk analysis became its own subclause (7.4) with a mandatory record, and three new definitions were added (benefit, reasonably foreseeable misuse, state of the art). Criteria for risk acceptability are a required element of the risk management plan (4.4 d)), and clause 6 evaluates risks against the criteria defined in that plan — though NOTE 4 to clause 4.4 states the plan or parts of it can be developed over time.
Post-production requirements (Clause 10) were substantially expanded into four sub-clauses (Establish, Collect, Review, Act), mandating active collection and review of post-market data rather than passive complaint handling. The overall residual risk evaluation (Clause 8) is a distinct step: the manufacturer evaluates the overall residual risk taking into account the contributions of all residual risks, in relation to the benefits of the intended use, against the method and criteria set in the plan. Clause 4.3 shifted emphasis from personnel qualifications to demonstrated competence. ISO/TR 24971:2020 (informative companion) adds Annex G (cybersecurity risk management) and Annex H (legacy device risk file remediation).
Common gaps (what we see in audits)
- Synergistic effects of combined residual risks not evaluated — Clause 8 requires the overall residual risk to be evaluated taking into account the contributions of all residual risks. ISO/TR 24971 guidance and notified-body practice read that as covering combinations — multiple individually 'low' residual risks that together create a higher-risk situation, such as several concurrent alarms that are each acceptable alone but together produce dangerous user confusion. Manufacturers commonly evaluate residual risks only in isolation.
- Benefit-risk conclusion not explicitly documented — The 2019 edition shifts the required conclusion from 'risks are acceptable' to 'benefits outweigh residual risks.' Many manufacturers' risk management reports do not include an explicit benefit-risk conclusion with documented rationale, particularly when overall residual risk exceeds pre-defined thresholds.
Related clauses
Join the waitlist to check your documents against this clause →