Maps to
QMSR / ISO 13485: §820.30(c)
ISO 13485: §7.3.3
ISO 14971: §5.2
Requirement text
The manufacturer shall describe the medical device, its intended use, the intended patient population, user profiles, and the use environment. Reasonably foreseeable misuse scenarios shall also be identified and documented as the basis for hazard identification.
What changed
ISO 14971:2019 was a major revision reorganizing the standard from 9 to 10 clauses and moving extensive guidance material into a separate technical report (ISO/TR 24971:2020), making normative requirements clearer and more auditable.
The most significant change was replacing ALARP (As Low As Reasonably Practicable) with AFAP (As Far As Possible), removing the ability to use economic cost as a primary justification for not implementing a risk control. The standard introduced explicit benefit-risk analysis requirements — three new definitions were added (benefit, reasonably foreseeable misuse, state of the art) and the required conclusion shifted from 'risks are acceptable' to 'benefits outweigh residual risks.' Risk acceptability criteria must now be established and documented in the risk management plan before risk analysis begins.
Post-production requirements (Clause 10) were substantially expanded into four sub-clauses (Establish, Collect, Review, Act), mandating active collection and review of post-market data rather than passive complaint handling. The overall residual risk evaluation (Clause 8) was enhanced to require aggregate assessment of all residual risks combined, considering synergistic effects where multiple low risks may create new high-risk situations. Clause 4.3 shifted emphasis from personnel qualifications to demonstrated competence. New Annex G on cybersecurity risk management and Annex H on legacy device risk file remediation were added.
Atomic constraints
- •Intended use must be documented and approved before risk analysis.
- •Intended patient population and user profiles (e.g., trained clinician vs. lay user) must be specified.
- •Reasonably foreseeable misuse scenarios must be identified and recorded.
- •Intended use documentation must serve as traceable input to hazard identification.
- •The use environment and foreseeable conditions of use must be described.
Common gaps
Reasonably foreseeable misuse insufficiently documented
majorThe 2019 edition formally defines 'reasonably foreseeable misuse' and requires it to be documented. FDA precedent (e.g., surgical mesh cases) shows that manufacturers must document and design against foreseeable misuse based on clinical trends, even when that use is explicitly 'off-label' in the instructions for use.
Evidence signals
- •
FILE_EXISTS
Intended.*Use|Device.*Description|Use.*Specification|Instructions.*for.*Use
- •
CONTENT_MATCH
Does this document describe the intended patient population, user profiles (clinical vs. lay), foreseeable misuse scenarios, and the intended use environment for the device?
Audit defense
The Intended Use document for [your product] (Doc ID: [your document ID]) specifies user profiles, clinical context, and foreseeable misuse scenarios that served as the structured input to hazard identification in the Risk Table — establishing a traceable link between use analysis and risk analysis.