EN ISO 14971

Buy the published European base

Risk management and the device lifecycle

The public scope describes a medical-device risk management process across the lifecycle, including software and in vitro diagnostic devices. It excludes business risk management and decisions about using a device in a particular clinical procedure. It does not specify universally acceptable risk levels.

For procurement, identify the device, intended use and version under review. Assign people who can resolve questions about design, users, manufacturing and information received after supply. A risk-management service is easier to quote when the provider knows which information exists and which must be developed.

Define the service and its decision boundary

The table is a commercial responsibility map. It does not perform a risk analysis or select acceptability criteria. The responsible manufacturer team must establish the technical decisions and applicable regulatory basis.

Questions before appointing a provider

• Does the proposal identify the same device boundary as the buyer's brief?
• Which existing evidence and stakeholder inputs are needed?
• Does the service include facilitation, review, file preparation or another defined deliverable?
• How will unresolved assumptions be recorded and assigned?
• What support remains available when the device or its evidence changes?

Compare offers using the same information register. A consultant may help organise the process but expect the manufacturer to provide technical judgements. Make that expectation explicit rather than assuming every decision is included in a fixed-price document package.

Example: updating a device accessory

A manufacturer plans to add a new accessory to an existing medical device. It asks a provider to quote a risk-file review. Before accepting the offer, the buyer supplies the existing device baseline, proposed accessory description and available evidence, then asks which interfaces and assumptions the assignment covers.

The contract names the review deliverables and the manufacturer's decision owners. Changes discovered during the work follow an agreed query process. The example explains scope coordination; it does not assess the accessory's safety or establish acceptable residual risk.

Keep different evidence subjects connected

Risk management can interact with software, usability, biological evaluation and other device evidence. Use common device and version identifiers so those assignments can exchange usable information. Ask each provider to explain what it needs and what it will supply to the risk-management team.

The international ISO record identifies ISO 14971:2019 separately. If the project needs the European amendment or annex information, confirm that package explicitly. An international copy should retain its correct identity rather than being labelled as including EN additions.

Frequently asked buying questions

Does a risk file prove the device is approved?

Define what the file and review actually cover. A broader product or regulatory conclusion requires its own evidence and responsible assessment.

Can the consultant choose every acceptance decision?

Agree decision ownership in the contract. Ask the manufacturer's responsible team how technical decisions and applicable requirements will be reviewed.

Does the published EN status establish current harmonisation?

This guide verifies publication and supports buying. Check current official citations and their relevance separately where a regulatory conclusion is required.

Related guidance

Read medical-device quality-system buying, usability engineering services and biological evaluation purchasing.

Explore more standards buying guides

Browse standards by reference and subject to compare related document choices.