How does ISO 14971 relate to MDR and IEC 62304?
Regulatory integration: EU MDR, IEC 62304, EN ISO 14971, IEC TR 24971
The short answer
ISO 14971 is the foundation of the EU MDR risk management requirement and is directly referenced by IEC 62304 for software risk management. It is the hub standard that connects software, hardware, clinical evaluation, and post-market surveillance requirements into a single risk management process.
EU MDR Annex I — the general safety and performance requirements
Section 3 of Chapter I of Annex I of Regulation (EU) 2017/745 requires, in its first sentence: "Manufacturers shall establish, implement, document and maintain a risk management system." The requirements on risk control and on the acceptability of risks are in Sections 4 and 8 of the same Chapter.
EN ISO 14971:2019, as amended by EN ISO 14971:2019/A11:2021, is listed as a harmonised standard under the MDR — with the effect and the limits set out below.
What harmonisation gives you — and where it stops
EN ISO 14971:2019 is listed as a harmonised standard under the EU MDR. The Commission published the reference on 17 May 2022, together with the amendment EN ISO 14971:2019/A11:2021 — Commission Implementing Decision (EU) 2022/757, OJ L 138, 17.5.2022, p. 29, entry 16, amending Implementing Decision (EU) 2021/1182 (OJ L 256, 19.7.2021, p. 100). The presumption of conformity runs from the day that reference was published.
That presumption is not a blanket. Article 8(1) of the Regulation presumes conformity only with those requirements of the Regulation that are "covered by those standards or parts thereof". Requirements the standard does not set out to cover stay yours to demonstrate — with your own evidence, in your own file.
That is also why the normative text of the standard does not quote the MDR. The Commission's standardisation request behind the revision (C(2021) 2406 final, Annex III Part A, Nos. 1 and 2, p. 33) requires the relationship between the clauses of a harmonised standard and the requirements of Regulation (EU) 2017/745 to be set out in the Z annexes of the standard, and bars the normative body from referring to the Regulation or reproducing its requirements. The same provision requires the Z annexes to state which relevant requirements a standard does not cover, or covers only in part.
For your technical documentation this means: how far the presumption reaches is something you read in Annex ZA (Regulation (EU) 2017/745) or Annex ZB (Regulation (EU) 2017/746) — both informative — of your own licensed copy of EN ISO 14971:2019/A11:2021, not in a table on a website. We do not reproduce their content here; standards text is copyrighted. Check the annex that applies to you against your Annex I argument, and plan your own evidence for every requirement it leaves open.
IEC 62304 and ISO 14971 integration
IEC 62304:2006+AMD1:2015 §7 (Software risk management) requires that software risk management activities are integrated into the ISO 14971 risk management process. The relationship is bidirectional:
- ISO 14971 → IEC 62304: The severity of harm identified in the ISO 14971 hazard analysis determines the software safety class under IEC 62304 §4.3. Higher severity leads to higher class (B or C), which triggers more stringent development and testing requirements.
- IEC 62304 → ISO 14971: Software failure modes and their effects, as analyzed in the IEC 62304 software FMEA or FTA, feed back into the ISO 14971 risk file as identified hazardous situations with estimated probabilities based on software reliability.
In practice, the software risk analysis (which satisfies IEC 62304 §7) is typically a software-specific FMEA worksheet that is referenced in the ISO 14971 Risk Management File.
ISO 14971 and software safety class determination
| ISO 14971 severity (after controls) | IEC 62304 software safety class |
|---|---|
| Negligible / no harm possible | Class A |
| Non-serious injury | Class B |
| Serious injury or death | Class C |
IEC TR 24971 — companion guide
IEC TR 24971:2020 is a technical report that provides guidance on applying ISO 14971:2019. It is not a standard and does not create requirements, but provides useful explanatory material including worked examples of risk analysis, guidance on the P1 × P2 probability model, and clarification of the benefit-risk analysis requirements. It is a valuable companion document for any manufacturer implementing ISO 14971:2019 for the first time.
Practical integration checklist
- Risk Management Plan references both ISO 14971 and IEC 62304 (for software devices)
- Software FMEA is included in or referenced from the Risk Management File
- Software safety class assignment cites severity from ISO 14971 hazard analysis
- Post-market surveillance plan feeds back into the risk management process
- Clinical Evaluation Report (MDR requirement) references benefit-risk analysis from ISO 14971
- Risk Management Report documents overall residual risk conclusion with benefit justification