How does ISO 14971 relate to MDR and IEC 62304?
Regulatory integration: EU MDR, IEC 62304, EN ISO 14971, IEC TR 24971, FDA 21 CFR 820.30
The short answer
ISO 14971 is the foundation of the EU MDR risk management requirement and is directly referenced by IEC 62304 for software risk management. It is the hub standard that connects software, hardware, clinical evaluation, and post-market surveillance requirements into a single risk management process.
EU MDR Annex I — GSPR 8
EU MDR 2017/745 Annex I (General Safety and Performance Requirements) §8 states: devices shall be designed and manufactured in such a way that, taking into account the generally acknowledged state of the art, the risks associated with the device are reduced to an acceptable level without adversely affecting the benefit-to-risk ratio.
EN ISO 14971:2019 is the harmonized standard for GSPR 8. Compliance with EN ISO 14971:2019 creates a presumption of conformity with GSPR 8. The ZA annex documents the mapping.
The ZA annex in EN ISO 14971:2019
The ZA annex is unique to the European adoption (EN ISO 14971:2019) and maps standard requirements to EU MDR and IVDR GSPR requirements. Key mappings include:
| EN ISO 14971 clause | EU MDR GSPR | Requirement (R-label) |
|---|---|---|
| §4 (Risk management system) | GSPR 8 | R1 — Establish and maintain a risk management system |
| §5 (Risk analysis) | GSPR 8 | R2 — Identify known and foreseeable hazards |
| §6.3–6.4 (Estimation / evaluation) | GSPR 8 | R3 — Estimate and evaluate risks for each hazardous situation |
| §6.5–6.9 (Risk control) | GSPR 8 | R4–R6 — Implement, verify, and evaluate risk controls |
| §7 (Overall residual risk) | GSPR 8 | R7 — Evaluate overall residual risk with benefit-risk analysis |
| §10 (Production and post-production) | GSPR 8 + PMS requirements | R8 — Review and update risk management with post-market data |
IEC 62304 and ISO 14971 integration
IEC 62304:2006+AMD1:2015 §7 (Software risk management) requires that software risk management activities are integrated into the ISO 14971 risk management process. The relationship is bidirectional:
- ISO 14971 → IEC 62304: The severity of harm identified in the ISO 14971 hazard analysis determines the software safety class under IEC 62304 §4.3. Higher severity leads to higher class (B or C), which triggers more stringent development and testing requirements.
- IEC 62304 → ISO 14971: Software failure modes and their effects, as analyzed in the IEC 62304 software FMEA or FTA, feed back into the ISO 14971 risk file as identified hazardous situations with estimated probabilities based on software reliability.
In practice, the software risk analysis (which satisfies IEC 62304 §7) is typically a software-specific FMEA worksheet that is referenced in the ISO 14971 Risk Management File.
ISO 14971 and software safety class determination
| ISO 14971 severity (after controls) | IEC 62304 software safety class |
|---|---|
| Negligible / no harm possible | Class A |
| Non-serious injury | Class B |
| Serious injury or death | Class C |
IEC TR 24971 — companion guide
IEC TR 24971:2020 is a technical report that provides guidance on applying ISO 14971:2019. It is not a standard and does not create requirements, but provides useful explanatory material including worked examples of risk analysis, guidance on the P1 × P2 probability model, and clarification of the benefit-risk analysis requirements. It is a valuable companion document for any manufacturer implementing ISO 14971:2019 for the first time.
FDA perspective — Design Controls (21 CFR 820.30)
The FDA Design Controls regulation requires risk analysis as part of the design and development process. ISO 14971 is recognized by FDA as the applicable consensus standard. In 510(k) and PMA submissions, manufacturers typically include:
- Declaration of conformity with ISO 14971 (using FDA's Recognized Consensus Standard database)
- Summary of risk management activities and key conclusions
- Reference to the Risk Management Report in the Design History File
FDA's Software as a Medical Device guidance documents reference ISO 14971 for the risk analysis that supports software level of concern determination — the FDA equivalent of IEC 62304 safety classification.
Practical integration checklist
- Risk Management Plan references both ISO 14971 and IEC 62304 (for software devices)
- Software FMEA is included in or referenced from the Risk Management File
- Software safety class assignment cites severity from ISO 14971 hazard analysis
- Post-market surveillance plan feeds back into the risk management process
- Clinical Evaluation Report (MDR requirement) references benefit-risk analysis from ISO 14971
- Risk Management Report documents overall residual risk conclusion with benefit justification