ISO 14971 third edition: what changed in 2019?
ISO 14971:2019 vs. ISO 14971:2007/2012 — key differences and transition requirements
The short answer
The 2019 edition introduced the P1 × P2 probability model, made benefit-risk analysis more prominent, added explicit production and post-production requirements, and included the ZA annex for EU MDR/IVDR alignment. The transition period for EU MDR ended in 2021. If your Risk Management File still references ISO 14971:2007 or ISO 14971:2012, it needs to be updated.
Edition timeline
| Edition | Year | Status |
|---|---|---|
| ISO 14971:2000 (1st edition) | 2000 | Withdrawn |
| ISO 14971:2007 (2nd edition) | 2007 | Withdrawn (superseded by 2019) |
| ISO 14971:2007/AMD1:2012 | 2012 | Withdrawn — Amendment 1 aligned 2007 text with European needs |
| ISO 14971:2019 (3rd edition) | 2019 | Current — harmonized under EU MDR and IVDR as EN ISO 14971:2019 |
Key changes in the 2019 edition
1. P1 × P2 probability model
The 2019 edition formalized the two-level probability model. Probability of harm is now defined as the combination of:
- P1 — probability that the hazardous situation occurs
- P2 — probability that the hazardous situation leads to harm (conditional on exposure)
This explicit split was present in practice in many companies but is now required. It is particularly important for software devices where the same software defect may create a hazardous situation but the clinical harm depends heavily on whether clinicians can detect and override an erroneous output (P2 close to 0) or not (P2 close to 1).
2. Benefit-risk analysis — more prominent
The 2019 edition elevated benefit-risk analysis from an appendix concept to a core requirement. §7 now explicitly requires benefit-risk evaluation of overall residual risk. The Clinical Evaluation Report (required under EU MDR) and the Risk Management Report must be consistent in their benefit-risk conclusions.
3. Production and post-production — explicit clause
ISO 14971:2019 §10 explicitly addresses risk management activities during production and post-production. This includes:
- Setting up procedures to collect post-production information (field complaints, MDRs, literature)
- Reviewing the Risk Management File when post-production information reveals previously unknown hazards or changed risk estimates
- Documenting the review and any resulting RMF updates
4. "Harm" definition expanded
The 2019 edition expanded the definition of harm to explicitly include damage to property and damage to the environment — not just physical injury to people. This broadens the scope of hazard identification for devices with significant environmental impact (e.g., devices containing hazardous substances).
5. ZA annex added (EN ISO 14971:2019 only)
The European adoption includes a ZA annex that maps standard requirements to EU MDR and IVDR GSPR requirements. Notified bodies in the EU will use the ZA annex as an audit framework. Manufacturers must be able to demonstrate compliance with all R-requirements (R1–R8) listed in the ZA annex.
What changed vs. ISO 14971:2007/2012
| Area | 2007/2012 requirement | 2019 requirement | Action required |
|---|---|---|---|
| Probability model | Single probability of occurrence | P1 × P2 two-level model | Update FMEA template to include P1 and P2 columns |
| Benefit-risk | Addressed in informative annex | Normative requirement in §7 and §8 | Add formal benefit-risk section to Risk Management Report |
| Post-production | Mentioned but limited | Explicit normative clause (§10) | Create documented procedure for post-market RMF review |
| Harm definition | Focused on patient/user injury | Expanded to property and environment | Review hazard identification to include environmental hazards |
| EU regulatory mapping | Z annexes for MDD/AIMD | ZA annex for EU MDR/IVDR | Map RMF documentation to R1–R8 requirements |
| Structure | 10 clauses + informative annexes | 10 clauses + normative annexes + ZA (EN version) | Review clause references in all RMF documents |
Transition period and current status
EN ISO 14971:2019 was harmonized under EU MDR in early 2020. The Official Journal of the EU published the harmonized standard reference in 2020. The transition period for manufacturers to update their compliance from the 2007/AMD1:2012 edition to the 2019 edition ended in 2021.
Since the transition period has ended, all Technical Documentation for EU MDR/IVDR submitted to notified bodies should reference EN ISO 14971:2019. References to ISO 14971:2007 or ISO 14971:2007/AMD1:2012 are no longer accepted as demonstrating conformity with GSPR 8.
Transition checklist
| Item | Action | Done? |
|---|---|---|
| Risk Management Plan | Update reference to ISO 14971:2019; add P1/P2 probability approach | ☐ |
| Risk acceptability criteria | Confirm criteria still appropriate; document re-approval date | ☐ |
| FMEA / hazard register | Update to P1 × P2 columns; review all probability estimates | ☐ |
| Risk Management Report | Add §7 overall residual risk section with benefit-risk conclusion | ☐ |
| Post-market procedure | Create or update procedure for §10 post-production information review | ☐ |
| ZA annex mapping | Create R1–R8 compliance table mapping your RMF documents to ZA requirements | ☐ |
| All RMF documents | Update standard reference from 2007/2012 to 2019 in headers/footers | ☐ |