ISO 14971 third edition: what changed in 2019?
ISO 14971:2019 vs. ISO 14971:2007/2012 — key differences and transition requirements
The short answer
The 2019 edition introduced the P1 × P2 probability model, made benefit-risk analysis more prominent, added explicit production and post-production requirements, and the European version additionally carries the informative Annexes ZA and ZB. If your Risk Management File still references ISO 14971:2007 or ISO 14971:2012, it needs to be updated.
Edition timeline
| Edition | Year | Status |
|---|---|---|
| ISO 14971:2000 (1st edition) | 2000 | Withdrawn |
| ISO 14971:2007 (2nd edition) | 2007 | Withdrawn (superseded by 2019) |
| ISO 14971:2007/AMD1:2012 | 2012 | Withdrawn — Amendment 1 aligned 2007 text with European needs |
| ISO 14971:2019 (3rd edition) | 2019 | Current — harmonized under EU MDR and IVDR as EN ISO 14971:2019 |
Key changes in the 2019 edition
1. P1 × P2 probability model
The 2019 edition formalized the two-level probability model. Probability of harm is now defined as the combination of:
- P1 — probability that the hazardous situation occurs
- P2 — probability that the hazardous situation leads to harm (conditional on exposure)
This explicit split was present in practice in many companies but is now required. It is particularly important for software devices where the same software defect may create a hazardous situation but the clinical harm depends heavily on whether clinicians can detect and override an erroneous output (P2 close to 0) or not (P2 close to 1).
2. Benefit-risk analysis — more prominent
The 2019 edition elevated benefit-risk analysis from an appendix concept to a core requirement. ISO 14971:2019 now explicitly requires benefit-risk evaluation of overall residual risk. The Clinical Evaluation Report (required under EU MDR) and the Risk Management Report must be consistent in their benefit-risk conclusions.
3. Production and post-production — explicit clause
ISO 14971:2019 explicitly addresses risk management activities during production and post-production. This includes:
- Setting up procedures to collect post-production information (field complaints, MDRs, literature)
- Reviewing the Risk Management File when post-production information reveals previously unknown hazards or changed risk estimates
- Documenting the review and any resulting RMF updates
4. "Harm" definition expanded
The 2019 edition expanded the definition of harm to explicitly include damage to property and damage to the environment — not just physical injury to people. This broadens the scope of hazard identification for devices with significant environmental impact (e.g., devices containing hazardous substances).
5. The European addition: Annex ZA and ZB (EN version only)
The European version — EN ISO 14971:2019, as amended by EN ISO 14971:2019/A11:2021 — carries two annexes the international version does not: Annex ZA, relating to Regulation (EU) 2017/745, and Annex ZB, relating to Regulation (EU) 2017/746, both informative. They set out how far the standard covers the general safety and performance requirements in Annex I of the respective Regulation — and where it does not. Which coverage applies to your device is something you read in the relevant annex of your own licensed copy; we do not reproduce its content here, because standards text is copyrighted.
What changed vs. ISO 14971:2007/2012
| Area | 2007/2012 requirement | 2019 requirement | Action required |
|---|---|---|---|
| Probability model | Single probability of occurrence | P1 × P2 two-level model | Update FMEA template to include P1 and P2 columns |
| Benefit-risk | Addressed in informative annex | Normative requirement | Add formal benefit-risk section to Risk Management Report |
| Post-production | Mentioned but limited | Explicit normative clause | Create documented procedure for post-market RMF review |
| Harm definition | Focused on patient/user injury | Expanded to property and environment | Review hazard identification to include environmental hazards |
| European addition | Z annexes to the directives then in force | Annex ZA (Regulation (EU) 2017/745) and Annex ZB (Regulation (EU) 2017/746), both informative | Read in your own copy how far the relevant annex covers your requirements — the presumption of conformity reaches no further. |
| Structure | 10 clauses + annexes | 10 clauses + Annexes A, B, C (all informative); the EN version adds Annexes ZA and ZB (also informative) | Review clause references in all RMF documents |
Transition period and current status
EN ISO 14971:2019 was harmonized under EU MDR in early 2020. The Official Journal of the EU published the harmonized standard reference in 2020.
The presumption of conformity holds for as long as the standard's reference remains on the list published in the Official Journal. So check the list in force for which edition it carries — and which edition your technical documentation names.
Transition checklist
| Item | Action | Done? |
|---|---|---|
| Risk Management Plan | Update reference to ISO 14971:2019; add P1/P2 probability approach | ☐ |
| Risk acceptability criteria | Confirm criteria still appropriate; document re-approval date | ☐ |
| FMEA / hazard register | Update to P1 × P2 columns; review all probability estimates | ☐ |
| Risk Management Report | Add an overall residual risk section with benefit-risk conclusion | ☐ |
| Post-market procedure | Create or update procedure for post-production information review | ☐ |
| All RMF documents | Update standard reference from 2007/2012 to 2019 in headers/footers | ☐ |