ISO 14971 third edition is released in December 2019 which cancels and replaces ISO 14971 second edition. Overall, there is not much change has occurred as the risk management process itself remains largely unchanged. However , there are important clarifications and updates in ISO 14971:2019 which are as below.
Similarly ISO TR 24971 second edition cancels and replaces ISO TR 24971 first edition. The new ISO/TR 24971:2020 is been expanded to include more guidance, explanation and examples of the risk management process requirements. The production and post-production section is expanded to multiple points.
What is new to ISO 14971:2019 ?
- General language improvements for readability
- Medical devices involve an inherent degree of risk
- Recognizes other specific safety standards, e.g. IEC 60601-1, IEC 62304, etc.
- Introduction
- Gives permission to use ISO 14971 for devices which are not considered medical devices in some jurisdictions; also applies to suppliers
- Scope of injury is expanded from people to data and property
Scope
Software as a medical device is included in the scope of ISO 14971
Gives examples of risks e.g., associated with: biocompatibility, security, usability, etc.
Requires the manufacturer to establish objective criteria for risk acceptability
Business risk is excluded
Clinical decision on whether to use a medical device in a procedure is excluded
Business risk management is excluded
Points to ISO/TR 24971 for guidance on how to apply ISO 14971
- Clause 3 : Terms and Definitions
- Provides reference to online terminological databases in IEC www.electropedia.org and ISO www.iso.org/obp
- Changed reference from Guide 51 to Guide 63
- Guide 51 is – ISO/IEC Guide titles : Safety aspects — Guidelines for their inclusion in standards released as third edition – April 2014 and provides practical guidance to drafters of standards to assist them in including safety aspects in standards
- But Guide 63 is titled : Guide to the development and inclusion of aspects of safety in International Standards for medical devices. Third edition released in August 2019 and provides requirements and recommendations to writers of medical device standards
- 3.1 Definition of Documentation is expanded to include auditory, tactile and visual materials and multiple media types. Also scope of documentation is expanded beyond IFU to installation manual, quick reference guides, etc.
- 3.2 Definition of Benefit is added.
- “positive impact or desirable outcome of the use of a medical device on the health of an individual, or a positive impact on patient management or public health
Note 1 : Benefits can include positive impact on clinical outcome, the patient’s quality of life, outcomes related to diagnosis, positive impact from diagnostic devices on clinical outcomes, or positive impact on public health.”
- “positive impact or desirable outcome of the use of a medical device on the health of an individual, or a positive impact on patient management or public health
3.6 Definition of Intended use is expanded to Intended use, intended purpose
Note 1 gives examples of what’s included: intended medical indication, patient population, part of the body or type of tissue interacted with, user profile, use environment, and operating principle
3.9 Definition of Manufacturer is expanded with 7 notes to entry.
Definition of Manufacturing is expanded in detail which defines who is not a manufacturer
3.15 Definition of Reasonably Foreseeable Misuse is added.
use of a product or system in a way not intended by the manufacturer, but which can result from readily predictable human behaviour.
Note 1 – Readily predictable human behaviour includes the behaviour of all types of users, e.g. lay and professional users.
Note 2 – Reasonably foreseeable misuse can be intentional or unintentional.
- 3.28 Definition of State of the Art is added
“developed stage of technical capability at a given time as regards products, processes and services, based on the relevant consolidated findings of science, technology and experience
Note 1 – The state of the art embodies what is currently and generally accepted as good practice in technology and medicine. The state of the art does not necessarily imply the most technologically advanced solution. The state of the art described here is sometimes referred to as the generally acknowledged state of the art”
- 3.30 Notes to the definition of Use Error are modified
- Note 1 – Use error includes the inability of the user to complete a task
- Note 3 – Users might be aware or unaware that a use error has occurred
- Note 5 – A malfunction of a medical device that causes an unexpected result is not considered a use error
- 3.31 Notes to the definition of Verification are modified.
- Note 1 – The objective evidence needed for a verification can be the result of an inspection or of other forms of determination such as performing alternative calculations or reviewing documents.
- Note 2 – The activities carried out for verification are sometimes called a qualification process
- Section 3.2 Management Responsibilities is now changed to Sec 4.2 Management Responsibilities having 2 notes
- Note 1 – The manufacturer’s policy for establishing criteria for risk acceptability can define the approaches to risk control: reducing risk as low as reasonably practicable, reducing risk as low as reasonably achievable, or reducing risk as far as possible without adversely affecting the benefit-risk ratio. See ISO/TR 24971[9] for guidance on defining such policy
- Note 2 – The results of reviewing production and post-production information can be an input to the review of the suitability of the risk management process.
- Section 3.3 Qualification of personnel is now Section 4.3 Competence of personnel i.e ‘Knowledge and experience’ is replaced with ‘ competence on the basis of education, training, skills and experience appropriate to the tasks’
- Section 3.4 Risk Management Plan is now Section 4.4 Risk Management Plan with paragraph (e) has been added regarding the min. requirements for an RMP which is defined as ” a method to evaluate the overall residual risk, and criteria for acceptability of the overall residual risk based on the manufacturer’s policy for determining acceptable risk;”
NOTE 2 – The method to evaluate the overall residual risk can include gathering and reviewing data and literature for the medical device being considered and similar medical devices on the market and can involve judgment by a cross-functional team of experts with application knowledge and clinical expertise.
Section 4.2 Intended use and identification of characteristics related to the safety of the medical device is split into Sec 5.2 and 5.3. A new paragraph is added as below:
The intended use should take into account information such as the intended medical indication, patient population, part of the body or type of tissue interacted with, user profile, use environment, and operating principle.
- Sec 5.2 Intended use and reasonably foreseeable misuse has a note which ‒Note 1, refers to IEC 62366-1, sec 3.23, as a source to determine Intended Use
- Sec 5.3 Identification of characteristics related to safety
- Section 4.3 Identification of hazards is now “Section 5.4 Identification of hazards and hazardous situations“
The manufacturer shall identify and document known and foreseeable hazards associated with the medical device based on the intended use, reasonably foreseeable misuse and the characteristics related to safety in both normal and fault conditions.
Section 4.4 Estimation of the risk(s) for each hazardous situation is now Section 5.5 Risk estimation with a note
Note 1 – … when the harm is minimal, an initial hazard and consequence analysis could be sufficient, or when insufficient information or data are available, a conservative estimate of the probability of occurrence can give some indication of the risk…
- Section 5 Risk evaluation is now Section 6 Risk evaluation with changes
For each identified hazardous situation, the manufacturer shall
decideevaluate the estimated risks and determine if the risk is acceptable or not, using the criteria for risk acceptability defined in the risk management plan,if risk reduction is required.If the risk is acceptable, it is not required to apply the requirements given in 7.1 to 7.5 to this hazardous situation … and the estimated risk shall be treated as residual risk.
- Section 6.2 Risk Control Option Analysis is now Section 7.1 Risk Control Option Analysis with changes as below
Old: a) inherent safety by design ‒New: a) inherently safe design and manufacture
Old: c) information for safety ‒New: c) information for safety and, where appropriate, training to users
- New Sec 7.2 Implementation of risk control measure(s) with New Notes
NOTE 1 Verification of implementation can be performed as part of design verification or process qualification within a quality management system.
NOTE 2 Verification of effectiveness can be performed as part of design validation within a quality management system, and can include testing with users, for example by usability testing (see IEC 62366-1), by clinical investigation of medical devices (see ISO 14155 [6]) or by clinical performance studies for in vitro diagnostic medical devices (see ISO 20916).
NOTE 3 Verification of effectiveness can also be performed as part of design verification or process qualification, if the relationship between the effectiveness in risk reduction and the result of design verification or process qualification is known.
EXAMPLE 1 – Design verification of a certain product performance characteristic, such as dose accuracy of a drug injector, can serve as verification of effectiveness of risk control measures ensuring safe drug dosing.
EXAMPLE 2 – Process qualification can serve as verification of effectiveness of risk control measures related to risk caused by variations in production output.
NOTE 4 See ISO 13485 [5] for more information on design and development verification and validation. See also ISO/TR 24971 [9] for more guidance.
- Section 6.4 Residual risk evaluation is now Sec 7.3 Residual risk evaluation
Paragraph deleted from 6.4: For residual risks that are judged acceptable, the manufacturer shall decide which residual risks to disclose and what information is necessary to include in the accompanying documents in order to disclose those residual risks.
Disclosure of residual risk is now limited to disclosure of overall residual risks in Section 8.
- Section 6.5 Risk/benefit analysis is now Sec 7.4 Benefit-risk analysis with sentence changes as below
“If this evidence does not support the conclusion that the medical benefits outweigh the residual risk, then the risk remains unacceptable.”
Is now
“If this evidence does not support the conclusion that the medical benefits outweigh this residual risk, then the manufacturer may consider modifying the medical device or its intended use. Otherwise, this risk remains unacceptable.”
- Section 7 Evaluation of overall residual risk acceptability is now Sec 8 Evaluation of overall residual risk
New text : “If the overall residual risk is not judged acceptable in relation to the benefits of the intended use, the manufacturer may consider implementing additional risk control measures (go back to 7.1) or modifying the medical device or its intended use (go back to 5.2). Otherwise, the overall residual risk remains unacceptable.”
- Section 8 Risk management report is now Section 9 Risk management review
Sentence: “Prior to release for commercial distribution of the medical device, the manufacturer shall carry out a review of the risk management process.”
Is now
“Prior to release for commercial distribution of the medical device, the manufacturer shall review the execution of the risk management plan.”
- Section 9 Production and post-production information is now Section 10 Production and post-production activities with expanded and new sections
The manufacturer shall establish, document and maintain a system to actively collect and review information relevant to the medical device or similar devices in the production and the post-production phases.
- New section: 10.2 Information collection
The manufacturer shall collect, where applicable:
information generated during production and monitoring of the production process;
information generated by the user;
- information generated by those accountable for the installation, use and maintenance of the medical device.
information generated by the supply chain;
publicly available information; and
information related to the generally acknowledged state of the art.
New section: 10.3 Information review
- The manufacturer shall review the information collected for possible relevance to safety, especially whether
- previously unrecognised hazards or hazardous situations are present;
- an estimated risk arising from a hazardous situation is no longer acceptable;
- the overall residual risk is no longer acceptable in relation to the benefits of the intended use; or
- the generally acknowledged state of the art has changed.
- The manufacturer shall review the information collected for possible relevance to safety, especially whether
- New section: 10.4 Actions
If the collected information is determined to be relevant to safety, the following actions apply.
- Concerning the particular medical device
the manufacturer shall review the risk management file and determine if reassessment of risks and/or assessment of new risks is necessary;
if a residual risk is no longer acceptable, the impact on previously implemented risk control measures shall be evaluated and should be considered as an input for modification of the medical device;
the manufacturer should consider the need for actions regarding medical devices on the market; and
any decisions and actions shall be recorded in the risk management file.
Concerning the risk management process,
the manufacturer shall evaluate the impact on previously implemented risk management activities; and
the results of this evaluation shall be considered as an input for the review of the suitability of the risk management process by top management (see 4.2).
- Concerning the particular medical device
- Old Annex C with 32 questions for safety characterization is moved to ISO/TR 24971 Annex A, and is now 36 questions
- Old Annex E, List of Hazards has been improved and moved to Annex C.1 of ISO 14971:2019
- ISO/TR 24971 has grown, 20 → 102 pages