Written and maintained by CASRAI Editorial Board
Last updated
ISO/TR 24971:2020 (Medical devices — Guidance on the application of ISO 14971) is the official international Technical Report prepared jointly by ISO Technical Committee ISO/TC 210 (Quality management and corresponding general aspects for medical devices) and IEC Subcommittee IEC/SC 62A (Common aspects of electrical equipment used in medical practice). It serves as the primary companion guidance document to the normative risk management standard ISO 14971:2019.
When the third edition of ISO 14971 was published in December 2019, the joint working group transferred the majority of the explanatory guidance and informative annexes that had previously resided in ISO 14971:2007 into the second edition of ISO/TR 24971:2020 (published in June 2020). This architectural split ensures that ISO 14971:2019 defines the mandatory, auditable requirements (shall statements) for a Risk Management File, while ISO/TR 24971:2020 provides the state-of-the-art methodologies, prompting checklists, benefit-risk frameworks, cybersecurity risk links, and in vitro diagnostic (IVD) guidance used by quality engineers, regulatory affairs teams, and notified body auditors.
Structural Relationship Between ISO 14971:2019 and ISO/TR 24971:2020
To allow engineering and quality teams to read both documents side by side, Clauses 4 through 10 of ISO/TR 24971:2020 use the exact same clause and subclause numbering as ISO 14971:2019, integrated within the broader ISO 13485 quality management system and ISO standards for medical devices:
| Clause Number & Title | Normative Requirement in ISO 14971:2019 | Practical Implementation Guidance in ISO/TR 24971:2020 |
|---|---|---|
| Clause 4: General requirements for risk management system | Establish risk management process, management responsibilities, staff competence, Risk Management Plan, and Risk Management File | Defining risk acceptability policy criteria, scaling the Risk Management Plan by device complexity, and maintaining traceability matrices across design controls |
| Clause 5: Risk analysis | Document intended use and reasonably foreseeable misuse, identify safety characteristics, identify hazards and hazardous situations, and estimate risk | Distinguishing use error from abnormal use (aligning with IEC 62366-1), mapping sequence of events from hazard to hazardous situation ($P_1$) to harm ($P_2$), and semi-quantitative probability/severity scales |
| Clause 6: Risk evaluation | Compare estimated risk against risk acceptability criteria defined in the Risk Management Plan | Applying multi-dimensional risk matrices and handling low-probability, high-severity catastrophic harms where numerical probability estimates are uncertain |
| Clause 7: Risk control | Apply priority order of risk control (inherently safe design → protective measures → information for safety), verify implementation/effectiveness, and evaluate residual risk | Executing benefit-risk analysis when residual risk exceeds initial acceptability thresholds, assessing risks introduced by risk control measures, and ensuring risk control completeness |
| Clause 8: Evaluation of overall residual risk | Evaluate the combined impact of all individual residual risks against the clinical benefits of the intended use | Methods for aggregating multiple residual risks (avoiding simple arithmetic summation), using clinical literature and expert panels, and structuring the Overall Residual Risk Statement |
| Clause 9: Risk management review | Review execution of the Risk Management Plan prior to commercial release and generate the Risk Management Report | Structuring the pre-market Risk Management Report for FDA 510(k)/De Novo/PMA or EU MDR/IVDR Technical Documentation audits |
| Clause 10: Production and post-production activities | Collect and review post-market information, evaluate impact on previous risk assessments, and update the Risk Management File | Linking medical device complaint handling, CAPA, and post-market clinical follow-up (PMCF) trend data back to hazard probability ($P_1, P_2$) estimates |
The 8 Informative Annexes of ISO/TR 24971:2020 (Annexes A through H)
The primary engineering value of ISO/TR 24971:2020 lies in its eight detailed informative annexes, which provide concrete templates, hazard taxonomies, and domain-specific guidance:
Annex A: Identification of Hazards and Characteristics Related to Safety
Annex A provides structured 37-question prompting checklists (expanded from the former Annex C of ISO 14971:2007) to help multidisciplinary risk teams uncover latent design and use characteristics that could affect safety. Questions cover chemical composition, biological contact duration, sterilization method, energy delivery, software/algorithmic control, calibration drift, aging/shelf-life degradation, and single-use reprocessing hazards.
Annex B: Techniques That Support Risk Analysis
Annex B details six complementary formal hazard and risk analysis techniques, explaining when to apply top-down (deductive) versus bottom-up (inductive) methods:
- Preliminary Hazard Analysis (PHA): Early-concept inductive screening used during feasibility and architecture phases when detailed schematics or code do not yet exist.
- Failure Mode and Effects Analysis (FMEA / DFMEA / PFMEA): Bottom-up inductive technique that systematically steps through individual hardware components, software modules, or manufacturing process steps to evaluate single-point failure modes (distinct from hospital-workflow Healthcare Failure Mode and Effects Analysis [HFMEA]).
- Fault Tree Analysis (FTA): Top-down deductive boolean logic diagram (AND/OR gates) starting from an undesired top-level hazardous situation or harm and tracing combinations of multiple simultaneous faults.
- Event Tree Analysis (ETA): Forward-looking inductive decision tree mapping the progression from an initiating event through successive mitigation barriers to final clinical outcomes.
- Hazard and Operability Study (HAZOP): Guide-word-driven (e.g., No, More, Less, Reverse, Early, Late) deviation analysis applied to fluidic pathways, drug delivery pumps, and continuous clinical data streams.
- Hazard Analysis and Critical Control Points (HACCP): Process-control methodology monitoring critical manufacturing parameters (such as sterilization cycles or aseptic filling).
Annex C: Risk Management Policy, Acceptability Criteria, and Benefit-Risk Analysis
Annex C guides executive management and clinical affairs teams on establishing objective criteria for risk acceptability under Clause 4.2. It clarifies that ISO 14971:2019 does not mandate an “As Low As Reasonably Practicable” (ALARP) economic region (to align with EU Medical Device Regulation 2017/745 Annex I General Safety and Performance Requirements, which require reducing risks “as far as possible” without economic trade-offs). It also provides structured clinical criteria for conducting a benefit-risk analysis when a high residual risk cannot be further reduced by design or protective measures.
Annex D: Information for Safety vs. Disclosure of Residual Risk
Annex D resolves one of the most frequent regulatory audit findings: conflating Information for Safety (Clause 7.1(c)—a risk control measure such as a specific warning or contraindication in the Instructions for Use [IFU] or user interface that requires user action to prevent a hazardous situation, and whose effectiveness must be validated via usability testing under IEC 62366-1) with Disclosure of Residual Risk (Clause 8—background clinical risk information provided so clinicians and patients can make an informed benefit-risk decision, which is not a risk control and does not lower the estimated risk score).
Annex E: Role of International Standards in Risk Management
Annex E explains how conforming to horizontal and vertical product safety standards (such as IEC 60601-1 for medical electrical equipment, ISO 10993 for biocompatibility, or IEC 62304 for medical device software lifecycle processes) simplifies risk evaluation and risk control verification. Where an international product standard establishes quantitative limits (such as leakage current or thermal limits), meeting that limit serves as prespecified evidence of risk control adequacy for that specific hazard.
Annex F: Guidance on Risks Related to Data and Systems Security (Cybersecurity)
Added in the 2020 edition, Annex F bridges safety risk management (ISO 14971) and medical device cybersecurity risk management (such as AAMI TIR57, AAMI SW96, and IEC 81001-5-1). It emphasizes that intentional threat exploits (unauthorized access, malware, denial of service, or tampering with sensor/AI model inputs) are analyzed using threat modeling and vulnerability scoring (rather than random hardware failure probabilities), while any security exploit that can lead to patient or operator physical harm, delayed diagnosis, or incorrect therapy must feed directly into the ISO 14971 safety Risk Management File.
Annex G: Components and Devices Designed Without Using ISO 14971
Annex G provides a structured methodology for integrating Off-The-Shelf (OTS) hardware, Software of Unknown Provenance (SOUP), open-source machine learning libraries, or legacy devices originally developed prior to ISO 14971 adoption, using gap analyses, post-market field reliability data, and black-box verification testing.
Annex H: Guidance for In Vitro Diagnostic (IVD) Medical Devices
Annex H (superseding the former Annex H of ISO 14971:2007) tailors the risk management lifecycle to IVD assays, analyzers, and companion diagnostics. Because IVDs operate on specimens outside the human body, primary patient harms arise through indirect pathways: false-positive results (leading to unnecessary invasive procedures or toxic therapies), false-negative results (leading to delayed or withheld life-saving treatment), or delayed/unavailable results in critical care settings. Annex H details how analytical performance characteristics (limit of detection, analytical specificity, interfering substances, hook effect, and lot-to-lot reagent stability) connect to clinical risk evaluation by laboratory directors and ordering clinicians.
Regulatory Recognition and Audit Expectations (FDA & EU MDR/IVDR)
Although ISO/TR 24971:2020 is an informative Technical Report rather than a normative standard, both the U.S. Food and Drug Administration (CDRH Recognized Consensus Standard) and European Union Notified Bodies under Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR) evaluate manufacturer Risk Management Files against the methodologies described in ISO/TR 24971:2020.
Frequently Asked Questions
What is ISO/TR 24971?
ISO/TR 24971:2020 (Medical devices — Guidance on the application of ISO 14971) is the official international Technical Report published by ISO/TC 210 and IEC/SC 62A that provides practical guidance, analytical methodologies, and domain-specific examples for implementing a medical device risk management system in accordance with the normative standard ISO 14971:2019.
Why were the informative annexes moved from ISO 14971 into ISO/TR 24971:2020?
During the third edition revision of ISO 14971:2019, ISO and IEC transferred the extensive explanatory guidance and most informative annexes from ISO 14971:2007 into ISO/TR 24971:2020. This separation kept ISO 14971:2019 strictly focused on auditable normative (shall) requirements while allowing ISO/TR 24971:2020 to expand practical implementation guidance—including new annexes on data and systems cybersecurity (Annex F) and legacy/unregulated components (Annex G)—without altering the normative text.
Is compliance with ISO/TR 24971 mandatory for FDA and EU MDR submissions?
Because ISO/TR 24971:2020 is a Technical Report rather than a normative standard, it contains informative guidance (should or can) rather than mandatory shall clauses. However, both the U.S. FDA (as a CDRH-recognized consensus standard) and European Notified Bodies treat ISO/TR 24971:2020 as the recognized state-of-the-art reference for evaluating whether a manufacturer’s ISO 14971:2019 Risk Management File is methodologically sound.
