ISO 14971:2019 is still the current edition: ISO confirmed it on 7 March 2025, and no revision is under way. Under the EU MDR and IVDR it is a harmonised standard, EN ISO 14971:2019+A11:2021, and FDA recognises it in full, although the QMSR does not require it.
This guide is for regulatory and quality managers building one risk file for the EU, the US and the Gulf.
Is ISO 14971:2019 still current, and what is changing in the 24971 guidance?
ISO published the third edition, developed by ISO/TC 210, in December 2019, replacing the 2007 edition. ISO lists no amendment and no planned replacement. The standard sets a risk management process across the whole device life cycle, including software as a medical device and IVD devices. The guidance documents around it are changing.
- ISO/TR 24971:2020 is a Technical Report, so it gives guidance, not requirements. ISO has marked it "to be revised" since 6 July 2026.
- Its replacement, ISO/TS 24971-1, was registered as a new project the same day. At stage 20.00, the preparatory stage, it is under development and not yet published.
- ISO/TS 24971-2:2026 on machine learning was published on 17 June 2026.
- ISO/CD TS 24971-3 would cover combination products, applying ISO 14971 with ICH Q9. It is a committee draft, and its comment period closed on 26 September 2026.
If your file cites ISO/TR 24971:2020 today, that is still the published guidance.
FDA's recognition record and MDR Article 2(23) both define risk as the combination of the probability of harm and its severity. This is product risk. For enterprise risk, see our guide to ISO 31000 and IEC 31010.
What must the risk management file show under the EU MDR?
EN ISO 14971:2019 with A11:2021 is item 16 in the MDR list of harmonised standards, Implementing Decision (EU) 2021/1182, added by Decision 2022/757. It is item 10 in the IVDR list, Decision 2021/1195, added by Decision 2022/729. Both entries were still listed in the consolidated versions of 17 June 2026.
Under MDR Article 8(1), conformity with a harmonised standard gives a presumption of conformity, including for risk management. Article 10(2) requires a risk management system as described in Annex I §3. Annex I §1 and §2 add that risks must be acceptable against the benefits and reduced as far as possible without harming the benefit-risk ratio.
The table maps the MDR duties to Saudi MDS-REQ 1 and to the usual records. FDA has no equivalent list.
| Duty | EU MDR | SFDA MDS-REQ 1, Annex (3) §5 | Record in the file |
|---|---|---|---|
| Plan for each device | Annex I §3(a) | Plan with responsibilities, review requirements, acceptability criteria from your policy, and verification | Risk management plan |
| Identify and analyse hazards | §3(b): known and foreseeable hazards | Risk analysis | Hazard analysis |
| Estimate and evaluate risks | §3(c): intended use and reasonably foreseeable misuse | Risk analysis, with evaluation set in the procedure | Risk estimation and evaluation records, such as an FMEA |
| Control risks | §3(d) and §4: safe design first, then protection measures, then information for safety | Procedure covers risk control | Control measures and their verification |
| Accept residual risk | §4: each hazard and overall, with users informed | Report confirms overall residual risk is acceptable | Overall residual risk evaluation |
| Use production and post-market data | §3(e) and (f) | Procedure, plan and report cover production and post-production information | Post-market inputs and file updates |
| Technical documentation | Annex II §5: benefit-risk analysis and risk management results | Procedure, plan, analysis and report, where the last three may be combined | Benefit-risk analysis and risk management report |
Annex I §3 calls risk management a continuous iterative process with regular updating. A file that stops at design transfer does not show that.
The Commission's targeted MDR and IVDR revision, COM(2025) 1023 of 16 December 2025, is proposed, not adopted. We found no change to the Annex I §3 risk wording in it.
Does the FDA QMSR require ISO 14971?
No. The QMSR, in force since 2 February 2026, incorporates ISO 13485:2016 into 21 CFR Part 820 by reference. In the final rule's preamble (response to Comment 9), FDA said it does not incorporate ISO 14971 or the other standards ISO 13485 refers to, though they may help in understanding it.
Risk management is still required. FDA's QMSR page says that incorporating ISO 13485:2016 "now specifically requires risk management". The preamble gives clauses 4.1, 7.1, 7.3, 7.4, 7.5, 7.6 and 8.2 as examples and calls this no shift in philosophy. Our ISO 13485:2016 guide covers that QMS.
In a CDRH Learn webinar on 14 January 2026, FDA panellists said you may use any appropriately validated risk management process, and that FDA requires neither specific risk tools nor ISO 14971. That is a webinar transcript, not regulation.
ISO 14971 still matters for premarket work. FDA recognises the 2019 edition as a complete standard under recognition number 5-125, so you can cite it in a declaration of conformity. FDA also notes that ISO 13485:2016 itself refers to the 2007 edition.
What did FDA inspectors cite in 2026?
Two CDRH warning letters from 2026 show what inspectors look for. Both cite ISO 13485:2016 clause 7.1 for risk management failures. Neither cites ISO 14971. A warning letter is FDA's notice of violations, not a final court finding.
Koven Technologies, 21 July 2026: the risk management reports for two fetal dopplers did not evaluate risks to the fetus, although both are labelled for fetal heart rate. FDA said it could not yet judge whether the response was adequate.
Lion Street Medical, trading as Pensar Medical, 21 August 2026: risk control verification in a design FMEA was still "In Progress". The firm's own procedure required a uFMEA, dFMEA and pFMEA for every product, yet none existed for its WoundPro devices. High-risk software verification was also unfinished, and FDA found three responses not adequate.
Inspectors read the file against your label and your own procedure. Check that the hazard analysis covers every labelled population, that every control is verified, and that every analysis your procedure demands exists.
What do SFDA and EDE expect in the Gulf?
In Saudi Arabia, MDS-REQ 1 Version 6.0 of 19 December 2021 sets the requirements for a Medical Device Marketing Authorization. Its Essential Principle 3 repeats MDR Annex I §3 almost word for word. One file can therefore follow the same structure for Riyadh and Brussels, though each regulator makes its own decision.
Annex (3) §5 sets the minimum: a procedure, a plan, a risk analysis and a report. The report confirms the activities were done as planned, overall residual risk is acceptable and post-market information is collected. People doing risk tasks need suitable knowledge and experience. Annex (4) repeats this for IVDs.
MDS-REQ 1 points to SFDA's adopted ISO 14971. The adoption notice on SFDA's site is for the 2007 edition, and we could not confirm a 2019 adoption. If you work to the 2019 edition, ask SFDA which edition it expects.
In the UAE, the Emirates Drug Establishment (EDE) calls itself the only federal regulator of medical and pharmaceutical products, including devices. Federal Decree-Law No. (38) of 2024, in force since 2 January 2025, requires medical product manufacturers and contract manufacturers to follow the quality management standards and GMP controls EDE issues and approves (Article 127). The law does not name ISO 14971, and EDE's legislation page listed no device risk guideline on 4 October 2026.
How do cybersecurity and machine learning change the file?
FDA's note on recognition 5-125 cites its February 2026 premarket cybersecurity guidance: the probability-based risk model does not apply to cybersecurity. Exploitability, meaning how feasible it is to exploit a vulnerability, is the basis for estimating security risk. A file that scores security threats on the same probability scale as safety hazards invites questions.
For machine-learning devices, ISO/TS 24971-2:2026 explains AI and ML risks and how to apply the ISO 14971 process, alongside ISO/TR 24971. It does not apply to devices that use large language models or generative AI.
How AGS can help
The ISO 14971:2019 Medical Device Risk Management System holds 367 editable Microsoft Word and Excel documents, using ISO/TR 24971:2020 as guidance. It includes a Risk Management Plan Template, Master Risk Register, Design FMEA Template, Benefit-Risk Analysis Report, Overall Residual Risk Evaluation Report, a clause-to-document matrix and an EU MDR Annex I Risk Management Matrix. Nine conditional modules cover cases such as software, cybersecurity, usability and IVDs. It has no FDA, SFDA or EDE content.
Frequently asked questions
Does ISO 14971 set acceptable risk levels?
No. You set the criteria for risk acceptability, based on your own policy. SFDA's MDS-REQ 1 takes the same approach for the plan's acceptability criteria.
Does ISO 14971 require a quality management system?
No. FDA's recognition record says it does not, although risk management can sit inside one. The ISO/TS 24971-1 project, still under development, names an ISO 13485:2016 QMS as an example.
Does ISO 14971 apply to clinical decisions?
No. FDA's record of the scope says it does not apply to clinical decision making. It covers the device's hazards and risks.
AGS provides independent documentation toolkits. This guide and the referenced kit are designed to support ISO 14971:2019 and related regulatory requirements. They are not affiliated with, endorsed by or approved by ISO, the US FDA, the European Commission, the Saudi Food and Drug Authority or the Emirates Drug Establishment. It is general information, not legal, regulatory or medical advice.
Reviewed October 2026. Facts checked against the sources current at publication.
