Thanks! You've successfully subscribed to the BONEZONE®/OMTEC® Monthly eNewsletter!

Please take a moment to tell us more about yourself and help us keep unwanted emails out of your inbox.

Choose one or more mailing lists:
BONEZONE/OMTEC Monthly eNewsletter
OMTEC Conference Updates
Advertising/Sponsorship Opportunities
Exhibiting Opportunities
* Indicates a required field.

ISO 14971 Update Recognized by FDA, Aligned with EU MDR on Risk Management

As 2019 came to a close, the International Organization for Standardization (ISO) released an update to the risk management standard for medical devices, ISO 14971. The 2019 version clarifies previously used terminology, expands some requirements, including for postmarket surveillance, and creates synergies with global regulations.

Until this most recent update, U.S. FDA and Health Canada had recognized the 2007 version of the standard, while the European Commission identified seven discrepancies in its 2012 Annex ZA of EN ISO 14971:2012. ISO 14971:2019 effectively replaces ISO 14971:2007.

Similar to the 2019 standard, the EU MDR risk management requirements provide a detailed, life-cycle approach to medical device regulation. According to ISO, the standard was updated to “better align with changes in medical device regulations around the world,” simplifying the concept of working toward ISO and MDR requirements for companies that sell on a global scale.

“FDA has formally recognized ISO 14971:2019,” said Linda Mummah-Schendel, NAMSA Principal Quality Systems Consultant. “The EU MDR risk management requirements and the new ISO 14971:2019 requirements align. I would highly recommend companies incorporate both MDR risk-related activities and ISO 14971 updates at the same time.”

What’s Changed?

ISO 14971:2019 includes changes to the standard that span from inception to post-production of medical devices and apply to the risk management of both new and existing products.

The new edition comprises 10 clauses and three informative annexes: Annex A, Rationale for requirements; Annex B, Risk Management Process for Medical Devices; and Annex C, Fundamental Risk Concepts. It clarifies the standard’s technical requirements by detailing the steps that manufacturers need to take during a product’s life cycle to stay in compliance.

The following terms have been defined in the updated standard:

Benefit: A positive impact or desirable outcome of the use of a medical device in the health of an individual, or a positive impact on patient management or public health. Benefits can include positive impact on clinical outcome, the patient’s quality of life, outcomes related to diagnosis, positive impact from diagnostic devices on clinical outcomes, or positive impact on public health.

Reasonable Foreseeable Misuse: Use of a product or system in a way not intended by the manufacturer, but which can result from readily predictable human behavior. Readily predictable human behaviour includes the behaviour of all types of users, e.g. lay and professional users. Reasonably foreseeable misuse can be intentional or unintentional.

State of the Art: Developed state of technical capability at a given time in regards to products, processes and services, based on the relevant consolidated findings of science, technology and experience. The state of the art embodies what is currently and generally accepted as good practice in technology and medicine. The state of the art does not necessarily imply the most technologically advanced solution. The state of the art described here is sometimes referred to as the “generally acknowledged state of the art.”

In addition, the standard updated terminology definitions for “harm,” “manufacturer” and “user error” to better reflect modern usage in the market.

Other clarifications are made in the following areas of the standard:

  • Section 5.2 clarifies the requirement to document reasonably foreseeable misuse.
  • Section 10.2 clarifies the requirement to review for possible relevance to safety and includes updates to general state of the art.
  • Section 10.3 separates actions into medical devices and risk processes, and adds consideration of devices already on the market.
  • Several sections include clarifications and updates to their notes.

Additions to the standard include:

  • A method to evaluate the overall risk and the criteria for acceptability of the overall risk shall be included in the Risk Management Plan.
  • Hazardous situations are required to be considered and documented.
  • The requirements to disclose residual risks have been moved and merged into one requirement after the overall residual risk has been evaluated and judged acceptable.
  • In addition to a Risk Management Report, a formal risk review (similar to a design review) is also required.
  • Annex B provides a detailed correspondence between ISO 14971:2007 and ISO 14971:2019.
  • Annex C includes a graphic and information that describes hazards, events and circumstances, the relationship between hazards and foreseeable sequences of events, hazardous situations and harm that can occur.

Postmarket Surveillance Prioritized

Some of the most impactful updates for orthopedic device manufacturers include the requirements surrounding postmarket surveillance.

“The [postmarket surveillance] requirements are much more prescriptive in the new version of the standard, and the MDR also has a lot of detailed requirements,” Mummah-Schendel said. “This is a clear message that these activities are becoming much more important.”

Under the new standard, the method for evaluation of the overall residual risk and criteria for its acceptability are required to be defined in the risk management plan.

“This requires developers to consider upfront what is the acceptable risk rather than just evaluating at the end of the design process, whether there is an acceptable benefit-risk of the product,” Mummah-Schendel said. “Fundamentally, this aligns with the concept of pre-approved acceptance criteria as compared to characterization in testing.”

Manufacturers should note that the changes aim to clarify previous requirements, and no changes have been made to the overall risk management process. It is typical for there to be a three-year transition period for manufacturers to implement and document the updated requirements.

Heather Tunstall is an ORTHOWORLD Contributing Editor.