Medical devices — Application of risk management to medical devices

The standard establishes a repeatable process for identifying hazards associated with a device, estimating and evaluating the associated risks, and implementing control measures. It applies across the lifecycle, from concept through to decommissioning.

Manufacturers must define a risk acceptability policy before evaluating individual risks, and must consider both normal and fault conditions. Risk control follows a defined order of priority: inherently safe design, protective measures in the device or manufacturing process, then information for safety.

Residual risk after controls must be evaluated against the benefit of the intended use, and the overall residual risk of the device judged acceptable. The evaluation is documented in a risk management report that feeds the technical documentation.

The standard requires a system to collect and review production and post-production information, so that new hazards or increased risk are fed back into the risk management file and, where needed, into design or labelling changes.