Sri Lanka ISO 14971 Risk Management Report Requirements

1. Key takeaways

The Sri Lankan PRD dossier explicitly requires a risk analysis report compiled according to ISO 14971. Its position within the document system is as follows: it reconciles item by item with the Essential Principles Checklist, corroborates the technical descriptions in the STED, and where necessary joins the biological evaluation, electrical safety, and sterilisation validation special reports to form a complete chain of argumentation. The risk analysis report is therefore not a standalone deliverable that can be written and forgotten; it is the connective tissue of the whole technical dossier. Every hazard identified in it must be answered somewhere — by a design measure described in the STED, by a test result in a special report, or by a control stated in the labelling. When that linkage is maintained deliberately, the dossier reads as a single coherent argument; when it is not, reviewers find the gaps quickly, because the gaps show up as risks mentioned in one document with no visible counterpart in any other. This is also why the risk report is best drafted early, before the special reports are commissioned, since its outputs define what those reports must cover.

• An ISO 14971 risk analysis report is an explicit PRD requirement under GL-034, effective 2025-07-23.
• The risk report reconciles with the Essential Principles Checklist (GHTF specification) and corroborates the STED.
• Special reports — biological evaluation, clinical evaluation, IEC electrical safety and EMC, sterilisation validation — are added as needed according to the risk outputs.
• General devices are classified Class I, IIa, IIb, or III; IVDs are classified Class A to D under GL-037, effective 2026-05-13; assessment is performed by MDEC.

2. Legal basis

The risk management requirement and its companion documents derive from GL-034, which took effect on 2025-07-23. The classification classes referenced below derive from GL-037, which took effect on 2026-05-13, and the assessment body reference comes from the NMRA website. The classification classes matter here for a practical reason: the class determined under GL-037 shapes the reviewer’s expectations of how exhaustive the risk analysis must be, and the special supplements listed in the table are only triggered when the risk outputs of the device call for them. The table should therefore be read as a decision aid — establish the class, establish the risk profile, and only then fix the list of special reports that the dossier will carry.

3. Expert insights

Insight one: the risk management report is a document that runs through the dossier, not an isolated file. Upward, it answers the reconciliation demands of the Essential Principles Checklist; downward, it guides the selection of special test items. Every risk identified in the analysis should have a corresponding argument in some technical document. If the report identifies a hazard related to, for example, patient contact, then the biological evaluation must address that contact; if it identifies an electrical hazard, the IEC report must address it. When this mapping is complete, the reviewer can trace any risk from identification to control without asking questions. When it is incomplete, the reviewer generates deficiency notices item by item, and the cost of responding far exceeds the cost of building the mapping in the first place.

Insight two: the scope of special testing is decided by the risk analysis. Products contacting human tissue or blood need biological evaluation; active equipment needs IEC electrical safety and EMC; sterile products need sterilisation validation. These are not cases of everything being required; they are determined by the risk outputs. This principle protects manufacturers from over-testing as much as from under-testing: a device with no tissue contact does not need a biological evaluation programme merely because other products in the portfolio have one. The discipline is to let the risk analysis drive the test plan, and to document that derivation so the reviewer can see why each test was included or omitted.

Insight three: software devices have their own special provisions. GL-034 specifies additional evidence items for software devices and requires a software verification and validation report. Products containing software must prepare this separately, in addition to the risk analysis. Software risk — including failure behaviour and the consequences of incorrect outputs — should be addressed within the ISO 14971 analysis, but the analysis alone does not discharge the software evidence requirement. The two deliverables coexist and should be drafted by people who understand both the device and the software lifecycle.

4. Practical recommendations

• GRZAN’s approach when compiling risk management documentation is three-way alignment: every risk in the risk analysis report must have a corresponding entry in the Essential Principles Checklist, a corresponding argument in the STED or a special report, and a corresponding warning or statement in the labelling or instructions for use.
• When all three directions align, the technical logic of the dossier is self-consistent — this is the internal quality gate applied before any submission.
• Maintain the alignment as a living table during preparation, so that revisions to any document immediately show which of the three legs needs updating.
• For software-containing products, confirm early whether the software verification and validation report is triggered, and assign it to the same revision cycle as the risk analysis.

5. Verification checklist

• □ Risk analysis report compiled according to ISO 14971
• □ Every risk mapped to an Essential Principles Checklist entry
• □ Every risk traceable to a technical argumentation source
• □ Labelling and instructions contain the corresponding warnings
• □ Software-containing products attach a software verification and validation report

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com