Risk Management with ISO 14971 in Canadian Dossiers

1. Key takeaways

Risk management in a Canadian dossier is typically performed using ISO 14971 as the method standard. What Health Canada and the MDSAP audit look for is not the existence of a risk file but a closed loop: each risk linked to a control measure and each control measure linked to verification evidence, in three columns that close without gaps. The risk management output must also connect to the surrounding regulatory obligations — the safety requirements of sections 10 to 20 of the Medical Devices Regulations, the labelling requirements of sections 21 to 23, and the post-market monitoring obligations of sections 59 to 61. Risk management is a component of design control and a fixed focus point of the MDSAP audit, so the quality of this loop is tested twice: once by the reviewer of the dossier and once by the auditor of the quality system.

• ISO 14971 is the customary method standard for risk management in Canadian dossiers.
• The expected structure is a closed three-column chain: risk, control measure, verification evidence.
• Outputs must close the loop with sections 10 to 20 (safety), 21 to 23 (labelling) and 59 to 61 (post-market reporting).
• Risk management is part of design control and a fixed MDSAP audit focus.
• Class I devices are not exempt: section 25 allows the Minister to demand analysis and order a sales stop.

2. Legal basis

The sources for this article combine the applicable provisions of the Medical Devices Regulations, the consensus standard used as the method framework, and one item drawn from industry compilation. The Regulations provisions were verified against Justice Laws; the consensus standard status of ISO 14971 should be kept visible wherever the standard is cited, since it informs rather than replaces the regulatory text.

3. Expert insights

Insight 1: the external interface of risk management is the labelling and the instructions for use.

Under section 21(1)(h)(i), the label must state the medical conditions, purposes and uses that are not immediately apparent to the intended user, together with the performance specifications and the instructions for use needed for correct and effective use. This provision is the regulatory anchor for risk communication. Residual risks that the risk analysis determines must be conveyed through the labelling should be findable, as corresponding text, in exactly these two places: the label and the instructions for use. If a risk file identifies a residual risk that no label text addresses, or if the label carries warnings that cannot be traced back to any risk analysis entry, the loop is broken in one direction or the other. Reviewers and auditors both sample these cross-references, so maintaining a live index between the risk file and the labelling texts is the practical way to keep the interface intact.

Insight 2: the internal interface of risk management is post-market monitoring.

Under section 59(1), manufacturers and importers have reporting obligations for incidents involving a failure of the device, a decrease in its effectiveness, or a deficiency in its labelling or instructions for use. These incident categories are precisely the input stream that risk management standards describe as post-production information. The two ends must be connected: incident and complaint records should be reviewed at defined intervals for signals that change the risk assessment, and any resulting changes should flow back into the risk file, the design outputs and, where relevant, the labelling. A reporting system that sends information nowhere is a compliance burden without a benefit; a reporting system wired into risk management turns the same records into evidence that the risk loop stays closed after the device reaches the market.

Insight 3: risk management for Class I devices can also be sampled.

Under section 25(1), if the Minister, on the basis of a report or information obtained by the Minister, has reasonable grounds to believe that a Class I device may not meet the applicable requirements of sections 10 to 20, the Minister may require the manufacturer to submit analyses or other information by a specified date. Under section 25(2), if the manufacturer fails to comply by that date, the Minister may direct that sales of the device be stopped. The lesson for Class I manufacturers is direct: Class I status removes the licence requirement, not the documentation expectation. Analyses that can be produced on demand — risk evaluations, test evidence, rationale for design choices — should exist as a matter of routine, because the power to demand them is not theoretical and the consequence of non-compliance is a sales stop.

Insight 4: ISO 14971 is a consensus standard, not a provision of the Regulations.

When ISO 14971 is cited in a dossier or in quality system documentation, it should be identified as a consensus standard rather than as a mandatory provision of the Regulations. Its role is to provide the methodological framework — hazard identification, risk estimation, risk evaluation, control and residual risk acceptance — within which the regulatory requirements are met. Citing it accurately prevents a subtle but real error: treating the standard as if its clauses were themselves legal duties, or conversely assuming that following the standard alone discharges the regulatory obligations. The Regulation clauses are the duties; the standard is the widely accepted way of demonstrating that the duties are fulfilled.

4. Practical recommendations

• Organise the risk management documentation in the three-column structure of risk, control measure and verification evidence.
• Check residual risks one by one against the label and the instructions for use (section 21(1)(h)(i)).
• Establish a feedback mechanism that routes post-market incidents back into the risk management file (inputs from sections 59 to 61).
• Prepare, for Class I devices as well, analyses that can be produced on demand under section 25.
• When citing ISO 14971, label it consistently as a consensus standard.

5. Verification checklist

• □ The risk management documentation uses the three-column structure of risk, control measure and verification evidence.
• □ Residual risks have been checked one by one against the labelling and instructions for use.
• □ A feedback mechanism from post-market incidents to the risk management file is in place.
• □ For Class I devices, analyses capable of answering a section 25 request have been prepared.
• □ Citations of ISO 14971 identify it as a consensus standard.
• □ Risk management records are traceable to specific device versions.

Regulatory information verified as of October 28, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Canadian market. Our team manages Health Canada Medical Device Licence and MDEL applications, prepares risk-classified dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com