Risk Management Report and Safety Alert Report: Article 6.3.2.1 k) and l)

1. Key takeaways

Article 6.3.2.1 k) and l) of RTS 11.03.02:21 require the registration dossier to contain two separate reports: the risk management report (Informe de gestión de riesgo) under item k, and the safety and health alert report (Informe de seguridad y alertas sanitarias) under item l. The first corresponds to the principle in article 5.2.1 b), which requires known and foreseeable risks to be identified and reduced in design, production and use. The second corresponds to article 6.3.6 a), under which a device subject to an international health alert may be refused approval.

Article 3.23 defines risk management as the systematic application of policies, procedures and practices to the tasks of analysing, evaluating, controlling and monitoring risk. That definition matters for drafting: the report required by item k is assessed as evidence of a process, not as a statement that the product is safe. The two reports look in opposite directions, and the regulation keeps them as separate items rather than as sections of one document.

• Two distinct reports are required, one for risk management and one for safety and health alerts.
• The risk management report is forward looking: it addresses risks that have not yet materialised.
• The alert report is backward looking: it addresses facts that already exist.
• A product under an international health alert may be refused approval under article 6.3.6 a).
• Concealment of an existing alert falls under the false data ground in article 6.3.6 c).
• Both reports are revisited after approval, during testing and vigilance activity.

2. Legal basis

The two reports draw on the terminology articles, on the essential principles in article 5.2.1 and on the refusal grounds in article 6.3.6. The table below maps each provision to the obligation it creates, so that the report structure can be justified provision by provision rather than by general practice.

3. Expert insights

First insight: the two reports have different jobs and cannot be merged. The risk management report addresses risks that have not yet occurred, covering identification, evaluation, control and monitoring. The safety and alert report addresses facts that have already occurred, namely the existing safety situation of the product and any health alert attached to it. One is prospective and the other retrospective, and the reviewer assesses them on two separate dimensions: whether risk is systematically managed, and whether history has been disclosed truthfully. A single combined document tends to blur both dimensions, because the drafting language of a risk file, which is written in the conditional, does not suit the factual statements required about past events.

Second insight: the risk management report must land on a benefit trade-off, not on the claim that risk is zero. Article 5.2.1 b) requires known and foreseeable risks to be identified and reduced, while article 5.2.1 f) requires those same risks to be weighed against the benefits of the intended use. Read together, the assessment standard is whether residual risk is acceptable. A report that states only that risks have been eliminated tends to read as insufficient argument, whereas a report that states the residual risk, the corresponding benefit and a conclusion of acceptability matches what the provisions actually ask for.

Third insight: the safety and alert report is the trigger that activates article 6.3.6. Article 6.3.6 a) refuses approval where an international health alert calls into question the quality, safety and effectiveness of the device. Read with the definition in article 3.3, under which a health alert is an official communication by the competent authority restricting or conditioning use because of a risk to the validity of a procedure or to the safety of patients or health personnel, the applicant who discloses an alert in the item l report hands the decision to the authority. Concealment instead falls into article 6.3.6 c), the ground concerning false data or information in the dossier. Disclosure is therefore the lower-risk route even where the alert is uncomfortable.

Fourth insight: both reports are retrieved again after the product is on the market. Article 5.1.3 requires the authority to ensure quality, safety and effectiveness at any stage of the lifecycle, the quality control sampling under article 6.5.2 draws on the technical information, and investigations during the vigilance stage look back at pre-market files. Version numbers and product configurations stated in the reports must therefore match the product actually sold, because a file that describes one configuration at registration and another at sale creates an inconsistency that is easy to detect and hard to explain.

The two reports also require different authoring skills. The risk report is written by the technical and quality functions, because it follows the design and production file, while the alert report depends on regulatory affairs, because it rests on the manufacturer history in each market and on the communications received from authorities. Assigning both to the same drafting owner is a common reason why one of the two ends up thin.

4. Practical recommendations

• Draft the risk management report and the safety alert report as separate documents, the first prospective and the second retrospective.
• Close the risk report with an explicit trade-off between residual risk and benefit, rather than with a statement that risks have been eliminated.
• Disclose existing international health alerts in the safety report and describe the corrective actions already taken.
• Keep version numbers and product configurations in the reports aligned with the product on sale, so that a post-market traceback is straightforward.
• Structure the risk report on ISO 14971 so that it can be compared directly when equivalence is being verified.
• Establish a report update mechanism that is triggered by changes in design, materials or suppliers.

5. Verification checklist

• □ Risk management report and safety report drafted separately
• □ Risk report contains a residual risk and benefit conclusion
• □ Existing international health alerts disclosed truthfully
• □ Report versions consistent with the configuration on sale
• □ Risk report structured on ISO 14971
• □ Update mechanism in place and linked to the change process

The regulations cited in this article are RTS 11.03.02:21, Dispositivos Médicos. Requisitos para la Regulación Sanitaria de Dispositivos Médicos (Acuerdo No. 14-2022, Diario Oficial No. 156, Tomo No. 436, 2022-08-23), articles 3.3, 3.23, 3.33, 5.1.3, 5.2.1 b) and f), 6.3.2.1 k) and l), 6.3.6 and 6.5.2.

Regulatory information verified as at 29 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Salvadoran market. Our team manages Ministry of Health (MINSAL) sanitary registration applications, prepares Spanish-language dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com