Risk Management: Annex I Point 3 and ISO 14971

1. Key takeaways

In Turkey, risk management is a system obligation rather than a documentation obligation, and the Regulation chooses its verbs with care. Each verb corresponds to evidence that an auditor will look for, and each post-market article closes the loop back into the risk file. The takeaways below unpack that structure into its verifiable components. The result is a compliance question that cannot be answered by producing a single document on demand: the auditor asks for behaviour, not paperwork. The points below translate the four verbs and the post-market loop into checkable items.

• Risk management in Turkey is a system requirement, not a document requirement. Paragraph 2 of Madde 10 requires manufacturers to establish, document, implement and maintain (kurar, dokümante eder, uygular ve sürdürür) a risk management system, the definition of which is point 3 of Ek I.
• The verb sequence is itself an audit point: none of the four steps — establish, document, implement, maintain — may be missing. A file that exists on paper without evidence of implementation and maintenance will be found in any point-by-point reconciliation table.
• Post-market data must flow back into risk management: paragraph 1 point (a) of Madde 84 requires manufacturers of Class IIa and above to draw up a PSUR containing the rationale for corrective and preventive actions; Madde 83 addresses Class I devices, requiring manufacturers to document each corrective and preventive action.
• The update frequency is a verifiable number: paragraph 1 point (b) of Madde 84 sets the PSUR for Class IIb and Class III devices to be updated at least once a year; the corresponding mechanism for Class I devices is reflected in the corrective and preventive action documents of Madde 83.

2. Legal basis

A single instrument carries the whole topic: the Medical Device Regulation, whose article 10 defines the system duty, whose Ek I point 3 defines the system itself, and whose articles 83 and 84 govern the post-market documents that feed it. Anchoring each takeaway to its provision keeps the operational design traceable to the statutory text. The table records the article-level anchors relied upon throughout.

3. Expert insights

Insight one: the four verbs map onto four sets of evidence. Establish corresponds to the risk management policy and the responsibility matrix; document corresponds to the risk management plan and report; implement corresponds to the records and verification of the specific risk control measures; maintain corresponds to the periodic reviews and the change-trigger records. Splitting the evidence into these four parts passes review more easily than one thick risk report, because each verb in the statutory text can then be answered by a named artefact rather than by a general assertion that everything is somewhere in the file. Mapping each verb to its artefact also exposes gaps quickly: if any of the four categories has no named document and no named owner, the system obligation is unmet regardless of how substantial the remaining file is.

Insight two: risk management is not static, and the PSUR is one of its inputs. Paragraph 1 point (a) of Madde 84 requires the PSUR to contain the rationale and explanation for each corrective and preventive action, together with the results of the analysis of PMS data. This effectively pulls post-market data back into the benefit-risk judgement, closing the loop. Users of ISO 14971 will generally recognise this structure, since it mirrors the continuous review cycle that the standard itself prescribes for keeping risk control measures effective over the device lifetime. Treating the PSUR as an input rather than an output — a document that updates the risk file, not merely reports on it — is the single habit that most distinguishes a functioning system from a formal one.

Insight three: once a year is a quantifiable compliance indicator. Paragraph 1 point (b) of Madde 84 sets the PSUR update for Class IIb and Class III devices at a minimum of once per year. This number gives enterprises a gauge that can be written directly into internal controls: set an annual PSUR calendar and treat each update as an auditable event. A dated calendar converts an abstract duty into a schedule that anyone in the organisation can verify at a glance. An auditable event implies a record: date, version, reviewer and outcome, all fixed at the time of the update rather than reconstructed for the audit.

4. Practical recommendations

• Split the risk management documentation system into a set of four: policy and responsibilities, plan and report, implementation records of risk controls, periodic review and change records.
• Maintain an annual PSUR calendar (at least 1 per year for Class IIb / III), and feed the rationale and explanation of each CAPA back into the risk files in step.
• Class I devices likewise require documentation of each corrective and preventive action (Madde 83); the lower classification does not excuse omission.

5. Verification checklist

• □ The risk management system has been established as defined in point 3 of Ek I, covering all four stages of establish, document, implement and maintain.
• □ PSURs have been drawn up for Class IIa / IIb / III, containing the rationale and explanation of CAPAs.
• □ At-least-once-yearly PSUR updates for Class IIb / III have been scheduled in the calendar.
• □ Class I devices have documented each corrective and preventive action.
• □ A channel has been established for post-market data to flow back into the risk management files.

Regulatory information verified to 29 October 2026. The provisions and the once-per-year update requirement listed in this article were checked against the current text on the Turkish legislative information system (MevzuatNo 38657).

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Turkish market. Our team prepares CE/UTS-compliant documentation, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com