Risk Management under ISO 14971 in the Ethiopian Device Registration Dossier

1. Key takeaways

Ethiopia lists risk management as the first item of Chapter 3, non-clinical evidence, in the non-IVD dossier (EFDA/GDL/097 Section 3.1), requiring manufacturers to establish and maintain a risk management file in accordance with ISO 14971 and to establish correspondence between risk items and Essential Principles entries. Risk management is not a standalone technical report; it is the thread that runs through the Essential Principles, non-clinical studies, clinical evidence and post-market surveillance: the risk acceptability determination decides which evidence is needed, and the disclosure of residual risks decides the warnings in the labelling and instructions for use.

The regulatory anchors reinforce this central position. Section 7.3 of EFDA-GDL-046 lists risk analysis as an independent mandatory element of technical documentation, listed side by side with the Essential Principles and labelling. Section 7.2 requires post-market surveillance to keep assessing conformity and to feed findings back into the system. And the EFDA recognized standards list, published online on July 17, 2026, gives manufacturers a reference set of methods for the risk management and related standards entries.

The practical message is that reviewers read the risk management file first: they scan the risk list and then judge whether the subsequent evidence covers those risks. A dossier whose risk management file is thin, whose acceptability criteria are unstated, or whose residual risks are missing from the labelling will generate queries across every other chapter. Conversely, a disciplined risk file that maps cleanly onto the EP checklist turns the rest of the dossier into a series of confirmations rather than open questions.

2. Legal basis

3. Expert insights

Insight 1: risk management is placed first among the non-clinical evidence, which shows it is the reviewer’s starting point. In Chapter 3, risk management precedes the Essential Principles checklist, the standards entry and each of the individual non-clinical studies. Reviewers will read the risk list first and then judge whether the subsequent evidence covers those risks. This ordering tells manufacturers something important about how to assemble the dossier: the risk management file should be finished early, because its hazard and risk inventory effectively defines the scope of every characterization study, verification test and clinical justification that follows.

Insight 2: risk analysis is an independent mandatory element of the technical documentation. Section 7.3 requires the technical documentation to provide evidence that the device conforms to the Essential Principles, labelling, risk analysis and other national requirements. Risk analysis is listed separately, side by side with labelling, and must not be buried implicitly inside other chapters. A file that treats ISO 14971 outputs as an appendix to the design documentation, without a clearly labelled and independently retrievable risk analysis, invites a formal deficiency finding even when the underlying work is sound.

Insight 3: the standards section (Section 3.3) forms a methodological pairing with risk management. EFDA/GDL/097 contains a dedicated standards entry, and the authority has published a recognized standards list (July 2026). Adopting recognized standards can serve as a presumption of conformity with the Essential Principles, but the version and any deviations must be stated. For risk management this means the ISO 14971 version used should be identified, and any standardized method for specific hazards, such as those drawn from IEC 60601 or ISO 10993 families, should be cross-referenced so the reviewer can trace the method behind each risk control measure.

Insight 4: the risk acceptability determination defines the boundary of the evidence. If a risk remains unacceptable after controls, additional non-clinical or clinical evidence is required; if a risk is judged acceptable, the criteria and basis for the judgement must be stated in the file. The acceptability criteria themselves must be written into the risk management file; a conclusion alone is not enough. Reviewers routinely test this point by asking why a given severity-and-probability combination was accepted, and a file that records its policy up front answers that question before it is asked.

Insight 5: risk management and post-market surveillance form a closed loop. Section 7.2 requires the manufacturer to establish processes within the QMS to continually assess conformity of the device with the Essential Principles during the post-market phase, including complaint handling, post-market vigilance reporting and subsequent corrective and preventive actions. New risk information obtained post-market must be written back into the risk management file. This loop is not merely good practice: it is the mechanism by which the registration remains valid, and it will be examined again at re-registration.

4. Practical recommendations

1. Establish the risk management file in accordance with ISO 14971: and submit it as the first item of Chapter 3.
2. Build a cross-reference table between the risk list and the Essential Principles entries: it makes review straightforward.
3. State the risk acceptability criteria explicitly: do not present conclusions only.
4. Adopt recognized standards and state versions and deviations: refer to the July 2026 list.
5. Disclose residual risks in the labelling and instructions for use: align with Article 28.
6. Write post-market risk information back into the risk management file: close the loop.

5. Verification checklist

• □ The risk management file has been submitted in accordance with Section 3.1
• □ A cross-reference between the risk list and the Essential Principles entries has been established
• □ The risk acceptability criteria have been stated explicitly
• □ The standards adopted and their versions have been stated in accordance with Section 3.3
• □ Residual risks have been disclosed in the labelling and instructions for use
• □ A mechanism for writing post-market risk information back into the risk management file has been established

Regulatory information verified as of October 29, 2026. The risk management entry and standards basis listed in this article are based on the current texts of EFDA/GDL/097 Sections 3.1 and 3.3 and the EFDA recognized standards list; when the guideline or the standards list is updated, they must be re-checked.

• Ethiopia local resource: GRZAN can assist manufacturers from the Chinese mainland and overseas with marketing authorization (MA), Certificate of Competency (CoC) and import licence applications to the Ethiopian Food and Drug Authority (EFDA), including local agent planning and agency agreement review, SRA reliance pathway justification, UMDN coding and classification determination, technical documentation preparation, and the setup of vigilance and post-market surveillance systems.
• Service capabilities: product attribute determination and risk classification (non-IVD Class I–IV / IVD Class A–D), marketing authorization application and re-registration, applicability determination for the low-risk notification procedure, Essential Principles conformity justification, labelling and IFU localization (English), and vigilance reporting and field safety corrective action support.
• Contact: hito.lin@grzan.cn; website www.grzan.cn.