Risk management across the device lifecycle under RDC 848/2024

1. Key takeaways

Art. 7 of RDC 848/2024 requires manufacturers to establish, implement, document and maintain a risk management system. Art. 7 §1 further defines it as a continuous process running through the entire device lifecycle that must be systematically and regularly updated. The requirements apply from 180 days after publication (Art. 88), and ANVISA issued the effective-date notice on September 10, 2024. The practical consequence is that a static ISO 14971 report frozen at submission time can no longer carry Brazilian compliance. What ANVISA expects is a living system whose files visibly absorb manufacturing data and post-market information, with defined triggers that force the risk documentation to move at the same speed as the product in the field.

2. Legal basis

• Essential Safety and Performance Requirements — RDC No. 848/2024, published in the DOU on March 8, 2024, Art. 7 (including §1 and §2 items I–VI), Arts. 85 and 88
• Classification, Notification and Registration of Medical Devices, and Labeling and Instructions for Use Requirements — RDC No. 751/2022, decided on September 15, 2022, Art. 10 §7, Arts. 56 through 58
• Technovigilance — RDC No. 67/2009, published on December 21, 2009, Art. 3 sole paragraph, Art. 8
• Brazilian Good Manufacturing Practices — RDC No. 665/2022, published on March 30, 2022, effective May 2, 2022 (Art. 138), Art. 1

3. Expert insights

Art. 7 §2 lists six obligations: establish and document a risk management plan for each device; identify and analyze known and foreseeable hazards; estimate and evaluate risks under intended use and foreseeable misuse; eliminate or control risks under Arts. 10 and 11; evaluate the impact of production and post-production information on the overall residual risk, the benefit-risk determination and risk acceptability; and change control measures where necessary. GRZAN’s reading is that these six items map one-to-one onto the ISO 14971 loop of planning, analysis, evaluation, control and post-market review. Brazil has not invented a parallel system; it has written the closed loop of the international standard into national statutory duty, which means the standard’s logic can be reused, but the documentation must answer to Brazilian law.

The first pitfall companies hit is the single group-level document. Item I of §2 says each medical device and each IVD must have a plan. A group-wide risk management master file can serve as the methodology layer, but the product layer must carry an independent document covering the exact models submitted in Brazil, and the two layers cannot substitute for each other in review.

The second pitfall is post-market information that never flows back. Items V and VI require production and post-market information to be fed into risk evaluation again, with control measures adjusted accordingly, and this is the same chain as technovigilance data under RDC 67/2009: deaths, serious threats to public health and counterfeiting occurring in Brazil must be reported to Notivisa within 72 hours of awareness; other confirmed serious adverse events within 10 calendar days; and technical complaints that may lead to a serious adverse event within 30 calendar days. GRZAN repeatedly sees companies route these reports to a vigilance function while the risk management file sits untouched at a version several years old, and the site inspection then exposes exactly this split between the two documents.

Third judgment: the risk management file itself has a fixed place in the technical dossier. Art. 56 of RDC 751/2022 provides that for a notification (notificação) the technical dossier is not submitted to ANVISA; it is retained by the authorization holder, and it may be organized by cross-reference to quality system records, with ANVISA entitled to call for it at any time. Art. 57 requires the technical dossier to follow the structure of Annex II, and Art. 58 requires tiering by risk class; Chapter 3 is precisely where the ESPR and risk management land, and Chapter 4 is the clinical evidence summary.

Fourth judgment: the obligated subjects for risk management and for vigilance are not the same. RDC 67/2009 applies to registration holders of health products with an establishment in Brazil, so vigilance reporting is the holder’s duty, while Art. 7 places establishment and maintenance of the risk management file on the manufacturer. The two subjects sit in different countries, and without a defined data-return path and timeline the manufacturer’s risk documents will lag behind Brazilian field data indefinitely. GRZAN’s recommendation is to write the update triggers as an executable checklist rather than the four words periodic review.

Fifth judgment: listing in the standards catalog is not compulsion. Under ANVISA’s official List of Recognized Technical Standards (v1.0, 2026-09-11), inclusion of a standard means neither approval nor obligation; companies may adopt listed standards voluntarily, and where a listed standard has been superseded by a newer edition, the newer edition may be adopted directly without separate justification. This matters most when judging ISO 14971 and IEC 62366-1: the version basis of the risk management file follows the current edition, and there is no need to prepare against an old edition merely because the catalog cites the old number.

4. Practical recommendations

• Build files on two levels — a methodology master file plus a product-level plan — with the product level stating the models submitted in Brazil, intended use and the use environment.
• Make Notivisa reporting records and technical complaints mandatory trigger inputs for the risk management file, with update frequency and responsible persons written down.
• Archive the risk management file and its historical versions inside the technical dossier kept under Arts. 56 to 58 of RDC 751/2022: for a notification the dossier is not submitted to ANVISA but retained by the holder and may be organized by cross-reference to quality system records, with ANVISA entitled to retrieve it in any necessary investigation — retrievability on demand matters more than polish.
• After changing a control measure, return to Art. 7 §2 item IV to confirm the safety principles are still satisfied.
• Write the three vigilance deadlines — 72 hours, 10 calendar days, 30 calendar days — into the SOP and run an annual drill.
• Agree in writing between the manufacturer and the Brazilian holder on the return path and timeline for vigilance data.

5. Verification checklist

• □ Does every model submitted carry an independent risk management plan?
• □ Does the hazard list cover foreseeable misuse scenarios?
• □ Does the benefit-risk determination state acceptability criteria?
• □ Is the return path for post-market information documented with traces?
• □ Does the risk management file version match the latest vigilance data?
• □ Is there a written agreement between manufacturer and holder on vigilance data return?
• □ Does the risk management plan state concrete triggers for periodic updates?
• □ Is the version of the standards used the current one (catalog listing is not compulsion)?

Regulatory information verified as of October 29, 2026

GRZAN Regulatory Team

GRZAN helps manufacturers build lifecycle risk management files that withstand Brazilian GMP inspections and technovigilance scrutiny, aligns them with RDC 848/2024 and RDC 665/2022, and maintains the dossier evidence chain from Notivisa reporting to Notivisa-driven updates. For risk management and dossier support in Brazil, contact GRZAN at info@grzanglobal.com.