Georgia Medical Device Risk Management: ISO 14971 Reports in Scientific-Technical Review

1. Key takeaways

An ISO 14971 risk management report is a core supporting document of the scientific-technical review in Georgia. The legal anchor is the Product Safety and Free Movement Code, Law No. 6157-Iს of 8 May 2012, Article 2(2), which describes the regulatory mechanisms of the Code as product safety assurance, harmonisation of technical standards, and reduction of non-tariff barriers. Risk management is the evidentiary expression of the first of those mechanisms, product safety assurance.

The ordering matters. Article 2(2) lists product safety assurance ahead of standard harmonisation and barrier reduction, which signals that in the legislative hierarchy of Georgia, safety comes first. The completeness of a risk management system therefore carries substantial weight in review. A report that follows ISO 14971 structure, states its version, and documents acceptability criteria gives reviewers exactly what the regulatory framework asks them to find.

Two boundary rules frame the exercise. Article 2(1)(a) limits mandatory safety requirements to regulated fields, so outside a dedicated technical regulation the risk file is read against general requirements under Article 3(2). And Government Decree No. 386 of 3 October 2023 requires trial risks and liabilities to be covered by insurance or documentary proof, showing that Georgia demands explicit responsibility and coverage arrangements for risk across both clinical trials and products.

The practical effect for applicants is that the risk file is read as a primary document, not as background. Reviewers conducting the scientific-technical review under Article 11¹¹ of Law No. 1586 of 10 August 2009 treat the risk management report as the central reference against which performance claims, warnings and clinical evidence are checked. A report that is internally consistent, states its version of ISO 14971, and cross-references the other dossier sections allows that check to proceed without clarification requests. The hierarchy also explains why generic risk language borrowed from other jurisdictions performs poorly: if the report reads as boilerplate, reviewers cannot verify the specific claims of the dossier against it, and unverifiable content generates the kind of open questions that extend review cycles.

One planning note completes the picture. Insurance documents, responsibility declarations and risk files should be prepared as one coherent set, so that the party named in the risk file matches the party named in the coverage documents, because a mismatch between the two invites exactly the questions about responsibility allocation that the decree is designed to prevent.

2. Legal basis

1. Product Safety and Free Movement Code of Georgia, Law No. 6157-Iს of 8 May 2012: Article 2(2) (regulatory mechanisms), Article 2(1)(a) (mandatory safety requirements apply only to regulated fields), Article 2(1)(d) (priority application of international and European standards), and Article 2(3).
2. Article 3(2): where no dedicated technical regulation exists, the general requirements of Chapters II and III of the Code apply.
3. Health Care Law of Georgia, Law No. 6000 of 21 March 2008, Article 67(1): the ministry develops and implements quality and safety standards.
4. Law of Georgia on Drugs and Pharmaceutical Activity, Law No. 1586 of 10 August 2009, Article 11¹¹: scientific-technical review.
5. Government Decree No. 386 of 3 October 2023 of Georgia: trial risks and liabilities must be covered by insurance or documentary proof.

3. Expert insights

Insight one: product safety assurance is the first of the Code’s regulatory mechanisms, and the risk management report is its direct evidence.

Article 2(2) places product safety assurance ahead of the harmonisation of technical standards and the reduction of non-tariff barriers. That ordering states a legislative value judgment: safety comes before trade facilitation. For applicants, the consequence is that reviewers treat the risk management file as the central object of the scientific-technical review, not as a formality appended to the technical annexes. A thin or generic risk file weakens the entire dossier even when all other sections are strong.

Insight two: Article 2(1)(a) draws the boundary of mandatory safety requirements, and ISO 14971 is the safest reference inside it.

The provision states that state mandatory safety requirements apply only to regulated fields. Medical devices, in the absence of a dedicated technical regulation, enter the general requirements zone through Article 3(2). In that zone, whether a risk management report is treated as voluntary documentation or as acceptable evidence depends on the level of the standard it follows. Adopting ISO 14971, an international standard explicitly favoured by Article 2(1)(d), is the most defensible choice, because it aligns the file with the Code’s declared preference for international and European systems.

In the same zone, the risk file effectively becomes optional-to-include but decisive-in-practice documentation. Nothing forces its inclusion in terms as strict as a dedicated technical regulation would, yet without it the general requirements on safety cannot be assessed, and the review stalls at the first substantive question.

Insight three: the trial risk requirements of Government Decree No. 386 of 3 October 2023 reflect a consistent attitude toward risk.

The decree requires documents confirming that clinical trial risks and liabilities are covered, and it requires the identity of the party carrying those responsibilities to be clear. From trial risk to product risk, Georgia demands explicit responsibility and coverage arrangements on both lines. When preparing risk management documentation, manufacturers should therefore plan the allocation of responsibility at the same time: who carries product liability, who carries trial liability, and how insurance or documentary proof supports each.

4. Practical recommendations

1. Write the risk management report following the ISO 14971 structure and state the standard version, so the reviewer can accept it directly without reconstructing the methodology.
2. Dedicate a separate chapter to risk acceptability criteria, explaining the basis of the judgments and how residual risks are disclosed.
3. Include the local use environment, covering language, training levels and maintenance conditions, as an input to the risk analysis, instead of copying European scenarios unchanged.
4. Build a two-way index between risk management documents and the warnings in the instructions for use, ensuring every residual risk has a corresponding usage instruction.

5. Verification checklist

• □ The risk management report follows the ISO 14971 structure and states its version
• □ Risk acceptability criteria are documented in a separate chapter
• □ The local use environment has been included as an input to the risk analysis
• □ A two-way index between risk items and instructions-for-use warnings is in place
• □ The allocation of risk responsibility has been made explicit

Regulatory information verified as of October 30, 2026.

GRZAN supports manufacturers and authorised representatives preparing registration dossiers and conformity documentation for the Georgian market, from ISO 14971 report structuring and acceptability criteria to residual-risk indexing and responsibility mapping. For tailored assistance with your Georgia medical device documentation, contact us at info@grzanglobal.com.