Risk Management under ISO 14971 for South African Medical Device Registration

1. Key takeaways

The South African system of Essential Principles for safety and performance treats risk management as its transversal method, and the method standard it references is ISO 14971 (Medical devices – Application of risk management to medical devices). Notice 1515 Regulation 8(6) requires that a device submitted for registration conform with the Essential Principles, including requirements for quality, safety and performance, and the acceptability of risk is a central judgement within that conformity. The risk documentation is not a standalone annex; it is method evidence that simultaneously supports several Essential Principles, and companies should organise it in a three-layer structure of principle, risk and evidence. In practice this means the risk management file is among the most heavily used documents in the dossier: it underwrites the general principles on acceptable risk, it supports the design and construction principles on chemical, physical and biological properties, and it connects the post-market vigilance loop back into pre-market conclusions. South Africa has not enacted a separate risk management regulation; instead it combines the Essential Principles with ISO 14971, which keeps the methodology internationally aligned but leaves the conformity judgement to SAHPRA’s case-by-case assessment, making readability and traceability of the risk file more important than formal completeness.

2. Legal basis

3. Expert insights

Insight 1: South Africa has not enacted a separate risk management regulation but instead references an international standard. Unlike the European Union, where MDR Annex I directly prescribes risk management requirements, South Africa places risk management in the combination of the Essential Principles plus ISO 14971. The benefit is a mature method aligned with international practice; the cost is that the standard of conformity judgement is left to SAHPRA’s case-by-case assessment. The practical consequence is that readability and traceability of the risk documentation matter more than formal completeness: a file that a reviewer can follow from hazard to harm to control, with each conclusion traceable, will outperform a technically complete but opaque document in a system without fixed national templates.

Insight 2: The risk documentation must be able to support multiple principles horizontally. A complete risk management file should be able to answer, at the same time, questions arising from chemical, physical and biological properties, infection and microbial contamination, manufacturing and cleaning, compatibility with the use environment, measuring or diagnostic functions, radiation protection, and requirements for software and active devices. The practical approach is to annotate, for each principle, that it is supported by chapter X of the risk management documentation, rather than copying the risk tables again into every section. This keeps a single source of truth for risk conclusions and lets reviewers move from any Essential Principle entry to the underlying analysis in one step.

Insight 3: Under the reliance pathway, foreign risk conclusions can be accepted but must be localised with supplementary analysis. SAHPGL-MD-22 allows SAHPRA to rely on the assessment conclusions of reference authorities, while reserving the right to require supplementary information. Practical estimate: foreign risk documentation can be reused, but risk analyses concerning the South African use environment, population characteristics, and electricity and infrastructure conditions, such as unstable voltage and high ambient temperatures, should be completed separately. It is precisely this localised risk layer that receives attention in African market reviews, and its absence is a common gap when dossiers built for other regions are submitted unchanged.

Insight 4: Risk management is a continuing obligation, connected to the vigilance loop. Post-market adverse events and field safety corrective actions (FSCA) flow back into the risk documentation. SAHPGL-MD-03 v4 and SAHPGL-MD-18 (post-market surveillance) both require post-market information to be incorporated into risk evaluation. If the risk file is a one-time product, it becomes an obvious gap at inspection and at renewal. Companies should treat the risk documentation as a living record with dated revisions, each revision noting which post-market inputs, complaints, vigilance reports or FSCA announcements triggered the re-evaluation and what conclusions changed.

Insight 5: Risk analysis for software and AI/ML devices has special dimensions. MD08-2025/2026 requires AI/ML devices to conform with existing device regulations, including quality management system requirements. Practical estimate: risks arising from algorithm iteration, data drift and training data bias should be included in the risk documentation and managed under version control. Because the model can change after release, the risk file must describe not only the risks of a given version but the process by which a new version is assessed before deployment, so that reviewers can see the governance loop rather than a static snapshot.

4. Practical recommendations

1. Build a complete risk management documentation set per the current version of ISO 14971, covering the full lifecycle from design through manufacture to post-market.
2. Establish a mapping of principle, risk and evidence: every Essential Principle must be traceable to the risk analysis.
3. Complete the risk analyses for the South African local use environment: power supply, climate, user population and comparable factors.
4. Feed post-market information back into risk documentation updates, closing the loop with vigilance reporting.
5. Supplement algorithm-related risk dimensions for software and AI/ML products, including iteration, drift and data bias.
6. Retain the revision history of the risk documentation for inspection and renewal verification.

5. Verification checklist

• □ The risk management documentation has been established per the current version of ISO 14971
• □ A three-layer mapping of principle, risk and evidence has been established
• □ Coverage spans the full lifecycle (design, manufacture, post-market)
• □ Risk analyses related to the South African local use environment have been completed
• □ Post-market adverse events and FSCA have been fed back into risk evaluation
• □ Algorithm-related risk dimensions have been supplemented for software and AI/ML products
• □ The revision history of the risk documentation has been retained
• □ The principle entries in SAHPGL-MD-01 supported by the risk documentation have been identified

Regulatory information verified as of 29 October 2026. The regulations, guidance documents and effective dates described in this article are limited to the official sources listed under Legal basis as published on that date; where official documents are subsequently updated, the latest published version prevails.

• South Africa local resources: GRZAN assists manufacturers from the Chinese mainland and overseas with SAHPRA medical device establishment licence (MDEL) applications and product registration preparation, including authorised representative (AR) scheme design, ISO 13485 certification pathway planning and CAB selection, GMDN coding and classification determination, technical dossier preparation, and the setup of vigilance and adverse event reporting mechanisms.
• Service capabilities: product attribute determination and risk classification (Class A/B/C/D), establishment licence applications and renewals, reliance pathway justification, technical dossier and Essential Principles conformity argumentation, labelling and IFU localisation in English, and support for post-market vigilance and annual compliance information submissions.
• Contact: info@grzanglobal.com; hito.lin@grzan.cn; website www.grzan.cn.