Risk Management under MDR Article 10(2) and ISO 14971

Risk management sits at the centre of the EU Medical Device Regulation, both as a management system obligation and as a set of design-stage requirements. This article explains what MDR Article 10(2) and Annex I demand, where ISO 14971 fits, and which points notified bodies examine most closely.

1. Key takeaways

Under MDR Article 10(2), manufacturers must establish, implement, document and maintain a risk management system. The substantive risk requirements are distributed across Annex I Chapter I, including the benefit-risk determination, the order of priority for risk control measures and the disclosure of residual risks, and across Annex II Chapter II. ISO 14971 is the commonly used harmonised consensus standard, but the MDR contains requirements at the level of the regulation itself that are independent of the standard, and the two must be distinguished rather than merged.

Three consequences follow. First, the decision axis is benefit-risk, not risk minimisation: the acceptability conclusion needs evidence on the benefit side, normally drawn from clinical evaluation, alongside the risk-side records. Second, residual risks must be disclosed to users in the labelling or instructions for use, which creates a traceable link between the risk file and the labelling. Third, ISO 14971 provides the process framework only; treating it as equivalent to the full MDR requirement set is judged as a systematic deficiency in audits.

The definitions in Article 2(23) to (26) matter here as well, because terms such as harm, hazard and risk are used with fixed meanings in the regulation. Aligning the terminology of the risk documentation with those definitions removes a recurring source of review questions, since assessors read the file against the regulatory wording rather than against the standard alone.

2. Legal basis

The table below summarises the provisions and standards cited in this article.

Because ISO 14971 is a consensus standard rather than a legislative text, its application must always be mapped back to the specific obligations of Annex I, and the mapping itself should be documented in the quality management system.

3. Expert insights

Insight one: the MDR makes benefit-risk, not risk minimisation, the decision axis.

Chapter I of Annex I requires manufacturers to reduce risks as far as possible and appropriate in the light of the generally acknowledged state of the art, with the benefit-risk determination at the core. This means the risk documentation must contain not only risk control records but also evidence on the benefit side, normally drawn from clinical evaluation. The two strands together support the acceptability conclusion. A risk file that shows only residual risk levels, without a documented benefit-side argument, cannot support an acceptability claim under the regulation.

Insight two: residual risks must be disclosed to users, not kept inside internal files.

Under Chapter I of Annex I, residual risks that remain after control measures must be disclosed to the user in the labelling or instructions for use. A traceable correspondence must therefore exist between the risk documentation and the labelling: every disclosed warning should be traceable to a specific residual risk entry, and every significant residual risk should appear in the user-facing information. This traceability is a hard checkpoint for notified body assessors during review.

Insight three: the order of priority for risk control measures is written into the regulation.

Chapter I of Annex I sets the priority order for risk control measures: inherent safety by design first, then protective measures in the design and manufacture of the device, then safety information in the instructions for use. Using a warning sentence in the instructions for use as the preferred control measure contradicts the order required by the regulation. Where a lower-priority measure is used, the documentation should record why the higher-priority options were not feasible for the risk in question.

Insight four: ISO 14971 is a consensus standard and not the whole of the MDR requirement.

ISO 14971 provides the process framework for risk management, but the MDR adds independent requirements: the benefit-risk acceptability criteria must be consistent with the state of the art, residual risks must be disclosed, and risk management must be linked to clinical evaluation and to post-market surveillance data. Treating ISO 14971 compliance as equivalent to full MDR compliance produces a systematic gap that assessors will flag, because the standard does not by itself contain those MDR-specific obligations.

4. Practical recommendations

1. Structure the risk documentation along the complete chain: hazard, hazardous situation, foreseeable event sequence, harm, risk estimate, control measures, residual risk, so no link in the reasoning is missing.
2. Order the risk control measures according to the priority fixed in Annex I, and record for each risk why the higher-priority measures were not feasible.
3. Build a cross-reference table between the risk documentation and the labelling and instructions for use, linking each residual risk to its disclosure point.
4. Present the benefit-side evidence, taken from the clinical evaluation conclusions, together with the risk-side conclusion in a single acceptability determination.
5. Establish an update mechanism through which post-market surveillance and vigilance signals flow back into the risk documentation on defined triggers.

5. Verification checklist

• □ The risk management system has been established and documented under Article 10(2)
• □ Risk control measures are ordered according to the priority set in Annex I
• □ Residual risks are disclosed in the labelling or instructions for use
• □ The benefit-risk acceptability determination includes clinical evaluation evidence
• □ A cross-reference exists between the risk documentation and the labelling
• □ A return-flow mechanism from PMS and vigilance signals into the risk documentation has been established

Regulatory information verified as of 2026-10-29.

GRZAN supports medical device manufacturers entering and maintaining the EU market under Regulation (EU) 2017/745. Our team structures risk management files against MDR Article 10(2) and Annex I, aligns them with ISO 14971, and links them to clinical evaluation and post-market surveillance. For technical file and conformity support for the EU MDR market, contact info@grzanglobal.com.