Philippines Risk Management Report Under ISO 14971

1. Key takeaways

Yes, it is required. CMDR applications for Class B, C and D devices must include a risk management report conforming to ISO 14971, submitted as a mandatory CSDT module. With the entry into force of AO No. 2025-0030, the weight of ISO 14971 increases further: the determination of whether an FSCA is necessary must be supported by a formal risk assessment conforming to the current ISO 14971.

GRZAN note: the report is the one dossier module that does not stop at registration. Once the product is on the market it becomes the instrument by which the company decides whether an event requires field action, and that decision is now open to being overturned. The framework can be remembered as 1 standard, 6 links in the review chain, and 1 continuous loop back from post-market data.

• ISO 14971 risk management report for Class B, C and D;
• Assessment must follow the current version of the standard;
• Under AO No. 2025-0030, FSCA necessity rests on that assessment;
• Post-market information must flow back into the risk management file.

The practical implication is that the risk management file should be written for two audiences at once: a reviewer deciding whether the design is acceptable before launch, and an internal team deciding months later whether an event observed in the field changes that judgment. A file designed only for the first audience tends to go quiet after approval, which is precisely the failure mode the newer framework targets.

2. Legal basis

The dossier requirement, the applicable standard and the post-market linkage are summarised below. The two instruments do different work: the administrative order requiring the CSDT establishes the report as part of the submission, while the later order gives the same report an operational role after approval. Reading them together explains why a report accepted at registration can still be found wanting during a post-market event.

3. Expert insights

Insight 1: the reviewer is looking for a closed loop, not for the existence of a document. Faced with a risk management report, the order of judgment is consistent: does the risk analysis cover all foreseeable hazards, are the risk evaluation criteria explicit, are the risk control measures implemented, is the residual risk acceptable, is there a benefit-risk analysis, and is there a mechanism for feeding post-market information back into the file. A break at any one of these points makes the report incomplete, regardless of how many pages it runs to. The sequence is worth internalising as a self-review protocol, because each step depends on the one before it: criteria cannot be applied to a hazard that was never identified, and residual risk cannot be judged acceptable where no criteria were set.

Insight 2: the report has to match the product. A recurring problem is a risk management file written from a generic template, carrying a hazard list full of items irrelevant to the declared device — radiation hazards in a non-radiation product, for instance — while omitting hazards specific to that device. A templated file of this kind is immediately recognisable. The hazard list has to be derived from the particular design, materials and use scenarios of the product, and each entry should be traceable back to one of them.

Insight 3: AO 2025-0030 turns risk management from a filing document into an operating tool. This is the most significant change for 2026. In the past the risk management report was archived once submitted; now, when a problem arises with a product, the basis for deciding whether to initiate an FSCA is the ISO 14971 risk assessment, and the FDA retains the power to overturn the company assessment. The file therefore has to be maintained continuously and be usable in real time. It is not archival material; it is the basis of a decision.

Insight 4: post-market feedback is what keeps the file alive. ISO 14971 requires production and post-production information — complaints, adverse events, recalls, publicly available information — to be fed back into the risk management process. Within the framework of AO 2025-0030, where complaint records, adverse event reports and FSCA records must all be retained, those records are themselves inputs to risk management. The efficient arrangement is to merge the two flows into a single chain: post-market event, then risk assessment update, then a decision on whether an FSCA is required.

4. Practical recommendations

• Derive the hazard list from the actual product. Every hazard should trace to a specific design feature, material or use scenario rather than to a template.
• Include a benefit-risk analysis section. The evaluation of residual risk needs an explicit acceptability argument.
• Connect the risk management file to the post-market process. Use complaint and adverse event records as inputs and review the file on a scheduled basis.
• Record the standard version relied on. State the version of ISO 14971 applied and track subsequent revisions.

The common thread is that a risk management file earns its place only when it is specific enough to be wrong. A generic file cannot be contradicted by events, which makes it useless for the decision it now has to support; a product-specific file can be updated when reality disagrees with it, which is exactly what the post-market framework expects.

5. Verification checklist

• □ Standard version stated and current: ISO 14971
• □ Hazard list traceable to the product design and use scenarios
• □ Risk evaluation criteria explicitly defined
• □ Control measures implemented and cross-referenced to verification reports
• □ Residual risk acceptability supported by a benefit-risk analysis
• □ Post-market feedback mechanism linked to the AO 2025-0030 record-keeping process

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including the Philippines. Our team prepares CMDN/CMDR dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the FDA Philippines, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com