ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO/TR 24971 is the guidance document that explains how to apply ISO 14971, and since the 2019 edition of the standard it has carried most of the content that used to sit in the standard’s own informative annexes. ISO/TR 24971:2020, Medical devices — Guidance on the application of ISO 14971, is the second edition of the technical report, published in June 2020 alongside the third edition of the standard, and it follows the standard’s clause structure exactly — clauses 4 to 10 of the report explain clauses 4 to 10 of the standard — with annexes on hazard identification, analysis techniques, the risk acceptability policy, information for safety, the role of standards, security, components designed without ISO 14971 and IVDs. It is not normative: no regulator requires conformity to a technical report, and a notified body cannot cite it as a requirement. It is, however, what every experienced reviewer reads as the shared interpretation of the standard, and a file that departs from it needs a reason. This guide explains what ISO/TR 24971 is and is not, what moved into it from ISO 14971:2007, what each clause and annex provides, the parts that matter most in practice — the risk acceptability policy, the two-part probability estimate, information for safety versus disclosure of residual risk — and how to use it without treating it as the standard.
| ISO 14971:2019 | ISO/TR 24971:2020 | |
|---|---|---|
| Type | International Standard | Technical Report — informative guidance |
| Status | Requirements; harmonised under EU MDR as EN ISO 14971:2019/A11:2021; FDA-recognised | No requirements; not harmonised; not recognised as a consensus standard in its own right |
| Edition | Third, December 2019; confirmed 2025 | Second, June 2020 (first edition 2013) |
| Structure | Clauses 1–10, Annexes A (rationale), B (process overview), C (hazard and hazardous situation relationship) | Clauses 1–10 mirroring the standard, plus Annexes A–H |
| Use | Conformity is demonstrated by the risk management file | Interpretation; reviewers expect the file to be consistent with it or to explain why not |
Our guide to the ISO 14971 risk management file covers the standard’s requirements; this guide covers the interpretation the report supplies.
ISO 14971:2007 carried nine informative annexes. The 2019 revision kept three — rationale, process overview, and the hazard-to-hazardous-situation relationship — and moved the practical content into the technical report, where it could be updated without reopening the standard. The consequence for anyone with a file built on the 2007 edition is that the annex references in their procedures point at the wrong document.
| ISO 14971:2007 annex | Content | Where it is now |
|---|---|---|
| Annex C | Questions to identify characteristics related to safety | Annex A of the report |
| Annex D | Risk concepts, including risk estimation and the ALARP discussion | Clauses 5 and 6 of the report; the risk acceptability policy in Annex C; ALARP treated with the caution the regulations now demand |
| Annex E | Examples of hazards, foreseeable sequences of events and hazardous situations | Annex A and clause 5.4 of the report |
| Annex F | Risk management plan | Clause 4.4 of the report |
| Annex G | Risk management techniques (PHA, FTA, FMEA, HAZOP, HACCP) | Annex B of the report |
| Annex H | Guidance for IVD medical devices | Annex H of the report |
| Annex I | Biological hazards | Not carried into the report; ISO 10993-1 covers biological evaluation |
| Annex J | Information for safety and residual risk | Annex D of the report |
| Report clause | Guidance it provides |
|---|---|
| 4 General requirements | How the process fits an organisation’s QMS; management responsibilities including the policy for risk acceptability; competence; what the plan and the file should contain and how the file can be distributed while keeping traceability |
| 5 Risk analysis | Defining intended use and reasonably foreseeable misuse; using the Annex A questions to find characteristics related to safety; identifying hazards, sequences of events and hazardous situations; estimating risk with the two-part probability P1 × P2 and handling probability that cannot be estimated |
| 6 Risk evaluation | Applying the criteria from the plan; how the policy, the criteria and the evaluation relate (with Annex C) |
| 7 Risk control | The priority of inherently safe design, protective measures and information for safety; verifying implementation and effectiveness; residual risk evaluation; when and how to perform a benefit-risk analysis; risks arising from controls; completeness |
| 8 Overall residual risk | General considerations, inputs and possible approaches — reviewing the distribution of residual risks, comparing with similar devices and the state of the art, expert review, combinations of hazardous situations |
| 9 Risk management review | What the review before commercial release confirms and what the risk management report records |
| 10 Production and post-production | Information collection from production, users, the supply chain, the market and the state of the art; review for new hazards, changed estimates and changed acceptability; actions on the device and the file |
| Annex | Content | How it is used |
|---|---|---|
| A — Identification of hazards and characteristics related to safety | The question list (energy, materials, environment, use, software, lifetime, disposal…) and example hazards | The checklist the hazard identification worksheet is built from |
| B — Techniques that support risk analysis | Preliminary hazard analysis, fault tree analysis, FMEA, HAZOP, HACCP — with their strengths and limits | Choosing and justifying the method in the plan; FMEA alone is not a hazard analysis |
| C — Relation between the policy, the criteria for risk acceptability, risk control and risk evaluation | How a top-management policy becomes device-level criteria and how ‘as low as reasonably practicable’ interacts with regulatory as-far-as-possible obligations | Writing the clause 4.2 policy; our guide to risk acceptability criteria covers the result |
| D — Information for safety and information about residual risk | The distinction between information for safety as a risk control measure and disclosure of residual risk; what belongs in the instructions for use | Deciding what the IFU says and why |
| E — Role of international product safety and process standards | How compliance with a particular standard (e.g. IEC 60601-1) provides evidence for specific risks | Citing standards as risk control evidence |
| F — Guidance on risks related to security | Security threats as sources of hazards; coordination with a security risk management process | Linking cybersecurity risk management (e.g. IEC 81001-5-1) to the safety file |
| G — Components and devices designed without using ISO 14971 | Handling purchased or legacy elements that have no ISO 14971 file | Supplier components and SOUP-like elements |
| H — Guidance for IVD medical devices | Hazards specific to IVDs: incorrect results, patient harm through misdiagnosis | IVD risk analysis |
What is ISO/TR 24971?
ISO/TR 24971:2020, Medical devices — Guidance on the application of ISO 14971: the informative technical report that explains how to apply ISO 14971:2019, clause by clause, with annexes on hazard identification, analysis techniques, the risk acceptability policy, information for safety, standards, security, components without ISO 14971 and IVDs.
Is ISO/TR 24971 mandatory?
No. It is a technical report — guidance, not requirements — and is neither harmonised under EU MDR nor recognised by FDA as a consensus standard in its own right. Reviewers nonetheless expect files to be consistent with it or to explain departures.
What did it take over from ISO 14971:2007?
The practical annexes: characteristics related to safety and example hazards, risk concepts and the acceptability discussion, the plan, analysis techniques, IVD guidance and information for safety — now Annexes A to H of the report and its clauses 4 to 10.
What is the most-used part?
Annex A’s question list for identifying characteristics related to safety, the two-part probability estimate (P1 × P2) in clause 5, and Annex C on the risk acceptability policy.
Is a new version coming?
ISO lists ISO/TS 24971-1 as a work item — a technical specification intended to carry guidance on the application of ISO 14971; until it is published, ISO/TR 24971:2020 is the current guidance.
Read ISO/TR 24971 as the interpretation every reviewer shares: build the hazard identification from Annex A, choose and justify the analysis technique from Annex B, write the risk acceptability policy with Annex C’s reasoning, split probability into P1 and P2, decide the instructions for use with Annex D — and keep citing ISO 14971:2019 as the requirement the file conforms to, because the report explains the standard and never replaces it.
The hazard identification checklist built on the Annex A questions, the risk acceptability policy, the P1 × P2 risk estimation worksheet, the information-for-safety decision record and the risk management plan and report templates are in the ISO 14971 Toolkit, or start with the free templates.
September 21, 2026
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026