Impact of en ISC-2013 11 6 2013

Impact of EN ISO 14971:2012
on Medical Device Risk Assessment

in the EU
Erika Huffman, MSBME, RAC
Regulatory
Impact of EN ISO 14971:2012 on Medical Device

Risk Assessment in the EU
NAMSA White Paper
ISO International Standard & EU Harmonization

International standard ISO 14971 - Medical devices - Application of risk management to medical
devices was developed by the International Organization for Standardization (ISO) in 1998. It
was written with participation from delegates representing 112 countries and has worldwide
application to risk/benefit assessment. This standard is intended to provide manufacturers
with a framework within which experience, insight, and judgment are applied systematically to
manage the risks associated with the use of medical devices.
Erika Huffman, MSBME,
RAC (ehuffman@namsa.
com) Medical Research
ManagerRegulatory,
joined NAMSA in 2010.
She holds an MS in
Biomedical Engineering
from the University of Iowa
and has over 18 years of
experience in the medical
device industry, having
worked in Regulatory,
Quality, and Management
roles with both US and
international focus. Her
experience includes
premarket submissions and
post-marketing surveillance
for Class II and III devices,
including software/firmware
and active implantables.
Ms. Huffman holds a
current Regulatory Affairs
Certification (RAC).
Companies
marketing medical
devices in the EU
are responsible
for adhering to
EEC standards,
not just ISO
standards.
The ISO 14971 standard was last revised in 2007 and these requirements are still current. The
European harmonized standard EN ISO 14971 was initially released in 2009 and recently revised
in 2012. This latest 2012 revision has modifications that are intended to aid in the identification
of remaining discrepancies between ISO 14971:2007 and the Essential Requirements for
medical devices as contained in the preexisting EU directives (93/42/EEC on Medical Devices,
90/385/EEC on Active Implantable Medical Devices, and 98/79/EC on In Vitro Diagnostic
Devices).
With the release of EN ISO 14971:2012, the requirements laid out in ISO 14971:2007 are
still current because the normative text is the same between the two standards and these
requirements provide the foundation for the subsequent regional or country-specific risk
management standards. An EN document is developed as a harmonized, or accepted,
regional standard applicable to the European Union (EU). EN documents are written under
protocols with participation from delegates of the EU member states and must subsequently
be adopted by each member state either with or without revisions. For example, DIN EN ISO
14971:2013 is the version adopted by Germany based on EN ISO 14971:2012 which is, in turn,
based on ISO 14971:2007. Note that when a country chooses to adopt an ISO standard, they
add a level of administrative overhead and thus the adopted versions typically have later issue
dates than the original ISO document.
A harmonized EN ISO standard is accomplished via appendices (Informative Annex Z) that
clarify any gaps or differences between the requirements of the worldwide ISO standard
and those of the EEC medical device directives. In the case of EN ISO 14971:2012, while the
normative text is the same as the ISO standard, the requirements are not because the EEC
directives add a further level of compliance in key areas of risk assessment. The Annex Z
requirements of the EN version are more stringent as compared to the ISO version; therefore,
compliance with the ISO 14971 standard alone is not sufficient in the European arena. You must
comply with the country-specific EN ISO 14971 standard for each country in which you plan to
market your product.
ISO 14971:2007 was first harmonized in 2009 as EN ISO 14971:2009. The current update, EN
ISO 14971:2012, became effective on July 31, 2012. Note that only the Annex Z appendices
(Annexes ZA-ZC) have changed between the 2009 and 2012 updates.
So Which One Is the Real Standard?

The difficulties inherent in these sorts of harmonizations are apparent, and thus the EN
ISO 14971:2012 standard states: Because this is an international standard, intended to be
applicable in jurisdictions all over the world, it is not the primary goal of the standard to cover
exactly any of the European Essential Requirements. In other words, in regards to the Essential
Requirements, conformity is not entirely achieved by complying only with the requirements
specified in this standard. Translation: companies marketing medical devices in the EU are
responsible for adhering to EEC standards, not just ISO standards.
Table 1 identifies the aspects where the ISO standard deviates, or might be understood as
deviating, from the European Essential Requirements thereby outlining the differing approaches
to risk management.

NAMSA White Paper
Table 1. Content Deviations between ISO 14971:2007 and Directive 93/42/EEC on Medical Devices
ISO 14971:2007
EEC DIRECTIVE
INTERPRETATION
NEGLIGIBLE RISKS
Manufacturer may discard negligible risks
[Annex D.8.2].
All risks, regardless of their dimension,

need to be reduced as much as possible
and need to be balanced, together with all
other risks, against the benefit of the device
[Annex I, Sections 1 and 2].
Manufacturer must
take all risks into
account.
All risks, regardless of any acceptability

assessment, must be reduced as far as
possible and must be balanced, together
with all other risks, against the benefit of
the device [Annex I, Sections 1 and 2].
Risk acceptability may

not be applied prior
to applying Sections
1 and 2 of Annex I of
Directive 93/42/EEC.
Risks are required to be reduced as far

as possible without room for economic
considerations [Annex I, Section 2].
Manufacturers and
Notified Bodies MAY
NOT apply the ALARP
concept.
An overall risk-benefit analysis must take

place, regardless of the application of
criteria established in the management plan
of the manufacturer [Annex I, Section 1].
Individual and overall

risk-benefit analyses
are required in all
cases.
ASSESSMENT OF RISK ACCEPTABILITY

Only non-acceptable risks are required to be
integrated into the overall risk-benefit analysis
[Annex D.6.1].
RISK REDUCTION
Risks must be reduced as low as reasonably
practicable (ALARP) [Annex D.8].
The ALARP concept contains an element of
economic consideration.
NEED FOR RISK-BENEFIT ANALYSIS

When specific residual risk (or overall
residual risk) is judged not acceptable using
risk management plan criteria and further risk
control is not practicable, the manufacturer
may determine if potential medical benefits
outweigh the residual risk [Clauses 6.5 & 7].
A risk/benefit analysis is not required by this
International Standard for every risk [Annex
D.6.1].
Undesirable side effects must constitute

an acceptable risk when weighed against
the performance intended. [Annex I,
Section 6].
RISK CONTROL OPTIONS/MEASURES

One or more risk control options are required,
in this order: (a) inherent safety by design; (b)
protective measures in the medical device
itself or in the manufacturing process; (c)
information for safety [Clause 6.2].
State of the art in safety principles

requires that all control options or control
mechanisms be applied cumulatively
[Annex I, Section 2].
The manufacturer
must apply all
control options
even if previous
control options have
reduced the risk to an
acceptable level.
Inherently safe design and construction

means that risks must be eliminated or
reduced as far as possible [Annex I, Section
2].
Directive is more
precise than Standard
and thus Directive
should be followed.
Further risk control measures do not need

to be taken if, after applying one of these
control options, the risk is judged acceptable
according to the risk management plan
[Clause 6.4].
SAFETY BY DESIGN
The first-priority measure, inherent safety by
design [Clause 6.2], is not defined.
SAFETY INFORMATION & RESIDUAL RISK REDUCTION

The third-priority measure, information
for safety given to users, is regarded as a
measure to reduce risk [Clause 6.4].
Users must always be informed about

residual risks, and thus safety information
given to users is not part of the risk
reduction equation [Annex I, Section 2].
Manufacturers cannot
use user training or
Instruction for Use
(IFUs) to accomplish
reduction of residual
risk.

NAMSA White Paper
Summary of Deviations
Although the Annex Z appendices to the EN ISO 14971:2012 standard bring ISO and EEC into closer agreement, the
key discrepancies described above affect how risk/benefit is assessed and thus how medical devices are designed,
manufactured, and marketed in the EU. In brief:
All risks must be taken into account.
A risk/benefit analysis must be conducted for all products and take into account all risks.
All risks must be reduced as far as possible.
All risk control options/measures must be taken.
Risks need to be reduced by an inherently safe design and construction.
Information to users is a requirement but does not reduce residual risk.
Again, Annex Zs found in the EN standards must be taken into account when developing a device for the EU market.
In the case of risk management, meeting the ISO 14971:2007 normative requirements alone is not enough to claim
compliance to the EU Essential Requirements.
Is Your Company in Compliance?

So what does this mean regarding assessment and CE mark approval? Assessors will expect that manufacturers are
aware of the gaps between the ISO requirements and those of the EEC Directives, that they have undertaken or are in
the process of undertaking any actions needed to address the gaps, and that ultimately these gaps are addressed for
all products with a CE mark. Notified Bodies will focus on compliance to the Directives and expect manufacturers to
assess risk/benefit according to the Directives, not just according to ISO.
You may already be in compliance and your procedures and documents may be sufficient. However, a check of your
internal procedures is advisable:
Does your company have a procedure for dealing with new revisions of standards?
Are you in compliance with your procedures?
If possible have all risks been designed out?
Have the risks been reduced as much as possible?
Has a risk/benefit analysis been conducted that includes all risks?
Have warnings and information provided in the IFUs and/or training processes been incorrectly assessed as
reducing risk?
As these content deviations have been in effect for a relatively short period of time, they are still being discussed
and their ramifications debated by medical device manufacturers and Notified Bodies. Since each Notified Body may
interpret compliance to the content deviations differently, it would be a good idea to discuss the deviations with your
Notified Body in advance of the next surveillance audit so that expectations are communicated and well understood.
Resources
Council of the European Communities/European Economic Community. Council Directive 93/42/EEC on Medical
Devices. June 1993. Available at: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31993L0042:en:NOT.
International Organization for Standardization. ISO 14971:2007: Medical devices - Application of risk management to
medical devices.
European Committee for Standardization (CEN). EN ISO 14971:2012: Medical devices - Application of risk
management to medical devices.
World Headquarters
6750 Wales Road
Northwood, OH 43619, USA
[email protected]
Telephone
866.666.9455 (toll free)
1.419.666.9455 (outside of USA)
1.419.662.4386 (fax)
For more information and

a listing of locations worldwide,
visit www.namsa.com

Impact of en ISC-2013 11 6 2013

Uploaded by

Copyright:

Available Formats

Impact of en ISC-2013 11 6 2013

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Impact of en ISC-2013 11 6 2013

Uploaded by

Copyright:

Available Formats

Impact of EN ISO 14971:2012

on Medical Device Risk Assessment

Impact of EN ISO 14971:2012 on Medical Device

NAMSA White Paper

ISO International Standard & EU Harmonization

So Which One Is the Real Standard?

Impact of EN ISO 14971:2012 on Medical Device

NAMSA White Paper

All risks, regardless of their dimension,

All risks, regardless of any acceptability

Risk acceptability may

Risks are required to be reduced as far

An overall risk-benefit analysis must take

Individual and overall

ASSESSMENT OF RISK ACCEPTABILITY

NEED FOR RISK-BENEFIT ANALYSIS

Undesirable side effects must constitute

RISK CONTROL OPTIONS/MEASURES

State of the art in safety principles

Inherently safe design and construction

Further risk control measures do not need

SAFETY INFORMATION & RESIDUAL RISK REDUCTION

Users must always be informed about

Impact of EN ISO 14971:2012 on Medical Device

NAMSA White Paper

Is Your Company in Compliance?

For more information and

You might also like