Medical Device Link.

Originally Published MDDI May 2004

Regulatory Outlook

Risk management for medical devices was developed in a series of stages. Both FDA and the European Community (EC) recognized the need for development of risk information on medical devices in the early 1990s when the U.S. quality system regulation (QSR) and the European Medical Devices Directive were developed. FDA included a statement in Section 820.30 (g) of the QSR indicating that risk analysis was to be part of the design validation process. 

In the preamble to the QSR, FDA recognized the ongoing work of ISO Technical Committee 210 on risk management and referred to prEN 1441, a standard developed as a European Norm by the European Committee for Standardization (CEN). The preamble is a reflection of agency thinking, and so it is considered to be part of the regulation. 

The Medical Devices Directive (Directive 93/42/EEC) included the concepts of life-cycle risk. The directive states: “in order to demonstrate conformity with the essential requirements and to enable conformity to be verified, it is desirable to have harmonized European standards to protect against the risks associated with the design, manufacture and packaging of medical devices.” The word risk appears 42 times in the directive. The directive requires a risk analysis in the technical documentation package for a device. Initially, EN 1441 was the risk analysis standard acceptable to the EC. This standard was withdrawn by CEN as a harmonized standard in March 2003. It was replaced by ISO 14971, which was made a harmonized standard with the CEN designation as ISO EN 14971. The documents developed in compliance with ISO EN 14971 may now be used to demonstrate compliance with the directive’s essential requirements. Note, however, that the language of the directive does not require a risk management process. When ISO 13485:2003 is adopted by CEN as the harmonized quality system standard, the language in that standard will require a risk management process.

After FDA released the quality system regulation in 1996, ISO TC 210 changed its approach to risk management. The 2000 release of ISO 14971 also uses this single life-cycle approach. The new standard covers more than just the design process that was reflected in the early risk analysis documents, including ISO 14971-1 and the final EN 1441.

Additionally, the newly released ISO EN 13485:2003 quality system standard requires the inclusion of risk management in a firm’s quality system. Product-specific standards also refer to ISO 14971 for the development of new products. The draft third edition of IEC 60601-1 refers to ISO 14971 and risk management more than 200 times.

ISO 14971, the international risk management standard for medical devices, was developed to provide guidance on risk management for the entire life cycle of the device. The standard defines a process for risk management that includes a postproduction phase. The description of that phase within the standard is somewhat vague. By contrast, previous phases of the standard are much clearer in referring to the development process for a medical device.

Copyright ©2004 Medical Device & Diagnostic Industry