Risk management plan
Define product scope, lifecycle, responsibilities, reviews, acceptance criteria and information collection.
Medical & healthcare
Trace hazards, controls and residual risk decisions
ISO 14971 provides a lifecycle risk management process for medical devices. Risk analysis must connect product context, controls, verification and post-production information.
Source record updated:
Discuss your certification →Scope and applicability
Medical device lifecycle risk management standard
It is not a standalone Korean product approval. Connect risk evidence to applicable authorization and QMS requirements. Your organization must establish justified risk acceptability criteria; the standard does not set universal acceptable values.
Korean certification schemes and international standards are different. A translated guide does not extend a Korean certificate to other countries. Confirm the target market, product classification and current requirements with the relevant body.
Who this is for
- Medical device and SaMD developers
- AI medical product risk teams
- Quality and regulatory teams maintaining risk files
Documents to prepare
Hazard and risk control analysis
Record hazardous situations, harms, probability and severity judgments, controls and verification.
Residual risk review and report
Evaluate individual and overall residual risk, benefit-risk rationale where needed and post-release findings.
Preparation process
Agree context and criteria
Define users, patients, environments and foreseeable use and approve acceptability criteria.
Analyze, control and verify
Coordinate clinical, development, security and usability roles and link controls to requirements and tests.
Review overall risk and changes
Approve the release report and update the file for complaints, defects and updates.
Timing
Hazards, clinical evidence, verification and changes determine effort. Plan ongoing updates throughout development and after release.
Agency fees
Risk management assessment and testing
Separate quotation
No single Korean statutory certification fee is established by this standard's name alone. Confirm standard purchase, testing, assessment and product authorization costs separately.
Sources and references ↗Document automation and management cost KRW 300,000 per month. Expert services and certification body testing or assessment fees are separate. Specify supports preparation; the relevant authority or certification body makes the final decision.
Pricing and certification costs →Optional expert consulting
Expert review and consulting are optional, separately scoped services. Choose support for ISO 14971 based on your team's readiness and the evidence or assessment preparation you need.
- Confirm institutional testing, assessment and registration fees separately in the contract.
- Development fixes, clinical studies where applicable, security equipment and infrastructure operations may require separate budgets.
- Confirm internal staffing, travel, translation, VAT, surveillance and renewal costs in the quotation.
Questions and answers
Is one FMEA table sufficient?
FMEA is an analysis technique. The full process also needs planning, control verification, residual risk review and post-release information.
Does high AI accuracy reduce the need for analysis?
Consider patients, data distributions, clinical effects of errors, human intervention and failure conditions as well as accuracy.
Should cybersecurity risks be included?
Connect security issues affecting device safety to risk management, while checking separate security testing and regulatory requirements.