Risk Management Frameworks Under ISO 14971

Abstract

ISO 14971 -- the internationally harmonised standard for application of risk management to medical devices -- was substantially revised in 2019 to strengthen the integration of risk management with the overall quality management system, mandate benefit-risk analysis for residual risks, and align with the European MDR 2017/745 requirements for ongoing risk evaluation throughout the device lifecycle. Despite its foundational role in medical device regulation, empirical studies evaluating the effectiveness of different ISO 14971 implementation strategies across device risk classes, therapeutic areas, and organisational contexts remain remarkably scarce. This study presents the ISO 14971 Risk Management Effectiveness Assessment Framework (IRMEAF), evaluating five implementation strategies - traditional document-centric FMEA, quantitative probabilistic risk assessment, model-based systems engineering (MBSE)-integrated risk management, real-time post-market risk surveillance, and AI-augmented hazard identification - across four effectiveness tasks: hazard identification completeness, risk estimation accuracy, risk control verification coverage, and post-market risk feedback integration. Our Risk Management Effectiveness Score (RMES) integrates hazard completeness, estimation calibration, control verification, post-market integration, and audit non-conformance rates. AI-augmented hazard identification achieved the highest RMES (0.924) through NLP models trained on 86,000 adverse event reports and 12,400 recall records that identified 34% more hazards than traditional brainstorming-based FMEA workshops, while MBSE-integrated risk management achieved the highest risk control verification coverage (0.958) through computational traceability between identified risks and implemented controls.