ISO 14971 Updated in 2019 Release

1. Section 10.1 – “The manufacturer shall establish, document and maintain a system to actively collect and review information relevant to the medical device in the production and post-production phases. When establishing this system, the manufacturer shall consider appropriate methods for the collection and processing of information.”
2. Section 10.2 addresses “information collection.”  Looking at each item in 10.2:
   • “information generated during production and monitoring of the production process”
     Consider that many server based SaMD products would likely address this clause in their Production and Process Control type procedures.  The info to collect related to risk might be cyber-related or system availability issues for example.
   • information generated by the user
     Likely covered in the complaint handling process but should be reviewed.
   • information generated by those accountable for the installation, use and maintenance of the medical device;
     Likely Production and Process Control type procedures or Servicing procedures depending on the device.
   • information generated by the supply chain
   • publicly available information
     This can be a gap for many manufacturers that do not have a regular software quality type review process that could add a check of public info regarding similar systems, FDA notifications, notifications from other regulatory bodies, and SOUP problems/failures/patches.  Also, same meeting could address 62304 required analysis of defect trends.
   • information related to the generally acknowledged state of the art
     The same quality meeting could be used to review current standards compliance – if a new standard is published, initiate CAPA to add compliance.
3. Changing the focus from Risk-Benefit analysis to Benefit-Risk analysis.  That subtly is meant to turn more attention to “benefit” and manufacturers will need to communicate the benefit argument and medical necessity of their device relative to risk.
4. Annexes were moved to ISO/TR 24971:2020.
5. ISO/TR 24971:2020, Annex F addressees the need to manage risks related to security, making explicit the risks of security breaches and loss of confidentiality, integrity or availability can lead to harm and should be considered hazards.  This may be a change to the methods used for safety risk analysis and cybersecurity risk analysis.  Many manufacturers have not historically treated “loss of confidentiality” as leading to harm – we recommend that you update your process in this area.
6. New direction and guidance for overall residual risk evaluation.

SoftwareCPR can assist with assessing your processes against this updated ISO 14971 standard.  You can email office@softwarecpr.com or complete the form below.