ISO 14971 Updated in 2019 Release

This content is only available to our Premium subscribers. See our Subscribe page for information on subscriptions.

ISO 14971 was updated and released in 2019.  We previously discussed the internal debate regarding ISO 14917 in this post ISO 14971 versus the EU Commission.

There are several items to consider with the new update:

  1. Section 10.1 – “The manufacturer shall establish, document and maintain a system to actively collect and review information relevant to the medical device in the production and post-production phases. When establishing this system, the manufacturer shall consider appropriate methods for the collection and processing of information.”
  2. Section 10.2 addresses “information collection.”  Looking at each item in 10.2:
    • “information generated during production and monitoring of the production process”
      Consider that many server based SaMD products would likely address this clause in their Production and Process Control type procedures.  The info to collect related to risk might be cyber-related or system availability issues for example.
    • information generated by the user
      Likely covered in the complaint handling process but should be reviewed.
    • information generated by those accountable for the installation, use and maintenance of the medical device;
      Likely Production and Process Control type procedures or Servicing procedures depending on the device.
    • information generated by the supply chain
    • publicly available information
      This can be a gap for many manufacturers that do not have a regular software quality type review process that could add a check of public info regarding similar systems, FDA notifications, notifications from other regulatory bodies, and SOUP problems/failures/patches.  Also, same meeting could address 62304 required analysis of defect trends.
    • information related to the generally acknowledged state of the art
      The same quality meeting could be used to review current standards compliance – if a new standard is published, initiate CAPA to add compliance.
  3. Changing the focus from Risk-Benefit analysis to Benefit-Risk analysis.  That subtly is meant to turn more attention to “benefit” and manufacturers will need to communicate the benefit argument and medical necessity of their device relative to risk.
  4. Annexes were moved to ISO/TR 24971:2020.
  5. ISO/TR 24971:2020, Annex F addressees the need to manage risks related to security, making explicit the risks of security breaches and loss of confidentiality, integrity or availability can lead to harm and should be considered hazards.  This may be a change to the methods used for safety risk analysis and cybersecurity risk analysis.  Many manufacturers have not historically treated “loss of confidentiality” as leading to harm – we recommend that you update your process in this area.
  6. New direction and guidance for overall residual risk evaluation.

SoftwareCPR can assist with assessing your processes against this updated ISO 14971 standard.  You can email or complete the form below.

About the author

Brian is a biomedical software engineer - whatever that is! Started writing machine code for the Intel 8080 in 1983. Still enjoys designing and developing code. But probably enjoys his garden more now and watching plants grow ... and grandkids grow!

SoftwareCPR Training Courses:

IEC 62304 and other emerging standards for Medical Device and HealthIT Software

Our flagship course for preparing regulatory, quality, engineering, operations, and others for the activities and documentation expected for IEC 62304 conformance and for FDA expectations. The goal is to educate on the intent and purpose so that the participants are able to make informed decisions in the future.  Focus is not simply what the standard says, but what is meant and discuss examples and approaches one might implement to comply.  Special deep discount pricing available to FDA attendees and other regulators.

3-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Brian Pate

Next public offering:  TBD

Email to request a special pre-registration discount.  Limited number of pre-registration coupons.

Registration Link:




Being Agile & Yet Compliant (Public or Private)

Our SoftwareCPR unique approach to incorporating agile and lean engineering to your medical device software process training course is now open for scheduling!

  • Agile principles that align well with medical
  • Backlog management
  • Agile risk management
  • Incremental and iterative software development lifecycle management
  •  Frequent release management
  • And more!

2-days onsite (4 days virtual) with group exercises, quizzes, examples, Q&A.

Instructors: Mike Russell, Ron Baerg

Next public offering: March 7 & 28, 2024

Virtual via Zoom

Registration Link:

Register Now



Medical Device Cybersecurity (Public or Private)

This course takes a deep dive into the US FDA expectations for cybersecurity activities in the product development process with central focus on the cybersecurity risk analysis process. Overall approach will be tied to relevant standards and FDA guidance documentation. The course will follow the ISO 14971:2019 framework for overall structure but utilize IEC 62304, IEC 81001-5-1, and AAMI TIR57 for specific details regarding cybersecurity planning, risk characterization, threat modeling, and control strategies.

2-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Dr Peter Rech, 2nd instructor (optional)

Next public offering:  TBD

Corporate Office

15148 Springview St.
Tampa, FL 33624
Partners located in the US (CA, FL, MA, MN, TX) and Canada.