ISO 14971:2019—Which Changes Impact Human Factors?

Introduction

In December 2019, the new version of ISO 14971:2019, Medical devices – Application of risk management to medical devices was released, along with ISO TR 24971:2019, Medical devices – Guidance on the application of ISO 14971. The purpose of the update to ISO 14971 was to clarify the standard, particularly when it comes to production and post-production information and risk-benefit analysis. Here, we break down the important updates that may impact your future human factors submission.

New Key Definitions

Important Updates Relevant to Human Factors Documentation

The new standard has updated clauses which may impact how a use-related risk analysis (uFMEA) and risk-benefit analysis should be structured. In this blog post, we focus on three major changes to the content that should be considered before starting use-related risk management activities for a new product adhering to the ISO 14971:2019 standard.

The clause regarding risk analysis (Clause 5.4) was updated to include the requirement for manufacturers to identify anticipated hazards in both normal and fault conditions. The previous version of the standard did mention this concept in other sections but focused primarily on identifying hazards under fault conditions. This change means that all reasonably foreseeable risks should be identified and captured in the use-related risk analysis, including normal conditions. Many risk analysis tools such as FMEA and fault tree cover only the hazards related to fault conditions, and not to normal conditions. Therefore, you should review how your organization is identifying hazard-related use scenarios and determine if you need to start using additional tools in the risk management process, in order to capture hazards in both normal and fault conditions. Additionally, the IEC 62366 definition of “normal use” conflicts with the concept of “normal conditions:” “normal use” is defined as use “according to the instructions for use,” and yet normal conditions often do not include use of the IFU. This gap must be addressed, as we noted in our blog post, Redefining “Normal Use” for Medical Devices.

The clause regarding risk-benefit analysis (Clause 7.4) has been updated to “Benefit-Risk Analysis” to align with regulatory changes. The new standard update requires only risks deemed to be unacceptable to be analyzed, and it is up to the manufacturer to determine if there are other regulatory requirements that must be met. Conducting risk-benefit analysis on all use-related risks after a usability study can take a significant amount of time; this update will significantly streamline the process and focus manufacturers, human factors engineers, and reviewers on risks that have an unacceptably high residual risk level. Additionally, ISO TR 24971:2019 Clause 7.4 has been updated to include an extensive discussion on benefit-risk analysis. The new update highlights that “benefit” shall not include economic or business advantages.

Clause 10 was retitled from “Production and Post-production Information” to “Production and Post-production Activities”. This section has been extensively revised and aligns with Clause 8 Measurement and Analysis and Improvement in ISO 13485. This change emphasizes a need for an active process for gaining information as opposed to just waiting for complaints to be reported. This new strategy aligns with post-market surveillance requirements by regulators, and requires the inclusion of risk management in post-market surveillance activities. Recommended active processes include: 1) monitoring of social media and YouTube for use-related complaints, 2) training of sales representatives to effectively detect use-related complaints, report on all product feedback and incorporate it with complaint management system, and 3) periodic observation of actual cases of device use in the field by manufacturer representatives and/or human factors engineers.

How does this impact the Human Factors process?

Only the broadening of the definition of “harm” has an impact on the human factors process, as it requires that “unreasonable psychological stress or unwanted pregnancy” be considered in risk identification and assessment (ISO 14971:2019, Annex A, Section A.2.3 Terms and Definitions). Other than this redefinition, there is no impact to previous or ongoing human factors activities or documents.

As such, you may want to consider referencing the ISO 14971:2019 version for future product release. The FDA currently recognizes only ISO 14971:2007 and the EU recognizes only EN ISO 14971:2012 (the harmonized version of ISO 14971:2007). Therefore, there is no regulatory mandate to switch future human factors activities to reference ISO 14971:2019 at this time. However, always check with your regulatory team or consultant for additional guidance on the standards to use for risk management activities.

Other Key Changes

General updates to key information
Information from the Informative Annexes of ISO 14971 are moving to the Technical Report (TR 24971) to improve ease of future updates. Additionally, the 2019 standard includes the new clause “Normative References” (A2.2) which identifies that no other standards are required to establish and maintain a risk management process in accordance with ISO 14971.

Updates to figures
In Clause 4.1, the Figure 1 diagram has been changed to include “Risk management plan” as the overarching document for the risk management process. Additionally, minor changes to the titles in various steps in describing the risk management process. This may require you to revise your process drawings if they were taken directly from the former ISO 14971 version.

Updates to Risk Management Report/Review (Clause 9)
The title of the clause was changed from “Risk management report” to “Risk management review” to emphasize that the risk management must be reviewed prior to release for distribution to determine 1) If the risk management plan has been appropriately implemented, 2) if the overall residual risk is acceptable, and 3) if appropriate methods are in place to collect and review information in the production and post-production phases. This clause newly states that reviewers must be identified in the risk management plan in advance of the review.

References:
EN ISO 14971:2012
ISO 14971:2019
ISO TR 24971:2019