Risk Management under EU MDR
Medical Device Risk Management Under EU MDR 2017/745
Article 10 of EU MDR 2017/745 sets forth stringent guidelines for risk management as part of the medical device regulations and stresses the need for a thorough risk management process.EU MDR 2017/745 states that manufacturers shall have a system for risk management that includes establishment, documentation, implementation, and maintenance. The risk management system shall remain consistent and be updated through all phases of the product life cycle, including the Post Market Surveillance (PMS), and be part of the Quality Management System (QMS) of the manufacturer. Although MDR sets out the mandatory requirements, the "state of the art" way to satisfy the regulation is the international standard ISO 14971 (Medical devices – Application of risk management to medical devices) and its technical report ISO/TR 24971 (Guidance on the application of ISO 14971).
The Role Of ISO 14971 And ISO/TR 24971 In EU MDR
Although the EU MDR is a regulation and ISO 14971 is a standard, they are inextricably linked.
Document | Role | Key Takeaway |
EU MDR 2017/745 | The Regulation (Law) | Mandates the "As Far As Possible" (AFAP) reduction of risk. |
ISO 14971:2019 | The Standard (Process) | The systematic process for managing risk. Use the EN version for EU compliance. |
ISO/TR 24971:2020 | The Guidance (Help) | Practical tips and examples on how to implement the standard effectively. |
For European compliance, manufacturers should refer to the Harmonized Standard (EN ISO 14971). This version includes Annex Z, which specifically outlines how the clauses of ISO 14971 map to the General Safety and Performance Requirements (GSPRs) of the MDR.
Risk Management Plan
The first step toward compliance is creation of a Risk Management Plan. As per ISO 14971 and the MDR, this plan shall specify the scope of risk management process and include the following:
The lifecycle phases to be covered by the plan.
Responsibilities and authorities.
Requirements for the review of risk management activities.
Criteria for risk acceptability (based on the manufacturer’s policy).
Process for assessment of the residual risk.
Verification activities.
Risk Analysis And Evaluation
Once the plan is in place, the manufacturer must perform a risk analysis for the specific medical device. This involves:
Intended Use & Misuse: Defining the intended use and reasonably foreseeable misuse.
Hazard Identification: Identifying known and foreseeable hazards associated with the device (e.g., electrical, biological, or software hazards).
Risk Estimation: Estimating the probability of occurrence and the severity of harm for each hazardous situation.
Following analysis, Risk Evaluation is performed to determine if the risk is acceptable based on the criteria defined in the plan.
Risk Control And The "AFAP" Requirement
Where the risk is regarded as an unacceptable one, risk controls must be put in place. The major difference in the new MDR from the previous standards is the need for the risks to be reduced "As Far As Possible" (AFAP).
The manufacturers will have to apply risk controls based on the following hierarchy of priority (MDR Annex I, Chapter I):
Inherent safety: Risks should be reduced through good design and manufacture.
Protection: Alarms or protective measures against risks that cannot be eliminated should be introduced.
Information for safety: Warnings and precautions should be provided to users.
Point to note: In the EU MDR, the provision of "information for safety" (labels) cannot be classified as a risk reduction technique.
Benefit Risk Analysis
In cases where a residual risk cannot be deemed acceptable according to the standards provided in the risk management plan, then a benefit risk analysis will have to be conducted. The manufacturer needs to collect data and literature to prove that the clinical benefits of the medical device are more than the residual risks associated with it.
Production And Post Production Activities
Risk management is not over even after the launch of the device. The EU MDR requires an active approach for information gathering in the post market phase, which includes the following:
Post Market Surveillance (PMS): Gathering information about the performance of the device.
Post Market Clinical Follow up (PMCF): Active gathering of clinical information to update the clinical evaluation.
Vigilance: Reporting incidents and field safety corrective actions.
This information is then used as input into the risk management process to assess the risk benefit balance.
Conclusion
The proper implementation of the risk management program is the key component of MDR requirements. With the help of applying ISO 14971 principles and using ISO/TR 24971 as a guideline, you will be able to develop a product that will conform to the requirements of the highest safety level needed for the European market. Risk management is a dynamic process.
How Morulaa Can Help
Morulaa assists medical device companies in developing and maintaining a risk management system that is in compliance with EU MDR regulations and standards ISO 14971 & ISO/TS 24971. We can assist in preparing the Risk Management Plan, Risk Analysis, Risk Control documents and the Benefit Risk Analysis in line with MDR and Notified Bodies' requirements. Moreover, we can assist in the alignment of the Risk Management process with Clinical Evaluation, Post Market Surveillance, PMCF and Vigilance processes for consistency of technical documentation.
Other posts
Don't let European red tape stall your vision. We simplify complex EU building regulations so you can focus on creation. Explore our blog for the clarity you need during your project and the insights required for post completion compliance. Read on for smoother approvals and smarter builds across Europe.