Best ISO 14971 risk management software for medical devices

What ISO 14971 and the MDR ask for

ISO 14971:2019 is the standard for risk management of medical devices, including software as a medical device and IVDs. ISO last reviewed and confirmed it in 2025, so the 2019 edition is still current.¹ According to ISO, the process runs from a device’s first concept to its disposal and covers every kind of risk, from biocompatibility and electrical safety to data and systems security and usability. The 2019 edition puts more weight on benefit-risk and on production and post-production. The standard requires you to set objective criteria for risk acceptability but doesn’t say what an acceptable level is.¹

The EU MDR spells out the same process in Annex I, Section 3. Risk management is “a continuous iterative process throughout the entire lifecycle of a device”, and you have to:²

• write a risk management plan for each device;
• identify the known and foreseeable hazards;
• estimate and evaluate the risks in intended use and in reasonably foreseeable misuse;
• eliminate or control them;
• evaluate information from production and post-market surveillance, and change the controls if it calls for that.

Section 4 sets the order for risk controls: safe design and manufacture first, then protective measures, then information for safety. Both the residual risk of each hazard and the overall residual risk have to be acceptable, and users have to be told about residual risks.²

In the US, the QMSR incorporates ISO 13485, not ISO 14971. FDA says ISO 14971 and the other standards ISO 13485 refers to “may be helpful in understanding application of ISO 13485”.³

Three things vendors call risk management

An ISO 14971 risk file. Hazards, hazardous situations and harms are records, each risk is estimated against a matrix you define, and each risk control is a requirement that a test verifies. Eight of the 21 systems we reviewed document this, usually inside their design controls.

An FMEA. A table of failure modes scored with risk priority numbers. Several systems offer FMEA for processes, equipment or production rather than for the device design: Scilife’s risk assessments are FMEAs for processes, equipment and systems, and ETQ Reliance has an FMEA with a hazard analysis but no ISO 14971 risk file.⁴⁵ An FMEA can feed a risk file, but on its own it doesn’t show the plan, the foreseeable misuse, the residual and benefit-risk evaluation or the post-market updates the MDR asks for.

A business risk register. A list of risks to the company or its operations, with owners and scores. Ideagen’s documented risk module and Qualityze’s are of this kind.⁶⁷ It isn’t a device risk management file.

What to look for in risk management software

• Your own acceptability criteria. ISO 14971 doesn’t set acceptable risk levels,¹ so the risk matrix and its thresholds have to be configurable per product.
• Risk controls linked to requirements and tests. The MDR’s order of priority starts with safe design,² so many controls are design requirements, and each should trace to the test that verifies it.
• Updates from production and the field. Complaints, nonconformances, CAPAs and post-market data have to flow back into the risk file.² TrackWise Digital documents links from nonconformances and CAPAs to individual risks, and Scilife’s FMEAs link to CAPAs and change requests.⁸⁴
• A generated risk management file. Ketryx and Orcanos document generating the risk management file from the linked records.⁹¹⁰ Greenlight Guru claims it without documentation we could check.¹¹

Common gaps we found

Risk outside the design. TrackWise Digital’s risk module keeps a risk file per product with a residual-risk matrix, but there are no design controls for risk controls to link to.⁸ Scilife’s FMEAs aren’t linked to its design items.⁴

Claimed, not documented. Dot Compliance describes FMEA with residual risk only in a marketing FAQ, QT9 shows risk scoring on marketing pages, and Ideagen and Qualityze claim ISO 14971 risk files only on marketing pages.¹²¹³⁶⁷ Ask for a demo of one hazard traced from its risk control to the test that verifies it, and of a complaint that updates a risk estimate.

Documents instead of records. SimplerQMS manages risk files as controlled documents from templates, and Arena users attach risk files to records.¹⁴¹⁵ That’s document control: the system can’t show an unverified risk control or a hazard without a control.

How we ranked risk management software

The list below uses one row of our clause matrix: the risk management file (ISO 14971). A system gets a full point when its documentation, a demo or an independent source shows the risk management workflow, and half a point when the feature is limited or only named on a marketing page.¹⁶ Systems with the same coverage are ordered by their overall score. Our design control software ranking adds design controls and IEC 62304 to the same row.