
Nevertheless, the new Article 10 (2) obligation on Manufacturers to establish a risk management system, combined with the explicit requirements for each device contained in the new Annex I Chapter I (3), means that the current state of the art in device risk management (EN ISO 14971) will become the new minimum standard for device risk management under the new EU IVDR.The risk management process for medical devices can be overwhelming. But it’s not a verbatim copy and paste of EN ISO 14971, as that wouldn’t allow the use of other approaches or for the risk management solutions to be developed and improved over time. Even to the point of adopting terms like “production phase” rather than post market phase.

If all of the above reads like a paraphrasing of the requirements of EN ISO 14971, it clearly is. Additionally, in the “production phase”, evaluate the impact of new information and if necessary amend control measures accordingly. Under the new EU IVDR, Manufacturers must have for each device a documented risk management plan, identify and analyse the known and foreseeable hazards, estimate and evaluate the associated risks and eliminate or control those risks. The detailed requirements of which are listed in the new Annex I Chapter I (3). But in addition, the new Article 10 (2) now explicitly requires Manufacturers to establish, document, implement and maintain a system for risk management.

In the new EU In Vitro Diagnostics Regulation (IVDR), the requirements to eliminate or reduce risks associated with the device are carried forward from the IVDD into the new Annex I Chapter I (4).

In practice however, the expectation of both Competent Authorities and Notified Bodies is that manufacturers implement a risk management system based on the harmonised standard EN ISO 14971, Application of risk management to medical devices. The IVDD doesn’t explicitly require manufacturers to have a risk management system. While the current In Vitro Diagnostics Directive (IVDD) in Annex I A (2) requires manufacturer’s to eliminate or reduce risks associated with the use of the devices as far as possible, implement protection measure for any risks that cannot be eliminated and inform users of residual risks.
