Templates and records · ISO 13485 · Clause 7.1

ISO 13485 and ISO 14971 risk management file

The full history of a medical device's risk: what could go wrong, how likely and how serious, what has been done to prevent it and why what remains is acceptable.

In one sentence

A medical device's risk management file brings together the risk management plan, identification of hazards and hazardous situations, estimation and evaluation of each risk, risk control measures with verification of their effectiveness, evaluation of overall residual risk and production and post-production information, because ISO 13485 requires risk management to be documented throughout product realisation and its records retained (7.1), with ISO 14971 as the reference method.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 13485 · Clause 7.1 Clauses are cited using the numbering of ISO 13485:2016, the current edition and the same one the Academy uses.
Type of information: Mandatory record Records to be retained (7.1); the file is defined in ISO 14971:2019, clause 4.5
Who fills it in: Multidisciplinary design and quality team With clinical input where needed; top management sets the risk acceptability criteria
When: From design and throughout the device's life Reviewed with every design change, every significant complaint and the post-market surveillance data
How long it is kept: Product lifetime, at least two years ISO 13485 requires records to be kept for at least the lifetime of the device as defined by the manufacturer, and never less than two years from release (4.2.5); the MDR requires technical documentation to be available for ten years after the last device was placed on the market, fifteen for implantables (Article 10(8)).

What the standard requires

What ISO 13485 demands and what it leaves to your judgement

ISO 13485 requires one or more documented risk management processes during product realisation and the records they generate to be retained. It does not describe the method: in practice it points to ISO 14971, the harmonised standard notified bodies use.

ISO 14971 does set out the content: risk management plan, analysis, evaluation, control, evaluation of overall residual risk, review before placing on the market, and production and post-production activities. All of it lives in the risk management file.

The European Regulation, in Annex I, requires risks to be reduced as far as possible without adversely affecting the benefit-risk ratio. A file that accepts risks merely because they are "in the green" on the matrix, without justifying why they cannot be reduced further, usually causes trouble with the notified body.

Read it in context: Product realization, in the ISO 13485 Academy

Structure

Fields the template should include

Risk management plan: scope, responsibilities and acceptability criteria
Intended use and reasonably foreseeable misuse
Hazards, sequences of events and hazardous situations
Estimated probability and severity of each harm
Evaluation against the acceptability criteria
Control measures: inherently safe design, protective measures, information for safety
Verification of implementation and effectiveness of each control
New risks introduced by the controls
Evaluation of overall residual risk and benefit-risk ratio
Risk management report before placing on the market
Production and post-production inputs and their review

Example

Example: one line of a urinary catheter analysis

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Hazard	Tip breaking during insertion
Hazardous situation	Fragment retained in the patient's urethra
Harm	Urethral injury requiring endoscopic removal
Initial estimate	Severity 4 of 5 · probability 3 of 5 · not acceptable
Control	Change to a one-piece moulded tip and a tensile test per batch (plan PI-UF-02)
Verification	Tensile test on 3 validation batches: 0 breakages below 15 N
Residual estimate	Severity 4 · probability 1 · acceptable under the criteria in plan RMP-03
Information for safety	Warning in the instructions: do not force if resistance is felt
Post-market review	Reviewed in the 2026 annual report: 0 breakage complaints in 41,000 units sold

At the audit

Mistakes auditors commonly flag

Acceptability criteria not defined before the analysis, or adjusted afterwards.
The analysis is not updated with complaints or post-market surveillance data.
Labelling warnings used as the first control measure instead of the last.
The effectiveness of control measures is not verified, only that they have been implemented.
No evaluation of overall residual risk, only risk by risk.

In Kimobox

How this record is kept in Kimobox

1Each device's risks are recorded in the risk map, with their rating and control measures.
2Control measures are assigned to an owner with a date and a delay warning.
3Complaints and recurring nonconformities feed the risk map, so the analysis does not stay frozen.
4The risk file is linked to the device file through document control and versions.

Frequently asked questions

What people ask us before getting started

Is applying ISO 14971 mandatory?

ISO 13485 does not cite it as mandatory, but it is the recognised standard for medical device risk management and the one notified bodies expect to see. Departing from it requires showing that the alternative method is equivalent.

Does an FMEA replace the risk management file?

No. FMEA is a useful tool for analysing design or process failures, but it does not cover hazards without a failure — foreseeable misuse, for example — or the evaluation of overall residual risk and the benefit-risk ratio ISO 14971 requires.

Keep your ISO 13485 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring