Risk Management (RMP, Risk Analysis & RMR)
MDR Reference: Annex II, Section 5; Annex I, Sections 1-9
BPG Rev.4 Reference: Section 5 (pp. 28-31)
Document Code: AII-S5
Responsible Party: CRO
Service Mode: Write / Assist / Review
Risk Management Plan (RMP)
Requirements Checklist
- [ ] Scope of risk management activities
- [ ] Complete description and identification of devices and accessories
- [ ] Device life cycle phases description
- [ ] Assignment of responsibilities and authorities
- [ ] Requirements for review of risk management activities
- [ ] System for categorisation (probability of occurrence x severity of harm)
- [ ] Definition of criteria for acceptable risk levels
- [ ] Evaluation of residual risk acceptability (individual and overall)
- [ ] Criteria for overall residual risk acceptability
- [ ] Method and evaluation of overall residual risk
- [ ] Verification of implementation of risk control measures
- [ ] Verification of effectiveness of risk control measures
- [ ] Identification of activities for production and post-production information collection/review
- [ ] Evidence of appropriately qualified risk management team (including clinical expert)
Risk Analysis & Risk Control
Requirements Checklist
- [ ] Benefit-risk analysis per MDR Annex I, Sections 1 and 8
- [ ] Solutions adopted and results per MDR Annex I, Section 3
- [ ] Safety concept per MDR Annex I, Section 4 (including residual risk information to users)
- [ ] Design risk assessment: documented risk assessment for design aspects
- [ ] Production/process risk assessment: documented risk assessment for manufacturing
- [ ] Clinical/application risk assessment: documented risk assessment for clinical usage
- [ ] Assessment of design changes adding new hazards or reducing existing hazards
- [ ] Use-related risk reduction per MDR Annex I, Section 5 and EN 62366-1
Risk Analysis Coverage (BPG Rev.4 minimum scope)
- [ ] Hazards related to all device components
- [ ] Hazards related to clinical use
- [ ] Hazards related to ergonomic features and use environment
- [ ] Hazards related to user technical knowledge, experience, education, training
- [ ] Hazards related to medical/physical conditions of intended users
- [ ] Hazards related to reuse (for SUDs: GSPR 23.4(p) risks)
- [ ] Hazards related to manufacturing process
- [ ] Hazards related to cybersecurity
- [ ] Hazards related to software updates (device software and platform OS)
- [ ] For Annex XVI devices: risk evaluation per Commission Regulation (EU) 2022/2346
- [ ] Additional hazards per EN ISO 14971 Annex C and ISO/TR 24971
Demonstrated Outcomes
- [ ] All known and foreseeable hazards identified and analysed
- [ ] Risks minimised and acceptable vs benefits (normal conditions of use)
- [ ] Risks from intended use and foreseeable misuse estimated and evaluated
- [ ] All risks reduced ALARP considering SOTA
- [ ] Risk control measures implemented (with document references)
- [ ] Effectiveness of risk control measures verified (with document references)
- [ ] Residual risks identified, acceptability assessed
- [ ] Clinical benefits outweigh all residual risks
- [ ] Production and post-production information evaluated for risk impact
Risk Management Report (RMR)
Requirements Checklist
- [ ] Evaluation of each residual risk acceptability
- [ ] Evaluation of overall residual risk acceptability
- [ ] Evaluation of the benefit-risk ratio
- [ ] Statement: device in intended purpose constitutes acceptable risk vs benefits, compatible with high level of health/safety protection considering SOTA (MDR Annex I, 1)
- [ ] For Annex XVI devices: statement per MDR Annex I, 9
- [ ] Evidence of lifecycle management (analysis throughout device lifecycle)
- [ ] Interface between RM and pre-clinical/clinical evaluation is clear (Annex VII, 4.5.4(c), 4.5.5)
Key Regulatory References
- MDR (EU) 2017/745, Annex II, Section 5
- MDR (EU) 2017/745, Annex I, Sections 1-9
- EN ISO 14971:2019+A11:2021: Application of risk management to medical devices
- ISO/TR 24971:2020: Guidance on the application of ISO 14971
- EN 62366-1:2015+A1:2020: Usability engineering (use-related risks)
- MDCG 2022-21: PSUR/PMS guidance (end of obligation to update)
- Commission Regulation (EU) 2022/2346: Common Specifications for Annex XVI devices
- Team-NB BPG for TD Submission, Rev.4 (2026-04-21), Section 5
Common Pitfalls (from BPG Rev.4)
- Risk controls not clear enough (e.g. "IFU" as control without specifying what information was added)
- IFU warnings/cautions used as risk control without usability engineering verification
- Risk controls not aligned with MDR Annex I GSPR 4 hierarchy
- Verification of implementation vs verification of effectiveness not distinguishable
- Semi-quantitative occurrence rates do not reflect clinical reality (e.g. 1 in 10 called "occasional")
- Risk acceptability decided by RPN/"green area" alone -- MDR requires individual risk acceptability decisions based on predefined criteria
Dependency
- RMP is a Phase 1 deliverable (strategic framework, delivered early)
- RMR is a Phase 4 deliverable (must finalize after CER due to bi-directional coupling)
- Risk Analysis Sheet is a living document updated throughout the project
Bi-directional Coupling with CER
The RMR benefit-risk analysis requires CER conclusions as input. Conversely, the CER must reference the RMR overall residual risk assessment. Any inconsistency between these two documents will be flagged by the NB. Risk management outputs also inform PMS Plan indicators and PMCF Plan objectives.