Risk Management File Documentation – ISO 14971 Pack

Every medical device manufacturer has to produce a risk management file, and it is the first thing a notified body reviewer opens. This risk management file documentation set is built around what that file actually has to demonstrate: traceability from each hazardous situation through to the residual risk evaluation.

On this page:

• The four places template packs are thin, and all four are where files fail review
• What is inside the risk management file documentation pack
• Written once, or written per device, and machine learning covered
• Who the risk management file documentation pack is written for
• What the risk management file documentation pack does not do
• Frequently asked questions
• Related toolkits

The four places template packs are thin, and all four are where files fail review

Benefit-risk analysis gets its own procedure. Clause 7.4 was strengthened in the 2019 edition and it decides whether a residual risk is acceptable at all. The templates specify the benefit side properly – magnitude, probability, duration, evidence strength, alternatives available, and whether the population bearing the risk is the population receiving the benefit – and state the conclusion the standard actually permits when benefit does not outweigh risk.

Overall residual risk is a separate evaluation. Clause 8 is not the sum, the average or the maximum of individual residual risks. It is evaluated here across eight dimensions including control dependency, because three controls that each look robust while all depending on the same sensor are one control.

Two verifications are required for every risk control. Clause 7.2 requires verification that a control was implemented and verification that it is effective. A file with only the first is the single most common finding against this standard, and the traceability matrix in this risk management file documentation will not let a row close without both. The fourth gap is clause 10, the post-production loop, which was expanded in 2019 and is what keeps a file alive.

What is inside the risk management file documentation pack

44 templates covering every clause, with 30 written once for the organisation, 9 instantiated per device or device family, and 5 that are both.

• Risk management process – the procedure, the policy on risk acceptability and the competence records clause 4 requires.
• Risk management plan – per device, with the acceptability criteria and the verification activities stated up front.
• Intended use and safety characteristics – per device, and the foundation everything downstream depends on.
• Hazard analysis – per device, with hazards, foreseeable sequences of events, hazardous situations and harms kept as distinct columns rather than collapsed.
• Risk control – the option analysis in the order clause 7.1 requires, with both verifications tracked.
• Traceability matrix – the row that cannot close without implementation and effectiveness evidence.
• Overall residual risk – the eight-dimension evaluation and the report.
• Risk management report – per device, and the review record.
• Production and post-production – the collect, review and act loop, including the clause 10.4 field decision recorded even when the answer is to do nothing.
• Machine learning supplement – the hazards specific to ML-enabled devices, placed in the same hazard analysis rather than in an annex.

Written once, or written per device, and machine learning covered

Risk management has two halves, and packs that ignore the distinction produce files that cannot be used. The standard requires a process applied across the organisation and a risk management file per device. Every document here is marked as one or the other. Thirty are written once. Nine are instantiated per device – the plan, the intended use statement, the safety characteristics, the hazard analysis, the control traceability, the overall residual risk report, the risk management report, the post-production register and the change log. Five are both.

That single distinction prevents the most common structural error in this domain: one shared hazard analysis maintained across a whole portfolio, which cannot serve as evidence for any individual device.

ISO published ISO/TS 24971-2 in June 2026, guidance on applying the process to machine-learning enabled devices. No pack written before 2026 reflects it. The supplement here covers unrepresentative training data, subgroup performance, data and performance drift, automation bias, opacity, behaviour on out-of-distribution inputs, and change after release – and puts those hazards in the same hazard analysis as everything else, which is the point.

Who the risk management file documentation pack is written for

• Medical device manufacturers at any class, including software as a medical device.
• Manufacturers of machine-learning enabled devices who need the 2026 guidance reflected.
• Quality and regulatory teams whose risk management file has been queried at review.
• Organisations maintaining a portfolio where per-device and organisational documents have blurred together.

What the risk management file documentation pack does not do

It does not do your hazard analysis. The risk management file documentation supplies the structure, the method and the traceability; the device knowledge is yours.

It is not a quality management system. ISO 13485 clause 7.1 requires risk management throughout product realisation, and the quality system is a separate pack.

It does not make a device safe. It makes the reasoning about safety visible and auditable, which is what the standard asks for.

Frequently asked questions

Does it cover the EU position correctly?

Yes. EU MDR Annex I requires a risk management system and Annex II requires the plan and results in the technical documentation, and the pack states the relationship rather than assuming presumption of conformity it does not have.

Is the machine learning material included or extra?

Included, as a supplement that feeds the same hazard analysis rather than a separate parallel file.

We have a hazard analysis already. What would this add?

Most often the two verifications per control, the separate overall residual risk evaluation, and a benefit-risk procedure that specifies the benefit side rather than asserting it.

What formats are the files in?

Native Microsoft Word and Excel, fully editable, with placeholders marked throughout.

Related toolkits

It sits beside the ISO 13485 toolkit for the quality system and the IEC 62304 toolkit where the device contains software. Manufacturers on the EU market need the EU MDR toolkit or the EU IVDR toolkit. ISO publishes the standard at iso.org.

Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.

Delivery, format and licence

The risk management file documentation pack downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is locked, nothing is a PDF you cannot edit, and no add-on or portal login is needed to open it. Every organisation-specific value is marked as a placeholder so you can see what still has to be decided.

One payment, no subscription and no annual renewal. The source files behind the risk management file documentation pack are yours to adapt for your own organisation for as long as you need them, including future revisions of your own documents.