Risk management is FDA’s top finding under QMSR
After roughly 100 inspections under the Quality Management System Regulation, FDA’s message was blunt. “Risk management is the top observation,” said Keisha Thomas of CDRH in May 2026, adding that “Risk is central to all the activities of the quality management system” (RAPS). A month earlier at MedCon, an FDA compliance official predicted: “I’ll be shocked if that is not at the top of the list on the 483” (RAPS).
Most firms already have an ISO 14971 procedure. The findings are about whether it works across the quality system. This checklist walks through ISO 14971:2019 clause by clause, with the gaps FDA officials are describing in 2026.
Where ISO 14971 stands in 2026
| Topic | Status |
|---|---|
| ISO 14971:2019 | Current. “This publication was last reviewed and confirmed in 2025” (ISO) |
| ISO/TR 24971:2020 (guidance) | Marked “to be revised”; to be replaced by ISO/AWI TS 24971-1, under development (ISO) |
| FDA QMSR | FDA does not incorporate ISO 14971, but states “the QMSR incorporates risk management throughout its requirements” (Federal Register) |
| FDA recognition | FDA recognized the 2019 edition in December 2019; declarations to the 2007 edition ended December 25, 2022 (RAPS) |
| FDA inspections | CP 7382.850 lists failure to establish risk management in product realization as a possible OAI finding (Ropes & Gray) |
| EU MDR | EN ISO 14971:2019+A11:2021 is a harmonized standard; A11 “does NOT modify the normative part” (ISO TC 210) |
Cybersecurity is a separate but linked process. FDA’s June 27, 2025 premarket cybersecurity guidance says “Security risk management should be an integrated part of a manufacturer’s entire quality system” and that it “is distinct from performing safety risk management as described in ISO 14971” (FDA guidance PDF). For connected devices, your ISO 14971 file should show how security risks that can cause harm feed into safety risk analysis.
ISO 14971:2019 clause-by-clause checklist
Clause structure per ISO 14971:2019 (BSI overview).
Clause 4: General requirements
- 4.1 A documented risk management process covers the whole life cycle
- 4.2 Top management has defined the policy for risk acceptability criteria and reviews the process
- 4.3 Personnel performing risk tasks have documented competence
- 4.4 A risk management plan exists for each device, with acceptability criteria and verification activities
- 4.5 A risk management file provides traceability for each hazard
Clause 5: Risk analysis
- Intended use and reasonably foreseeable misuse are documented
- Characteristics related to safety are identified
- Hazards and hazardous situations are identified, with hazard and harm kept distinct
- Risks are estimated using one consistent severity and probability scale
Clause 6: Risk evaluation
- Each risk is evaluated against the plan’s acceptability criteria
Clause 7: Risk control
- 7.1 Options analyzed in priority order (inherent safety by design, protective measures, information for safety)
- 7.2 Controls are implemented and verified for implementation and effectiveness
- 7.3 Residual risk is evaluated
- 7.4 Benefit-risk analysis is done where residual risk is not acceptable
- 7.5 New risks arising from controls are assessed
- 7.6 Completeness of risk control is confirmed
Clauses 8–9: Overall residual risk and review
- Overall residual risk is evaluated and disclosed as needed
- A risk management review before release confirms the plan was carried out
Clause 10: Production and post-production
- 10.2 Information is collected from production, complaints, service and the field
- 10.3 That information is reviewed for new hazards or changed risk estimates
- 10.4 Actions update the risk management file and, where needed, design or production
The gaps FDA officials are describing
At MedCon in April 2026, FDA investigators described what they see in practice (RAPS):
| Gap | In FDA’s words | Checklist item to fix it |
|---|---|---|
| Generic procedures | ”Some companies are providing procedures during inspections that are not relevant or specific to the process” | 4.1, 4.4 |
| Vague risk controls | ”They’re not specific. They’re vague, they’re missing.” | 7.1, 7.2 |
| Hazard vs. harm confusion | When they are mixed up, “the rest of the risk analysis gets really messy” | Clause 5 |
An industry analysis of early inspections adds two more (MedDeviceOnline):
- No feedback loop: “no input pathway from complaints or CAPAs into the risk file” (Clause 10).
- Controls that don’t run on the line: a control that cannot work at production rates is “a control in name only” (7.2).
These are the author’s views, not FDA findings, but they match what FDA officials say.
Keeping the risk file alive
The recurring theme is a risk file that was written once and never connected to the rest of the QMS. Medical device risk management software should link hazards to design outputs, risk controls to verification, and complaints and CAPAs back to risk estimates.
AI can help check whether that is actually happening. AI document assessment can read your risk management procedure, plan and file against ISO 14971 and QMSR expectations, flag vague controls, hazard-harm mix-ups and missing feedback pathways, and cite the passage behind every finding.
Run a sample regulatory document assessment on your risk management procedure. AskDona shows the evidence behind every finding; your team decides what to fix.
FAQ
Is ISO 14971 required by FDA? FDA did not incorporate ISO 14971 into QMSR, but QMSR requires risk management throughout, and FDA recognizes ISO 14971:2019 as a consensus standard (Federal Register).
Is ISO 14971:2019 still current? Yes. ISO reviewed and confirmed it in 2025 (ISO).
What is the most common risk management finding? In 2026, FDA officials cite generic procedures, vague risk controls and confusion between hazards and harms (RAPS).
How does cybersecurity relate to ISO 14971? FDA treats security risk management as distinct from safety risk management but expects both to be integrated into the quality system (FDA guidance PDF).
What does clause 10 require? Collecting and reviewing production and post-production information, and updating the risk file and product when new information changes the risk picture.
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| ISO: ISO 14971:2019 | Standards body | Confirmed 2025 | Status |
| ISO: ISO/TR 24971:2020 | Standards body | Jul 6, 2026 review | To be revised |
| BSI: Risk management for medical devices | Certification body | Undated | Clause structure |
| Federal Register: QMSR final rule | Regulator | Feb 2, 2024 | ISO 14971 not incorporated |
| RAPS: FDA recognizes ISO 14971:2019 | Trade press | Jan 16, 2020 | FDA recognition |
| Ropes & Gray: A QMSR State of Mind | Law firm | Feb 17, 2026 | OAI risk finding |
| RAPS: Top observations from QMSR inspections | Trade press | May 14, 2026 | Risk management #1 |
| RAPS: MedCon risk management hurdle | Trade press | Apr 28, 2026 | FDA official quotes on gaps |
| MedDeviceOnline: Risk Is the Spine | Expert column | May 29, 2026 | Feedback loop gaps |
| ISO TC 210: EN ISO 14971 harmonized | Standards body | Jun 10, 2022 | EU harmonization |
| FDA: Premarket cybersecurity guidance (HHS copy) | Regulator guidance | Jun 27, 2025 | Security vs safety risk |
Note: check fda.gov for any revision of the cybersecurity guidance after June 2025 before publishing.