ISO 14971:2019 · ISO/TR 24971:2020 · ISO/TS 24971-2:2026 · EU MDR · EU IVDR · EU AI Act
Medical Device Risk Management: ISO 14971 and Artificial Intelligence
Most risk management files are complete in form and thin in substance. They contain a hazard table, a set of scores and a report, and they cannot answer the question the whole exercise exists for: when something goes wrong in the field, was it already in the file, what was estimated, what was supposed to prevent it, and was that control ever shown to work. This course works through the standard clause by clause, states each requirement precisely, and shows how it is implemented in a working document.
Scope
What the course covers
Where a requirement is quoted, it is quoted in full and then explained. Where something is an interpretation rather than a rule, the course says so.
01
The three standards, read together
ISO 14971 states the requirements, ISO/TR 24971 supplies the method, and ISO/TS 24971-2 adds a layer for devices that incorporate machine learning. All three share clause numbering 4 to 10, and the course keeps them aligned throughout.
02
What the European regulations add
Three requirements exceed the standard and each invalidates a common practice: information for safety does not reduce risk, reduction as far as possible admits no economic limit, and an acceptable risk still requires a record of whether further reduction was available.
03
The documents, not only the requirements
The plan, the hazard analysis, the design and use-related failure analyses, the report and the GSPR mapping — shown section by section, with what goes in each field and how to check your own against them.
04
Devices that learn
Bias as a source of hazard, autonomy as a set of properties, human oversight and the four conditions that make it a control, drift in its four forms, and why an analysis built on failure modes finds none of the hazards that matter.
05
In vitro diagnostics
Where the harm reaches the patient through a clinical decision, the analytical characteristics are the characteristics related to safety, and the pre-analytical phase sits outside your control and inside your analysis.
Outline
13 modules, in the order the process runs
The course follows the sequence of the work rather than the numbering of the regulation, and ends where the work ends.
Introduction
What the course contains, who it is for, and how it is meant to be usedThe three standards, the two regulations and the AI Act
What is binding, what is voluntary, and the three points where they divergeThe risk management system: process, plan and file
Clause 4 — the policy, the criteria, the seven elements of the plan, traceabilityIntended use, misuse and characteristics related to safety
Clauses 5.1 to 5.3 — what the analysis is built onHazards, hazardous situations and the techniques that find them
Clause 5.4 — the chain, the six techniques, and harm with no faultBias as a source of hazard
Its sources, how subgroups are selected, and why the fairness definitions conflictRisk estimation, acceptability criteria and risk evaluation
Clauses 5.5 and 6 — P1 and P2, denominators, and what Europe addsRisk control, risks introduced by controls, and security
Clause 7 — the priority order, the two verifications, and security as a conversionAutonomy, human oversight and information for safety
The most claimed control measure, and the four conditions that make it realOverall residual risk, benefit-risk and the review before release
Clauses 8 and 9 — why the whole is not the sum, and what the report must stateProduction and post-production: the loop that closes the file
Clause 10 — active collection, the four review questions, trend reporting, driftIn vitro diagnostics: risk management under the IVDR
A different shape of chain, and the phases outside the manufacturer’s controlThe risk management file in practice
Assembly, interfaces, legacy devices, and the order in which gaps are closedFinal test
Covering the whole courseOutcomes
What you will be able to do
01
Write an acceptability policy that criteria can be derived from
Four sentences, four sources, and one of them fixed by European law. It is the document most files do not have, and every criterion depends on it.
02
Build a hazard analysis that finds what matters
The chain kept in four parts, one row per hazardous situation, and the techniques chosen for what each is capable of finding.
03
Verify that a control worked, not only that it exists
The second verification of clause 7.2 is the one most files do not have. The course states what counts as evidence for each type of control.
04
Handle a device that incorporates a model
Where the dominant hazards arise while everything is working as specified, and what has to be logged before release for the post-market loop to function.
05
Assess an existing file and know what to fix first
Three passes, one day, and a work list ordered by dependency rather than by severity — because working in severity order produces work that is redone.
Format
Designed to be worked through, not watched
Self-paced and fully online, with progress saved to your account and every module replayable. Transcripts are downloadable, so the content stays searchable long after the video is finished. Access does not expire, and revisions made after your purchase are included.
Audience
Who the course is for
- Regulatory and quality professionals writing or maintaining a risk management file
- Engineers and product managers whose device now includes a machine learning component
- Consultants who assess files and need the vocabulary to be precise
- Anyone who inherited a file and has to establish what is missing
It assumes familiarity with medical device regulation and with a quality management system. It does not assume prior study of the articles and annexes it covers.
Certificate
Verifiable by a third party
On passing the final test, the certificate carries a verification code derived from your name and the date of completion.
An employer, an auditor or a client can confirm it on a public page, and it can be filed as training evidence under your quality system.
MDR-XXXX-XXXX · mdregulatory.com/verify
Questions
Before you enrol
Do I need a copy of ISO 14971?
It helps but is not required. The course quotes the clauses it discusses and does not reproduce the standard. Having your own risk management file open matters more, because most modules end with an exercise performed on it.
Does it cover devices without artificial intelligence?
Yes. The machine learning material is additive and sits in the module where the corresponding clause is treated, so a conventional device manufacturer can follow the course and lose nothing.
Does it cover in vitro diagnostics?
Module 11 is devoted to them, because the harm reaches the patient through a clinical decision rather than through contact with the device, and that changes the analysis at every stage.
Is this a course about passing an audit?
No. Every requirement is justified by what it does for the device and for the people who use it. A file written to satisfy a reviewer and a file written to be usable diverge quite quickly, and only one of them helps when a hospital calls.
What is included besides the videos?
A gap assessment workbook ordered the same way as the modules, the slides as PDF, a quiz after each module, and a final test that issues a certificate with a verification code.
How long do I have access?
Access does not expire. The course stays in your account, including any updates made to the modules after your purchase.
Is there a certificate?
Yes. Passing the final test issues a certificate with a verification code, which anyone can check on our verification page.
Can I watch the modules in any order?
The modules unlock in sequence, because each one builds on the previous. Once unlocked, a module stays available and can be rewatched.
Do I need any prior knowledge?
The course assumes you work in the sector and know what a technical file and a notified body are. No knowledge of the specific technology is assumed.
Can my company buy several seats?
Yes. Write to us and we will set up team access with a single invoice.
Course and kit
The course explains the reasoning. The kit gives you the structure.
The workbook included with the course is a gap analysis of your own documentation, arranged in the order an assessment runs. Working through it produces a list of what is missing or partial in your file.
That list maps to the templates in the Risk Management Kit.
Enrol
From the acceptability policy to the post-market loop — with the documents that hold each requirement.
13 modules, 3h 25min of video, downloadable transcripts, workbook and certificate. Self-paced, with no expiry.