Regulatory Open Forum

There seems to be some confusion within the medical device industry regarding the use of labeling as it relates to risk.  I think some of it may be due to how risk is addressed in different regulations and standards, along with some confusion about different definitions of risk mitigation, reduction, and control found in the different regulations and standards?

Can anyone here sort this out?  Or is some of it still in the process of interpretation?

Julie,

This is easy to understand, but as you point out there is confusion. The primary source is a misunderstanding of the content deviations in EN ISO 14971:2012.

While the next statement is technically not correct, it makes the discussion easier. There are two versions of the risk management standard in play, ISO 14971:2007 and EN ISO 14971:2012. The former is the international standard and forms the basis for regional and national regulations around the world. Most regulatory regions have adapted it without adjustment. The EU, however, has adopted it “with adjustment”. They realized (the story is not worth the telling) that if a company implements ISO 14971:2007 as written, they would be out of compliance with the associated product directive. Consequently, they wrote three annexes, one for each directive, to explain the differences. These are called Content Deviations, and they differ by directive.

First, there is no standard numbered ISO 14971:2012. The international standard didn’t change, only the EU version.

Second, the term mitigation is incorrect. The standard uses risk reduction, and the word mitigation is not in the standard. Think of risk reduction as reducing the severity or probability of harm before it happens. Think of mitigation as addressing the effect of the harm after it happens. Risk reduction, for example, reduces the risk of amputation. A prosthesis helps mitigate the effect of amputation.

FDA seems to have adopted a policy using the word mitigation, when they mean reduction. In addition, FDA has adopted a policy to use the term benefit-risk, while the standards use risk-benefit. This will only exacerbate the rampant confusion.

The primary point however, is the use of information for safety as a risk reduction measure when implementing EN ISO 14971:2012. To be specific, I’ll use the MDD to explain the issue. ISO 14971:2007, clause 6.2, lists three risk reduction options in priority order:

• inherent safety by design
• protective measures in the medical device itself or in the manufacturing process
• information for safety

The manufacturer implements them, in order, to achieve acceptable residual risk. When the residual risk is acceptable, however, the manufacturer may stop, i.e., there is no requirement to implement all of them,

However, EN ISO 14971:2012 Annex ZA Content Deviation #6 says that, according to the MDD Annex I Section 2 second sentence first indent manufacturers should use “eliminate or reduce risks as far as possible (inherently safe design and construction)” as the first risk control option.

In addition, EN ISO 14971:2012 Annex ZA Content Deviation #5 says that, according to the MDD Annex I Section 2 second sentence, the manufacturer cumulatively applies the risk control options. The content deviation concludes that the manufacturer must apply all the "control options" and may not stop if the first or the second control option has reduced the risk to an "acceptable level". In other words, if a manufacturer does not utilize information for safety, the manufacturer is out of compliance with the MDD!

The problem comes from a misreading of EN ISO 14971:2012 Annex ZA Content Deviation #7 coupled with a failure to differentiate between “information for safety” and “disclosing residual risk”.

In ISO 14971:2007 clause 6.4 the manufacturer must, “For residual risks that are judged acceptable, … decide which residual risks to disclose and what information is necessary to include in the accompanying documents in order to disclose those residual risks”. In the International standard disclosing residual risk is an option. Recall that residual risk is “risk remaining after risk control measures have been taken” [2.15]

Notice that, at this point, information for safety reduces risk and is mandatory for the MDD. Residual risk is the risk that cannot be reduced and, for the international version, the manufacturer decides whether or not to disclose it.

EN ISO 14971:2012 Annex ZA Content Deviation #7 says that the MDD Annex I Section 2 second sentence third indent, requires that the manufacturer “inform users of the residual risks due to any shortcomings of the protection measures adopted”. In other words, when the three risk control options don’t eliminate the risk, i.e., there is residual risk, the manufacturer must disclose it. The conclusion in the content deviation is, “manufacturers shall not attribute any additional risk reduction to the information given to the users”.

The problem arises when Notified Bodies read the “information given to the users” to mean the information for safety, not the information from disclosing residual risks.

Were the Notified Body’s misunderstanding to prevail, it would write a nonconformance:

1. a) For failure to use information for safety as a risk control option (Content Deviation #5) and
2. b) Using information for safety as a risk control option (misunderstanding of Content Deviation #7).

Clearly, this doesn’t make sense. My recommendation is that if a device manufacturer receives a non-conformance for using information for safety, the b) part above, then it is time to get a new Notified Body.

Sorry for the long response, but this is a problem about which I’m passionate.

There seems to be some confusion within the medical device industry regarding the use of labeling as it relates to risk.  I think some of it may be due to how risk is addressed in different regulations and standards, along with some confusion about different definitions of risk mitigation, reduction, and control found in the different regulations and standards?

Can anyone here sort this out?  Or is some of it still in the process of interpretation?

Julie,

This is easy to understand, but as you point out there is confusion. The primary source is a misunderstanding of the content deviations in EN ISO 14971:2012.

While the next statement is technically not correct, it makes the discussion easier. There are two versions of the risk management standard in play, ISO 14971:2007 and EN ISO 14971:2012. The former is the international standard and forms the basis for regional and national regulations around the world. Most regulatory regions have adapted it without adjustment. The EU, however, has adopted it “with adjustment”. They realized (the story is not worth the telling) that if a company implements ISO 14971:2007 as written, they would be out of compliance with the associated product directive. Consequently, they wrote three annexes, one for each directive, to explain the differences. These are called Content Deviations, and they differ by directive.

First, there is no standard numbered ISO 14971:2012. The international standard didn’t change, only the EU version.

Second, the term mitigation is incorrect. The standard uses risk reduction, and the word mitigation is not in the standard. Think of risk reduction as reducing the severity or probability of harm before it happens. Think of mitigation as addressing the effect of the harm after it happens. Risk reduction, for example, reduces the risk of amputation. A prosthesis helps mitigate the effect of amputation.

FDA seems to have adopted a policy using the word mitigation, when they mean reduction. In addition, FDA has adopted a policy to use the term benefit-risk, while the standards use risk-benefit. This will only exacerbate the rampant confusion.

The primary point however, is the use of information for safety as a risk reduction measure when implementing EN ISO 14971:2012. To be specific, I’ll use the MDD to explain the issue. ISO 14971:2007, clause 6.2, lists three risk reduction options in priority order:

• inherent safety by design
• protective measures in the medical device itself or in the manufacturing process
• information for safety

The manufacturer implements them, in order, to achieve acceptable residual risk. When the residual risk is acceptable, however, the manufacturer may stop, i.e., there is no requirement to implement all of them,

However, EN ISO 14971:2012 Annex ZA Content Deviation #6 says that, according to the MDD Annex I Section 2 second sentence first indent manufacturers should use “eliminate or reduce risks as far as possible (inherently safe design and construction)” as the first risk control option.

In addition, EN ISO 14971:2012 Annex ZA Content Deviation #5 says that, according to the MDD Annex I Section 2 second sentence, the manufacturer cumulatively applies the risk control options. The content deviation concludes that the manufacturer must apply all the "control options" and may not stop if the first or the second control option has reduced the risk to an "acceptable level". In other words, if a manufacturer does not utilize information for safety, the manufacturer is out of compliance with the MDD!

The problem comes from a misreading of EN ISO 14971:2012 Annex ZA Content Deviation #7 coupled with a failure to differentiate between “information for safety” and “disclosing residual risk”.

In ISO 14971:2007 clause 6.4 the manufacturer must, “For residual risks that are judged acceptable, … decide which residual risks to disclose and what information is necessary to include in the accompanying documents in order to disclose those residual risks”. In the International standard disclosing residual risk is an option. Recall that residual risk is “risk remaining after risk control measures have been taken” [2.15]

Notice that, at this point, information for safety reduces risk and is mandatory for the MDD. Residual risk is the risk that cannot be reduced and, for the international version, the manufacturer decides whether or not to disclose it.

EN ISO 14971:2012 Annex ZA Content Deviation #7 says that the MDD Annex I Section 2 second sentence third indent, requires that the manufacturer “inform users of the residual risks due to any shortcomings of the protection measures adopted”. In other words, when the three risk control options don’t eliminate the risk, i.e., there is residual risk, the manufacturer must disclose it. The conclusion in the content deviation is, “manufacturers shall not attribute any additional risk reduction to the information given to the users”.

The problem arises when Notified Bodies read the “information given to the users” to mean the information for safety, not the information from disclosing residual risks.

Were the Notified Body’s misunderstanding to prevail, it would write a nonconformance:

1. a) For failure to use information for safety as a risk control option (Content Deviation #5) and
2. b) Using information for safety as a risk control option (misunderstanding of Content Deviation #7).

Clearly, this doesn’t make sense. My recommendation is that if a device manufacturer receives a non-conformance for using information for safety, the b) part above, then it is time to get a new Notified Body.

Sorry for the long response, but this is a problem about which I’m passionate.

There seems to be some confusion within the medical device industry regarding the use of labeling as it relates to risk.  I think some of it may be due to how risk is addressed in different regulations and standards, along with some confusion about different definitions of risk mitigation, reduction, and control found in the different regulations and standards?

Can anyone here sort this out?  Or is some of it still in the process of interpretation?

Dan O'Leary

Thank you very much for a great explanation. 

Thank you Julie for your question! This is a very interesting topic. Even if I did not ask the question, this is an area that struggle with. 

Thanks!

Julie,

This is easy to understand, but as you point out there is confusion. The primary source is a misunderstanding of the content deviations in EN ISO 14971:2012.

While the next statement is technically not correct, it makes the discussion easier. There are two versions of the risk management standard in play, ISO 14971:2007 and EN ISO 14971:2012. The former is the international standard and forms the basis for regional and national regulations around the world. Most regulatory regions have adapted it without adjustment. The EU, however, has adopted it “with adjustment”. They realized (the story is not worth the telling) that if a company implements ISO 14971:2007 as written, they would be out of compliance with the associated product directive. Consequently, they wrote three annexes, one for each directive, to explain the differences. These are called Content Deviations, and they differ by directive.

First, there is no standard numbered ISO 14971:2012. The international standard didn’t change, only the EU version.

Second, the term mitigation is incorrect. The standard uses risk reduction, and the word mitigation is not in the standard. Think of risk reduction as reducing the severity or probability of harm before it happens. Think of mitigation as addressing the effect of the harm after it happens. Risk reduction, for example, reduces the risk of amputation. A prosthesis helps mitigate the effect of amputation.

FDA seems to have adopted a policy using the word mitigation, when they mean reduction. In addition, FDA has adopted a policy to use the term benefit-risk, while the standards use risk-benefit. This will only exacerbate the rampant confusion.

The primary point however, is the use of information for safety as a risk reduction measure when implementing EN ISO 14971:2012. To be specific, I’ll use the MDD to explain the issue. ISO 14971:2007, clause 6.2, lists three risk reduction options in priority order:

• inherent safety by design
• protective measures in the medical device itself or in the manufacturing process
• information for safety

The manufacturer implements them, in order, to achieve acceptable residual risk. When the residual risk is acceptable, however, the manufacturer may stop, i.e., there is no requirement to implement all of them,

However, EN ISO 14971:2012 Annex ZA Content Deviation #6 says that, according to the MDD Annex I Section 2 second sentence first indent manufacturers should use “eliminate or reduce risks as far as possible (inherently safe design and construction)” as the first risk control option.

In addition, EN ISO 14971:2012 Annex ZA Content Deviation #5 says that, according to the MDD Annex I Section 2 second sentence, the manufacturer cumulatively applies the risk control options. The content deviation concludes that the manufacturer must apply all the "control options" and may not stop if the first or the second control option has reduced the risk to an "acceptable level". In other words, if a manufacturer does not utilize information for safety, the manufacturer is out of compliance with the MDD!

The problem comes from a misreading of EN ISO 14971:2012 Annex ZA Content Deviation #7 coupled with a failure to differentiate between “information for safety” and “disclosing residual risk”.

In ISO 14971:2007 clause 6.4 the manufacturer must, “For residual risks that are judged acceptable, … decide which residual risks to disclose and what information is necessary to include in the accompanying documents in order to disclose those residual risks”. In the International standard disclosing residual risk is an option. Recall that residual risk is “risk remaining after risk control measures have been taken” [2.15]

Notice that, at this point, information for safety reduces risk and is mandatory for the MDD. Residual risk is the risk that cannot be reduced and, for the international version, the manufacturer decides whether or not to disclose it.

EN ISO 14971:2012 Annex ZA Content Deviation #7 says that the MDD Annex I Section 2 second sentence third indent, requires that the manufacturer “inform users of the residual risks due to any shortcomings of the protection measures adopted”. In other words, when the three risk control options don’t eliminate the risk, i.e., there is residual risk, the manufacturer must disclose it. The conclusion in the content deviation is, “manufacturers shall not attribute any additional risk reduction to the information given to the users”.

The problem arises when Notified Bodies read the “information given to the users” to mean the information for safety, not the information from disclosing residual risks.

Were the Notified Body’s misunderstanding to prevail, it would write a nonconformance:

1. a) For failure to use information for safety as a risk control option (Content Deviation #5) and
2. b) Using information for safety as a risk control option (misunderstanding of Content Deviation #7).

Clearly, this doesn’t make sense. My recommendation is that if a device manufacturer receives a non-conformance for using information for safety, the b) part above, then it is time to get a new Notified Body.

Sorry for the long response, but this is a problem about which I’m passionate.

There seems to be some confusion within the medical device industry regarding the use of labeling as it relates to risk.  I think some of it may be due to how risk is addressed in different regulations and standards, along with some confusion about different definitions of risk mitigation, reduction, and control found in the different regulations and standards?

Can anyone here sort this out?  Or is some of it still in the process of interpretation?

Dan has provided a comprehensive and very readable response - as always.

Julie, the NB-MED Consensus Paper on the Interpretation and Application of Annexes Z in EN ISO 14971: 2012 (Version 1.1 dated 13 October 2014) also provides a good explanation of the differences between the international standard and the EU version.　

http://www.team-nb.org/wp-content/uploads/2015/05/documents2014/NBRG_WG%20RM_Interim_NBmed_Consensus_Version_140812_1_1.pdf

Dan O'Leary

Thank you very much for a great explanation. 

Thank you Julie for your question! This is a very interesting topic. Even if I did not ask the question, this is an area that struggle with. 

Thanks!

Julie,

This is easy to understand, but as you point out there is confusion. The primary source is a misunderstanding of the content deviations in EN ISO 14971:2012.

While the next statement is technically not correct, it makes the discussion easier. There are two versions of the risk management standard in play, ISO 14971:2007 and EN ISO 14971:2012. The former is the international standard and forms the basis for regional and national regulations around the world. Most regulatory regions have adapted it without adjustment. The EU, however, has adopted it “with adjustment”. They realized (the story is not worth the telling) that if a company implements ISO 14971:2007 as written, they would be out of compliance with the associated product directive. Consequently, they wrote three annexes, one for each directive, to explain the differences. These are called Content Deviations, and they differ by directive.

First, there is no standard numbered ISO 14971:2012. The international standard didn’t change, only the EU version.

Second, the term mitigation is incorrect. The standard uses risk reduction, and the word mitigation is not in the standard. Think of risk reduction as reducing the severity or probability of harm before it happens. Think of mitigation as addressing the effect of the harm after it happens. Risk reduction, for example, reduces the risk of amputation. A prosthesis helps mitigate the effect of amputation.

FDA seems to have adopted a policy using the word mitigation, when they mean reduction. In addition, FDA has adopted a policy to use the term benefit-risk, while the standards use risk-benefit. This will only exacerbate the rampant confusion.

The primary point however, is the use of information for safety as a risk reduction measure when implementing EN ISO 14971:2012. To be specific, I’ll use the MDD to explain the issue. ISO 14971:2007, clause 6.2, lists three risk reduction options in priority order:

• inherent safety by design
• protective measures in the medical device itself or in the manufacturing process
• information for safety

The manufacturer implements them, in order, to achieve acceptable residual risk. When the residual risk is acceptable, however, the manufacturer may stop, i.e., there is no requirement to implement all of them,

However, EN ISO 14971:2012 Annex ZA Content Deviation #6 says that, according to the MDD Annex I Section 2 second sentence first indent manufacturers should use “eliminate or reduce risks as far as possible (inherently safe design and construction)” as the first risk control option.

In addition, EN ISO 14971:2012 Annex ZA Content Deviation #5 says that, according to the MDD Annex I Section 2 second sentence, the manufacturer cumulatively applies the risk control options. The content deviation concludes that the manufacturer must apply all the "control options" and may not stop if the first or the second control option has reduced the risk to an "acceptable level". In other words, if a manufacturer does not utilize information for safety, the manufacturer is out of compliance with the MDD!

The problem comes from a misreading of EN ISO 14971:2012 Annex ZA Content Deviation #7 coupled with a failure to differentiate between “information for safety” and “disclosing residual risk”.

In ISO 14971:2007 clause 6.4 the manufacturer must, “For residual risks that are judged acceptable, … decide which residual risks to disclose and what information is necessary to include in the accompanying documents in order to disclose those residual risks”. In the International standard disclosing residual risk is an option. Recall that residual risk is “risk remaining after risk control measures have been taken” [2.15]

Notice that, at this point, information for safety reduces risk and is mandatory for the MDD. Residual risk is the risk that cannot be reduced and, for the international version, the manufacturer decides whether or not to disclose it.

EN ISO 14971:2012 Annex ZA Content Deviation #7 says that the MDD Annex I Section 2 second sentence third indent, requires that the manufacturer “inform users of the residual risks due to any shortcomings of the protection measures adopted”. In other words, when the three risk control options don’t eliminate the risk, i.e., there is residual risk, the manufacturer must disclose it. The conclusion in the content deviation is, “manufacturers shall not attribute any additional risk reduction to the information given to the users”.

The problem arises when Notified Bodies read the “information given to the users” to mean the information for safety, not the information from disclosing residual risks.

Were the Notified Body’s misunderstanding to prevail, it would write a nonconformance:

1. a) For failure to use information for safety as a risk control option (Content Deviation #5) and
2. b) Using information for safety as a risk control option (misunderstanding of Content Deviation #7).

Clearly, this doesn’t make sense. My recommendation is that if a device manufacturer receives a non-conformance for using information for safety, the b) part above, then it is time to get a new Notified Body.

Sorry for the long response, but this is a problem about which I’m passionate.

There seems to be some confusion within the medical device industry regarding the use of labeling as it relates to risk.  I think some of it may be due to how risk is addressed in different regulations and standards, along with some confusion about different definitions of risk mitigation, reduction, and control found in the different regulations and standards?

Can anyone here sort this out?  Or is some of it still in the process of interpretation?