Every risk points at a version
Risks connect to the release they affect and the controls that reduce them, so your risk position and your product stay in step instead of drifting apart between submissions.
Meet every requirement for
ISO 14971
Assuric gives you the risk file, release links and reviews to meet ISO 14971 across the product lifecycle, all in one place.
- Risk file linked to your releases
- Alongside your ISO 13485 QMS
- 21 CFR Part 11 e-signatures
Trusted bymedical device teams
Features
Everything you need for
ISO 14971
Medical device risk management
Hazards, causes, controls and residual risk
One file rather than a folder of spreadsheets, scored and reviewed, with the design records that mitigate each hazard attached to it.
Medical device risk management
Traceability an auditor can follow
Risk to control to evidence to release, held as you go, so nobody assembles the chain by hand the week before an audit.
Post-market surveillance
The monitoring the standard asks for
Incidents, complaints and user feedback land in one surveillance record and feed back into the risks they relate to, so the loop ISO 14971 expects actually closes.
Complete eQMS
ISO 14971 where ISO 13485 expects it
Risk management sits with your documents, records and design controls rather than in a separate tool, so the quality system and the risk file cannot diverge.
Benefits
A risk file that moves with every release
Reviews with dates and owners
Risk reviews carry a date and a named owner, so the cycle is scheduled rather than remembered, and you can see which risks need reassessing when the product changes.
Field data comes back to the file
What you learn after launch updates the risks and controls it relates to, which is the part auditors find missing most often.
Expert help where you want it
Work with our regulatory team for ad-hoc advice or hands-on help building your technical file. You are not left to work out the standard on your own.
Frameworks
Mapped to other frameworks
Overlapping requirements and evidence are mapped across frameworks automatically, so you never do the same work twice.
What our customers say
“We couldn't speak highly enough of both the Assuric team and the platform itself, which is incredibly easy to use, and with the skill and hardworking nature of the Assuric team. They've been a key component in accelerating our progress and deployments!”
Maks Kozarzewski
COO, VitVio
“The Assuric platform is a game changer in the clinical risk management field. It has been carefully designed to make the job of a CSO significantly more streamlined. The team are excellent and responsive to any product suggestions I have requested, and it has been a pleasure to work with them.”
Paul Llewellyn
CCIO, Accenture
“Assuric has been fantastic in helping us quickly and safely navigate regulatory compliance in the UK. From completing Cybersecurity requirements to DSPT, DCB0129, and DTAC, the team was supportive, extremely knowledgeable, and the platform made everything quick and straightforward. A separate regulatory company we consulted at the beginning even remarked on how quickly we achieved compliance!”
Katie Baker
Director UK & Ireland, Tandem
Frequently asked questions
The international standard for risk management of medical devices. It sets out a lifecycle process: identify hazards, estimate and evaluate the risks, control them, and monitor the effectiveness of those controls in production and post-production. The output is a risk management file covering the whole life of the device.
Medical device manufacturers, including teams building software as a medical device. ISO 14971 is the accepted way to show you manage device risk across the product's life. Both the EU MDR and UK MDR expect risk management evidence in your technical documentation.
The risk management file holds the records ISO 14971 asks you to keep for a device. That covers your risk management plan, the hazards you have identified, how each risk was estimated and evaluated, the controls you put in place and the residual risk that remains. In Assuric, the file sits alongside your ISO 13485 quality system and each risk links to the release it affects.
You need documented risk management, and ISO 14971 is the accepted way to demonstrate it. Doing it properly at Class I is far cheaper than reconstructing a risk file when you move up a class.
ISO 13485 is the quality system, IEC 62304 is the software development lifecycle inside it, and ISO 14971 is the risk management process feeding both. They are designed to be used together, and doing them in separate tools is what makes device compliance feel unmanageable.
They overlap heavily. ISO 14971 is the medical device standard used for MHRA and EU MDR purposes, and DCB0129 is the NHS clinical risk management standard. Both ask you to identify hazards, control them and evidence it, for different audiences. Both are held in Assuric.
Whenever the product changes materially, whenever post-market data suggests a control is not working, and on a defined periodic cycle. Assuric holds the review dates and owners so the cycle is scheduled.
Yes, and under current UK and EU frameworks there is no separate AI medical device regime to comply with. AI is managed within your existing ISO 13485 quality system through AI-specific policies, risk controls and change management. The EU AI Act adds obligations, but it does not replace the device framework.
Yes. Signature records carry identity, intent and a timestamp on an audit trail that cannot be edited or deleted.
Assuric holds your ISO 14971 risk file in the same platform as your quality system. Hazards, causes, controls and residual risk sit in one file, each risk links to the release it affects, and reviews carry a date and a named owner. Our regulatory team can also help where you want expert input.
Keep your risk file current
Talk to us about ISO 14971 risk management that moves with every release.