Post-production surveillance has to be active, not passive

A risk management file's residual-risk conclusion is not a one-time verdict entered at clearance and left standing. ISO 14971:2019 rewrote Clause 10 — production and post-production activities — into the clause that can reopen that verdict, and it opens with a single word that changes what a compliant system has to do: actively. A file that waits for a complaint to arrive before it looks for new risk information has already fallen short of what the clause asks for.

The clause requires a search, not an inbox

Clause 10.1 requires the manufacturer to establish, document, and maintain a system to actively collect and review information relevant to the medical device, or similar devices, in the production and post-production phases. The word actively is doing real work: a complaint-handling process that only reacts when a customer calls is a passive collection point, not the system the clause describes. The information sources the clause has in view span both sides of that phase — production-side data such as supplier performance, in-process monitoring, inspection results, and environmental monitoring, alongside post-production sources such as complaints, user feedback, adverse events, installation and servicing reports, clinical or performance studies, published literature, and public or media reports. A system built only around the complaint record's own reportability test is covering one source on a much longer list.

Production data belongs in the same system as field data

Clause 10 doesn't split production information into a separate, lower-stakes bucket from what comes back from the field. Process monitoring and inspection results generated on the line feed the same active-collection system as a complaint filed two years post-launch, because both can carry the same signal: a risk estimate that no longer matches what the device is actually doing. A validated process's own ongoing monitoring data is exactly the kind of production-side input the clause expects a risk file to be watching, not just a process-control record kept in a separate system nobody cross-references against the hazard analysis.

The scope reaches past your own device

Clause 10.1's own wording covers information relevant to the medical device “or similar devices,” not just the one on the label. A competitor's field action, a pattern showing up in published literature about a device class, a signal in a public adverse-event database that never named your own product by name — all of it falls inside the collection duty if it's the kind of information that would change what your own risk file assumes. A monitoring system scoped only to your own complaint file and your own device history record is watching a narrower window than the clause actually opens.

Review asks a specific set of questions, not a general one

Clause 10.2 requires the collected information to be reviewed for possible relevance to safety, which the standard frames as a specific checklist rather than an open-ended read: is this a new hazard or hazardous situation, has an estimated risk changed, is the original risk assessment no longer valid on some other basis, or has the general state of the art moved. Each of those questions points back at a conclusion Clause 8's own overall residual risk evaluation already reached — Clause 10 is the mechanism that can reopen that conclusion, not a separate, parallel judgment call made without reference to it.

Two different actions, aimed at two different places

Clause 10.3 keeps the action a review triggers pointed at two distinct targets rather than one. Information that implicates a specific device already on the market can call for action on that device — up to and including a field safety corrective action. Information that implicates the risk management process itself calls for a different kind of action: revisiting the hazard analysis, adding or strengthening a control such as a warning that was leaning too hard on user behavior, or updating the file for devices still in design. A response that fixes the immediate device in the field without ever touching the file that produced it has closed only half of the clause's own structure.

Where this meets the rest of the file

Clause 10's active-collection duty is what a post-market surveillance plan and, for diagnostics, a PMPF plan ultimately feed — the risk file is one of the places that surveillance data has to land, not a separate exercise run in parallel with it. A post-production monitoring worksheet built around Clause 10's active-collection duty, its safety-relevance review questions, and the device-versus-process split its actions have to respect is previewed in the launch catalog. If your program runs this loop differently, the shelf takes that correction directly.