The annex that used to make ISO 14971 stricter

ISO 14971:2019 gets treated as a single, self-sufficient risk management standard, and in most of the world it is. In the EU, a risk management file's own citations should be watching a narrower detail than most teams realize: EN ISO 14971:2012, the version harmonized under the old device directives, carried seven formal content deviations forcing manufacturers away from cost-benefit risk reasoning and toward the directives' own stricter test. The current harmonized version — EN ISO 14971:2019 with Amendment A11:2021 — carries none. That isn't a relaxation of the underlying requirement. The requirement was never the standard's to relax in the first place.

A borrowed test, not a native one

The device directives' essential requirements, and the General Safety and Performance Requirements that succeeded them in MDR and IVDR Annex I, ask for something specific: manufacturers must eliminate or reduce risks as far as possible, where “as far as possible” means reduced as far as possible without adversely affecting the benefit-risk ratio — not reduced as far as remains economically reasonable. ISO 14971 itself, in both its 2007 and current editions, is built around a more familiar engineering idea: risk reduced as low as reasonably practicable, a test that explicitly allows weighing further reduction against practicability, cost included. The EU regulations don't recognize that economic weighing at all for this step. Cost isn't a permitted reason to stop reducing risk further — only genuine impracticability, or a resulting drop in the benefit-risk ratio, is.

The 2012 fix was seven explicit deviations

EN ISO 14971:2012 closed that gap with Annex ZA, ZB and ZC — one per directive — each listing seven Content Deviations spelling out exactly where the ISO text needed to be read differently to satisfy the directive underneath it. Content Deviation #3 addressed this point directly: economic considerations aren't acceptable justification for stopping short of further risk reduction, regardless of how small the risk already is. It was an explicit, textual override of the ALARP-style cost-benefit reasoning wherever the ISO standard's own language invited it.

The 2019 revision moved the goalposts, so the annex didn't need to

When ISO revised the standard in 2019, and CEN published EN ISO 14971:2019 with Amendment A11:2021 as its European harmonized version, the seven content deviations disappeared entirely. Industry commentary on the amendment describes the 2019 edition's own approach to risk acceptability as having already moved much closer to the EU's “as far as possible” framing than the 2007 edition ever was — closing most of the gap the 2012 deviations existed to patch. What Annex ZA and ZB contain now instead are correlation tables: rows mapping each GSPR in MDR and IVDR Annex I to the ISO clause that addresses it. An index, not a rewrite.

The obligation was never the deviation's to carry

This is the part worth getting right in a risk management file. The duty to reduce risk as far as possible, cost aside, comes from MDR and IVDR Annex I directly — the regulation, not the standard, and not the standard's harmonized annex. Content Deviation #3 disappearing from the current annex doesn't touch that duty at all; the regulation didn't change alongside the standard's own text. A risk management plan whose acceptability-criteria section still cites “EN ISO 14971:2012 Annex ZA, Content Deviation #3” as the reason cost-based reasoning is off the table is citing a document structure that no longer exists in the current harmonized standard. The citation belongs on MDR or IVDR Annex I itself, with the ISO clause cited only for the process the file follows to get there — not for the substantive rule. A file that gets this backward is exposed exactly the way a template that outlives the source it was built against always is: correct in 2013, silently wrong today, and nobody circles back to check until an auditor asks where the rule actually comes from.

What changes in the file, and what doesn't

The substance a risk management file has to carry didn't move an inch: the per-hazard residual-risk acceptability judgment still can't lean on cost or convenience as its stated reason for stopping short, and that was true before 2012, through the 2012 deviations, and after their removal in 2019. What changes is only where the file should say that rule comes from — and a file that's still pointing at a superseded annex is one audit finding away from having to explain the difference on the spot.

A risk-acceptability worksheet that traces this rule to MDR and IVDR Annex I directly, rather than to a content deviation the current harmonized standard no longer carries, is previewed in the launch catalog. If your program's citation runs differently, the shelf takes that correction directly.