How should post-market data feed the risk file?
ISO 14971:2019 clause 10 asks manufacturers to collect and review information from production and post-production, complaints among it, and to judge whether it is relevant to safety. Where it is, the manufacturer reviews the risk management file to decide whether risks need to be reassessed or new risks assessed, and whether action is needed for devices already on the market. In practice, every trend, complaint cluster and investigation finding should end in a recorded risk review, even when the answer is that the risk file stays as it is.
This page is general information, not legal or regulatory advice. Check the current official text and your own procedures before you rely on it.
What clause 10 asks for
- A system to actively collect and review information about the device in production and post-production.
- A review of that information for possible relevance to safety: for example a hazard or hazardous situation not recognized before, an estimated risk that is no longer acceptable, or an overall residual risk that is no longer acceptable in relation to the benefits.
- Where the information is relevant to safety, a review of the risk management file, a decision on whether risks must be reassessed or new risks assessed, and consideration of action for devices already on the market.
Make the link explicit
Post-market data reaches the risk file only if someone connects it: each complaint and failure mode to the hazards, risks and risk controls it touches. A trend that nobody compared with the risk file, or a risk review that left no record, is a gap even when the risk estimate would not have changed.
What MDARIX does
- Links complaints and failure modes to the risks and controls they touch, so field signals reach the risk file. Risks come in with the CSV templates, like products, lots and complaints.
- Readiness checks name the post-market data not yet in the risk file, and the trends with no CAPA or risk review, each opening the records behind it.
- Lets you plan and sign the CAPA effectiveness check, send input to the risk file, and download the inspector summary as one pack.
- MDARIX does not replace your risk management file: a person decides what the risk file must say, and your systems stay the record.