ISO 13485 · Basic · 13 min lesson
Clause 7.1 - planning of product realization and risk management
ISO 13485:2016 clauses 7.1 and 4.1.2, with ISO 14971:2019 clauses 4 to 10; EU MDR Article 10(9) and Annex I section 3
What you will learn
- Explain what clause 7.1 requires you to determine and document when planning product realization.
- Describe the ISO 14971:2019 risk management process and the documents it produces, and how risk controls reach the production line.
- Trace one hazard from the risk file to an acceptance criterion and a record, and spot a plan that fails an audit.
Key takeaways
- Clause 7.1: plan product realization, covering objectives, processes, resources, verification, validation, monitoring, acceptance criteria and records.
- Clause 7.1 also requires documented risk management processes and maintained risk management records.
- ISO 14971:2019 runs from plan (clause 4.4) through analysis, evaluation, control, residual risk, review and production feedback (clauses 5 to 10).
- A risk control is only real when it appears in a specification, a work instruction or an inspection, with an acceptance criterion and a record.
- Complaints and production data flow back into the risk file; a risk file that is never updated fails clause 7.1 in practice.
Free practice question
Brightwell's realization plan for a new infusion set says: 'Inspect connectors according to standard practice.' The QA manager wants to approve it today.
Which clause 7.1 content is most clearly missing?
Quality objectives under clause 5.4.1.
Not quite. Objectives matter, but the quoted sentence concerns inspection, which falls under clause 7.1 c.
Product acceptance criteria and the specific verification and inspection activities.
Correct. Clause 7.1 c requires verification and inspection activities and product acceptance criteria to be determined, which this text does not provide.
The date of the next management review.
Not quite. Management review under clause 5.6 is a separate requirement and is not what this plan lacks.
A statement of the company's address.
Not quite. Addresses are not part of the planning content required by clause 7.1.
Key terms
- product realization: The set of processes from planning and design through purchasing, production and service that turn requirements into a delivered device (ISO 13485 clause 7).
- risk management: Systematic application of policies, procedures and practices to analyse, evaluate, control and monitor risk (ISO 14971:2019).
- hazardous situation: A circumstance in which people, property or the environment are exposed to one or more hazards (ISO 14971:2019 clause 3).
- risk control: A measure that reduces risk, chosen in the order: inherently safe design, protective measures, then information for safety (ISO 14971:2019 clause 7.1).
- residual risk: The risk remaining after risk control measures have been implemented (ISO 14971:2019 clause 3).
- risk management file: The set of records and other documents produced by risk management (ISO 14971:2019 clause 4.5).
- acceptance criteria: Measurable limits that product or process results must meet to be accepted (ISO 13485 clause 7.1 c).
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- ISO 14971:2019 Medical devices - Application of risk management to medical devices
- Regulation (EU) 2017/745 on medical devices (MDR), EUR-Lex
- FDA - Quality Management System Regulation (QMSR)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.