A medical electrical device may complete leakage current, temperature, mechanical safety, and electromagnetic compatibility tests without obvious failure. Yet the IEC 60601 test report may still remain incomplete.
The reason may not be the physical performance of the device. It may be insufficient evidence in the manufacturer’s risk management file.
IEC 60601-1 testing is not limited to laboratory measurements. The standard requires manufacturers to apply a risk management process aligned with ISO 14971 and provide device-specific evidence for requirements that depend on risk analysis. If essential performance is unclear, risk controls are not traceable, or acceptance criteria are unsupported, the laboratory may not have enough evidence to complete the applicable clauses.
Understanding the relationship between ISO 14971 and IEC 60601 helps manufacturers prepare stronger documentation, define appropriate test criteria, and reduce avoidable delays during medical device testing.
ISO 14971 and IEC 60601 Serve Different Purposes
ISO 14971:2019 provides the international framework for managing risks associated with medical devices throughout their lifecycle. It requires the manufacturer to identify hazards, estimate and evaluate risks, implement risk controls, assess residual risk, and review production and post-production information.
IEC 60601-1 establishes general requirements for the basic safety and essential performance of medical electrical equipment and medical electrical systems. It addresses areas such as electrical hazards, mechanical hazards, excessive temperatures, radiation, fire, single fault conditions, programmable systems, and essential performance.
The relationship can be understood as follows:
ISO 14971 | IEC 60601-1 |
Establishes the risk management process | Establishes product safety and essential-performance requirements |
Requires hazards and hazardous situations to be identified | Provides requirements and tests for many known hazards |
Requires risk-control measures to be selected and verified | Evaluates whether relevant controls are implemented and effective |
Requires the manufacturer to define risk-acceptability criteria | Uses those criteria where compliance depends on manufacturer-defined risk decisions |
Produces the risk management file | Refers to the risk management file for specific compliance evidence |
Neither standard replaces the other. ISO 14971 does not remove the need for IEC 60601 testing, and successful laboratory measurements do not remove the need for a documented risk management process.
Why Clause 4.2 Makes Risk Management Part of IEC 60601 Testing
Clause 4.2 of IEC 60601-1 establishes the connection between the two standards. It requires a risk management process that complies with ISO 14971 for medical electrical equipment.
This means the manufacturer’s risk management documentation is an integral input to IEC 60601 assessment. The laboratory must have access to the relevant risk management evidence when a clause requires the risk management file to be inspected.
Within an IEC 60601 evaluation, the laboratory does not approve the manufacturer’s entire risk management system. It examines the documentation needed to determine whether the applicable IEC 60601 requirements have been addressed for the specific device under test.
Responsibility for defining risk-acceptability criteria, evaluating individual and overall residual risk, and maintaining lifecycle risk management remains with the manufacturer.
What the Laboratory Looks for in the Risk Management File
IEC 60601-1 contains several requirements where compliance is checked through the risk management file, either independently or together with physical inspection, measurement, or functional testing.
The relevant documentation should allow the laboratory to understand the device, its safety-related functions, the hazards being controlled, and the criteria that will determine whether the device performs acceptably during testing.
Important documentation inputs commonly include:
Documentation area | Why it matters during IEC 60601 testing |
Intended use and use environment | Determines expected operating conditions, users, patients, and applicable collateral standards |
Device configuration | Confirms the models, accessories, software versions, power sources, and operating modes included in the evaluation |
Hazard analysis | Identifies electrical, mechanical, thermal, functional, electromagnetic, and other relevant hazards |
Risk-acceptability criteria | Shows how the manufacturer decides whether a risk is acceptable |
Essential performance | Identifies functions that must be maintained to prevent unacceptable risk |
Risk-control measures | Connects safety-related design features, protective systems, alarms, markings, and instructions to identified risks |
Verification evidence | Demonstrates that each risk-control measure was implemented and is effective |
Residual-risk evaluation | Shows the risk remaining after controls have been applied |
Traceability | Connects hazards, controls, requirements, test evidence, and final risk conclusions |
A generic risk assessment that could apply to any electrical product is unlikely to provide adequate evidence. The file must reflect the actual medical device, tested configuration, intended use, and reasonably foreseeable misuse.
Essential Performance Connects Risk Analysis With Testing
Essential performance is one of the most important connections between ISO 14971 and IEC 60601.
Not every device specification is essential performance. The manufacturer must determine whether the loss or degradation of a function could result in unacceptable risk. If it could, that function may need to be identified as essential performance.
For example, essential performance may include:
- Delivery of ventilation within defined safety limits.
- Prevention of uncontrolled infusion.
- Delivery of the required defibrillation output.
- Operation of a safety-related alarm.
- Accurate display of information used for critical clinical decisions.
The risk management file should explain how the loss or degradation of the function could lead to a hazardous situation and possible harm. It should also define measurable limits that allow the function to be monitored during testing.
A clear evidence chain would show:
Function degradation → hazardous situation → possible harm → risk evaluation → risk control → acceptance criterion
If essential performance is described only as “the device must function normally,” the laboratory may not have an objective basis for evaluation. The expected performance, permitted degradation, response to disturbance, and recovery behaviour should be defined where relevant.
Risk Management Does Not Replace Prescribed Tests
Risk management gives manufacturers a structured method for addressing device-specific hazards, but it is not a general exemption from IEC 60601 requirements.
Many clauses contain prescribed test methods and defined acceptance limits. A manufacturer cannot omit an applicable test simply because its internal risk score is low.
Risk management becomes particularly important when:
- A clause specifically requires inspection of the risk management file.
- Essential performance must be identified or monitored.
- Test conditions depend on the intended use or device configuration.
- A hazard is not completely addressed by the standard.
- The standard permits an alternative method supported by equivalent safety evidence.
- Manufacturer-defined acceptance criteria are needed.
- A design feature serves as a risk-control measure.
Any alternative approach must be technically justified and supported by objective evidence. The resulting residual risk should not be greater than the risk associated with meeting the prescribed requirement.
How Test Results Support the Risk Management File
The connection between ISO 14971 and IEC 60601 works in both directions.
The risk management file informs the testing strategy by identifying hazards, controls, operating modes, essential performance, and acceptance criteria. Test results then provide objective evidence about whether those controls are effective.
Consider an infusion pump with software intended to prevent uncontrolled delivery. The risk file may identify overdose as a potential harm and specify a protective function as a risk control. The relevant IEC 60601 and device-specific testing must then evaluate whether that protection operates under the required normal and fault conditions.
If testing reveals unexpected behaviour, the result should not remain isolated in the laboratory report. The manufacturer may need to review the hazard analysis, reassess the risk, modify the design, add or revise controls, and update the verification evidence.
The risk management file should therefore reflect the final tested design rather than an earlier prototype or a generic product concept.
Common Risk File Gaps That Delay Testing
Delays often occur when the documentation and physical device do not describe the same configuration.
A risk file may identify an earlier power supply, software version, accessory, enclosure, or operating mode. The device submitted for testing may contain later changes that have not been assessed. This creates uncertainty about whether the existing risk controls and verification records remain applicable.
Other common gaps include poorly defined essential performance, missing links between hazards and controls, acceptance criteria that cannot be measured, and controls that are listed without evidence of implementation.
Another problem occurs when the risk analysis addresses only component failure. ISO 14971 requires consideration of hazards, sequences of events, hazardous situations, and possible harms. Failure mode and effects analysis can support this work, but an FMEA alone may not represent the complete risk management process.
Preparing the risk documentation before formal testing helps the manufacturer and laboratory agree on the configuration, operating modes, applied parts, accessories, essential performance, and monitoring methods.
What Current Standard Editions Mean for Existing Risk Files
The current international edition of ISO 14971 is ISO 14971:2019. ISO reviewed and confirmed this edition in 2025. ISO/TR 24971:2020 provides non-mandatory guidance on applying its requirements.
The current consolidated general standard is IEC 60601-1:2005+A1:2012+A2:2020, commonly referred to as Edition 3.2. Amendment 2 aligned several terms and references more closely with ISO 14971:2019.
Manufacturers relying on older risk files should check whether the terminology, clause references, hazard analysis, essential-performance reasoning, and traceability remain consistent with the edition selected for testing.
Changes in collateral standards may also affect the required evidence. For example, IEC 60601-1-2:2014+A1:2020 introduced immunity testing for proximity magnetic fields under its Clause 8.11. If electromagnetic disturbance could affect basic safety or essential performance, the manufacturer must define what will be monitored and what constitutes acceptable performance during EMI/EMC Testing.
The applicable edition should always be confirmed according to the target market, device type, and regulatory submission route.
What Indian Medical Device Manufacturers Should Consider
Under Rule 7 of India’s Medical Devices Rules, 2017, medical devices must first conform to applicable standards established by the Bureau of Indian Standards. Where no relevant BIS standard exists, applicable ISO or IEC standards may be used. If neither category provides an applicable standard, validated manufacturer specifications may be considered.
For medical electrical equipment, BIS lists IS 13450 (Part 1):2024 for general requirements concerning basic safety and essential performance. Applicable collateral and device-specific standards must also be identified.
The documentation and testing required for a CDSCO licensing application depend on the device, risk classification, applicable Indian standards, and licensing route. Manufacturers should not assume that one IEC 60601 report or one standard covers every requirement.
Early identification of the applicable standards is important because it affects product design, sample configuration, risk documentation, test planning, and the evidence submitted to the regulatory authority.
Preparing Risk Documentation for IEC 60601 Testing
A well-prepared submission does more than provide a risk table. It gives the laboratory a consistent technical picture of the product.
The device description, intended use, essential-performance claims, test configuration, operating modes, accessories, software version, and risk-control measures should agree across the risk management file, technical documentation, instructions for use, and test request.
Manufacturers should also establish traceability between the identified hazards and the IEC 60601 evidence used to verify the controls. IECEE OD-2044-1 provides a structured mapping approach for evaluating risk management requirements associated with IEC 60601-1 Edition 3.2 within the IECEE CB Scheme.
This preparation allows questions to be resolved before formal testing begins, when changes to the documentation or test plan are easier to manage.
How Astute Labs Supports IEC 60601 Testing
Astute Labs supports medical device manufacturers with IEC/EN 60601 testing for basic safety and essential performance. The testing process considers the applicable general, collateral, and device-specific requirements together with the manufacturer’s device information and relevant risk management evidence.
Through its Medical Device Testing capabilities, Astute Labs helps manufacturers establish the appropriate test scope, identify the documentation needed for evaluation, and generate objective test evidence for their compliance submissions.
Early coordination between the manufacturer and testing laboratory can reduce uncertainty concerning device configurations, essential-performance monitoring, operating modes, accessories, and risk-control verification.
Astute Labs supports manufacturers in connecting applicable IEC 60601 requirements with reliable testing evidence while keeping responsibility for risk evaluation and acceptance with the manufacturer. Contact us
