IVDR Risk Management: Recurring Gaps in Technical Documentation Assessments and How to Anticipate Them

November 2025 – Amsterdam

At the BSI Meet the Experts: In Vitro Diagnostic Regulation, held in Amsterdam in November 2025, BSI presented the most frequently observed gaps during initial technical documentation assessments in compliance with Regulation (EU) 2017/746 (IVDR). Among the twelve areas identified, risk management (per Annex I Chapter I of the IVDR and EN ISO 14971:2019) is a major point.

A finding that echoes what I observe in the field: putting in place a compliant risk management process, fully integrated into the design and development cycle, remains a demanding undertaking. It involves numerous links between requirements from different reference frameworks, a multidisciplinary team trained in both ISO 14971 principles and the company’s own internal practices, and a significant initial investment to build a robust process. The good news: once this process is in place, keeping it up to date is much faster and it becomes a genuine tool for monitoring the product over time.

What BSI observes during technical documentation assessments

The following points are drawn from my notes taken during the BSI Meet the Experts IVDR 2025 event in Amsterdam, enriched by my own field observations:

• GSPR compliance and risk control measures. Files frequently show gaps in demonstrating that specific GSPR clauses have been adequately addressed particularly for foreseeable misuse and chemical risks. Risk control measures are sometimes insufficiently justified: their effectiveness is not demonstrated and residual risk levels are not adequately argued.
• Risk evaluation and scoring methods. Inconsistencies in scoring methods are frequent: absence of individual scores for each risk, unclear definitions of severity and probability levels, or scoring methods that vary within the same file without justification.
• Design and usability risks. Evidence demonstrating that risk reduction through design has been implemented especially in usability engineering is often insufficient or poorly substantiated.
• Residual risks. A lack of alignment is frequently observed between documented residual risks and the information provided in the instructions for use.
• Benefit-risk analysis. The description of clinical benefits and how they justify residual risks to patients is often insufficiently developed — a particularly sensitive point for in vitro diagnostics, where demonstrating clinical benefit is central to the performance evaluation.

What these findings reveal

These recurring gaps primarily reflect the inherent complexity of applying ISO 14971 in the specific context of an in vitro diagnostic. The standard is well known in broad terms but its rigorous and consistent application is highly specific to each company and each product, and cannot be done by analogy with other files. What works for one manufacturer will not be directly transposable to another and this is what makes risk management so demanding to put in place.

These findings also highlight the importance of not approaching risk management as a purely documentary exercise: it must be fed by verification and validation data, clinical data, field feedback and developments in the state of the art throughout the product lifecycle.

→ Would you like to assess the robustness of your risk management documentation, identify gaps against ISO 14971 requirements and build an improvement plan with your team? A One Health Compliance Workshop combines a review of the requirements applicable to your context and a collaborative analysis of your existing data to make concrete progress, without starting from scratch.

Sandra Dejean, PharmD – Founder of One Health Compliance

References:

• BSI. Data presented at the BSI Meet the Experts: In Vitro Diagnostic Regulation, Amsterdam, November 2025 [non-public document distributed to participants].
• © Aude Lemaitre / One Health Compliance