Teams building software as a medical device (SaMD) tend to think of ISO 14971 as the hardware team’s problem. Risk management files, FMEA tables, severity scores: all quality and regulatory territory, while the engineers close Jira tickets. That split is where things go wrong.

ISO 14971 applies to your entire device. If your device contains software, or is software, risk management must account for what happens when the code behaves unexpectedly, gets misused, loses connectivity, or interacts with components you don’t fully control. A hardware fault that stops a pump is obvious. But a Bluetooth timeout that fails silently in a specific environment, affecting a patient who’s already cognitively impaired? That’s a software risk, and it’s just as real.

The question is how SaMD teams find it, document it, and trace it back to their design before it surfaces in a submission review or an inspection.

 …