Residual risk

Residual risk is what the risk management file has to evaluate as acceptable, one by one and as a whole, against the benefits. Residual risks that matter for safe use are disclosed to users, usually in the instructions for use.

RISK remaining after RISK CONTROL measures have been taken [SOURCE: ISO 14971:2007, 2.15]

IEC 82304-1:2016, clause 3.11

risk remaining after risk control (3.21) measures have been implemented [SOURCE: ISO/IEC Guide 63:2019, 3.9]

ISO 14971:2019, clause 3.17

RISK remaining after RISK CONTROL measures have been taken NOTE 1 Adapted from ISO/IEC Guide 51:1999, definition 3.9. NOTE 2 ISO/IEC Guide 51:1999, definition 3.9 uses the term “protective measures” rather than “RISK CONTROL measures.” However, in the context of this International Standard, “protective measures” are only one option for controlling RISK as described in 6.2 [of ISO 14971:2007]. [SOURCE: ISO 14971:2007, 2.15].

IEC 62304:2006+AMD1:2015, clause 3.38

Risk remaining after risk control measures have been implemented.

FDA guidance: Applying Human Factors and Usability Engineering to Medical Devices (August 2026), Section 3, Definitions