1. On the relationship between ISO/DTS29321 and ISO14971 & Japans Comments for new draft & amended clause 8 final of ISO/DTS29321 3/5/2008 JAHIS

2. All Rights Reserved,Copyright © 2008 JAHIS 2 -1 Risk Management Process in ISO14971 Risk analysis Risk evaluation Risk control Evaluation of overall residual risk acceptability Risk management report Production and post-production information Risk assessment Risk management 1

3. All Rights Reserved,Copyright © 2008 JAHIS 3 -2 Risk analysis process in ISO14971 4.1 Risk analysis process a)a description and identification of the medical device that was analyzed b)Identification of the person(s) and organization who carried out the risk analysis c)Scope and date of the risk analysis It is not required to disclose the documents mentioned above. 1

4. All Rights Reserved,Copyright © 2008 JAHIS 4 -3 Identify medical device characteristics (Annex C) C.2.4 What materials or components are utilized in the medical device are used with, or are in contact with, the medical device? C.2.18 Is maintenance or calibration necessary? C.2.19 Does the medical device contain software? C.2.26 Does installation or use of the medical device require special training or special skills? C.2.31 In what way(s) might the medical device be deliberately misused? Characteristics including operating environment and maintenance are required to be documented and updated. 1

5. All Rights Reserved,Copyright © 2008 JAHIS 5 -4 Risk control in ISO14971 6.2 Risk control The manufacturer shall use one or more of the following risk control options in the priority order listed: a)Inherent safety by design; b)Protective measures in the medical device itself or in the manufacturing process; c)Information for safety; Control option by information for safety is the low ranking. Basically, manufacturer ensures the safety by the control of a) and b). 1

6. All Rights Reserved,Copyright © 2008 JAHIS 6 -5 Risk control in ISO14971 (Annex J) J2:When developing information for safety it is important to identify to whom this information is to be provided and how it is to be provided. The manufacturer should provide an explanation of the risk, the consequences of exposure and what should be done or aoided to prevent harm. J3:When developing the disclosure of individual or overall residual risk(s) it is important to identify what is to be communicated and to whom this is directed in order to inform, motivate and enable the user to use the device safely and effectively. It is important for manufacturer to tell users what they should do for ensuring safety. 1

7. All Rights Reserved,Copyright © 2008 JAHIS 7 -1 Comparison of 14971 and 29321 (common points) 14971 Description and identification of the medical device that was analysed Identification of the person(s) or organization who or which carried out the risk analysis Consideration on components utilized in medical devices. Maintenance & Calibration Disclosure of residual risk 29321 Description and identification of the health software product that was analysed Identification of the person(s) who carried out the risk analysis Analysis on software product including OTS or SOUP Lifetime management arrangements including maintenance(J.7) Disclosure of residual risk 2

8. All Rights Reserved,Copyright © 2008 JAHIS 8 -2 Comparison of 14971 and 29321 (different points) 14971 Consideration on the skill of person installing the device and end user Consideration on misuse Manufacturer has the responsibility for ensuring safety through the risk management process Risk control process is in- house information 29321 Manufacturer is not responsible for misuse of end users Manufacturer can decide the risk class of its product with appropriate evidence Disclosure of CSCR on risk control process through the whole life cycle of the product (contract base) CSCR should contain sufficient details of personnel : risk analysis (J.6) 2

9. All Rights Reserved,Copyright © 2008 JAHIS 9 -3 Relationship between 14971 and 29321 (CSCR) 14971 Risk control option analysis(6.2) Risk analysis process(4.1) Misused(C.2.31) Materials & Components(C.2.4) Information for safety(J.2) Disclosure of residual risk(J.3) Maintenance & Calibration(C.2.18) 29321(CSCR) Introduction and health software identification Description of general and clinical safety management arrangements Identification and justification of any residual risks. (including OTS, SOUP) Overall clinical safety justification Lifetime management arrangements including maintenance Overview of hazard and risk assessment process including risk evaluation and acceptance criteria covering CSCR should contain sufficient details of personnel : risk analysis (J.6) Improper to collect the parts of 14971 requirements as CSCR 2

10. All Rights Reserved,Copyright © 2008 JAHIS 10 -1 Proper relationship on requirements for safety 3 Requirements for Medical Device 14971) Requirements for non-Medical Device software Requirements for Medical Device software (62304 : applying 14971 to software)

11. All Rights Reserved,Copyright © 2008 JAHIS 11 -2 Comment-1 14971 Risk control option analysis(6.2) Risk analysis process(4.1) Misused(C.2.31) Materials & Components(C.2.4) Information for safety(J.2) Disclosure of residual risk(J.3) Maintenance & Calibration(C.2.18) 29321(CSCR) Introduction and health software identification Description of general and clinical safety management arrangements Identification and justification of any residual risks. (including OTS, SOUP) Overall clinical safety justification Lifetime management arrangements including maintenance Overview of hazard and risk assessment process including risk evaluation and acceptance criteria covering CSCR should contain sufficient details of personnel : risk analysis (J.6) Delete requirements exceeding those of 14971 at least 3

12. All Rights Reserved,Copyright © 2008 JAHIS 12 -3 Comments-2 3 As CSCR is based on contract between customer and manufacturer, replace shall by should in the sentence of amended clause 8 final; Thus a clinical safety case report shall at a minimum cover the following aspects: Add the corresponding table, ISO14971 vs. DTS29321 CSCR, as annex. Replace may be by is in the sentence of amended clause 8 final ; The required content of the safety case report may be contained in the manufacturer's accompanying documents.

13. All Rights Reserved,Copyright © 2008 JAHIS 13 -4 Comments-3 3 Delete additional condition from the sentence 1022-1024 in clause 13 Any software product which is regulated as a medical device and whose manufacture is in compliance with ISO 14971, can be considered as in compliance with this standard. Safety information in accompanying documents regulated by ISO14971 is not CSCR itself. But the medical device and the medical device software are managed by risk management process of ISO14971 and related standards by the responsibility of manufacturer. In addition, safety information in accompanying documents includes the residual risk which should be informed to users. It is not Least Burdensome Approach for manufacturer which produces both medical devices and non-medical devices to conform the two standards (as commented by Netherlands). In addition, it is burdensome for users such as hospital to make contract with consideration on the two standards. Relationship between ISO/DTR29322 and IEC80001 is the same problem.