Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
CAN CSA Z15190-05: A Comprehensive Guide to Risk Management for Medical Devices
Understanding the Requirements, Implementation Strategies, and Compliance Pathways for Canada’s Adoption of ISO 14971
CAN CSA Z15190-05 is the Canadian national adoption of the international standard ISO 14971:2000, which specifies a framework for applying risk management to medical devices. Published by the Canadian Standards Association (CSA Group) in 2005, this standard establishes a systematic process for manufacturers to identify hazards, estimate and evaluate associated risks, control those risks, and monitor the effectiveness of controls throughout the product lifecycle. Compliance with CAN CSA Z15190-05 is recognized by Health Canada as a means to demonstrate conformity with the Medical Devices Regulations (SOR/98-282) and is often a prerequisite for device licensing in Canada. This article provides an overview of the standard’s scope, key technical requirements, implementation highlights, and essential compliance notes for medical device manufacturers operating in or exporting to Canada.
Scope and Application
CAN CSA Z15190-05 applies to all stages of the medical device lifecycle, from concept and design through production, installation, servicing, and eventual decommissioning. The standard is intended for manufacturers of medical devices, including in vitro diagnostic (IVD) products, accessories, and software intended for medical purposes. It does not cover clinical decision-making regarding the use of a device on an individual patient, nor does it address hazards that are exclusively related to the effectiveness of the device (e.g., performance characteristics) unless they also affect safety.
The scope explicitly includes:
- All types of medical devices (active, active implantable, sterile, non-sterile, etc.);
- Combination products (e.g., drug-device combinations) where risk management is required for the medical device constituent;
- Standalone software and software as a medical device (SaMD);
- Accessories that are necessary for a medical device to be used as intended.
Manufacturers are required to establish, document, and maintain a risk management process as an integral part of their quality management system (QMS) per ISO 13485 or equivalent. The standard is process-based and does not mandate specific risk acceptability criteria, instead requiring that each manufacturer define their own criteria based on applicable regulatory requirements, state of the art, stakeholder expectations, and the intended use of the device.
Tip: In the Canadian context, the Health Canada guidance document “Risk Management for Medical Devices” (GD 91) provides additional clarification on how CAN CSA Z15190-05 should be interpreted to meet regulatory expectations, especially for Class III and IV devices.
Technical Requirements
Risk Management Process
CAN CSA Z15190-05 defines a closed-loop process consisting of the following phases:
- Risk Analysis
- Risk Evaluation
- Risk Control
- Acceptance of Residual Risk
- Risk Management Review
- Production and Post-Production Activities
The standard requires that each phase be documented in a Risk Management File (RMF) that is maintained throughout the life of the device. The responsibility for risk management lies with the manufacturer, who must assign qualified personnel, provide resources, and ensure that the process is integrated into the design and development activities.
Risk Analysis
Risk analysis begins with the identification of intended use, reasonably foreseeable misuse, and characteristics related to safety (e.g., energy, biological, information, functional). The manufacturer must identify known and foreseeable hazards, including those arising from materials, energy, information, environment, and human factors. For each hazard, the manufacturer shall estimate the probability of occurrence and the severity of harm. The standard allows both qualitative and quantitative methods, provided they are appropriate and justified.
Risk Evaluation
Each identified hazardous situation is then evaluated against the manufacturer’s pre-defined risk acceptability criteria. If the estimated risk is judged unacceptable, the manufacturer must proceed to risk control. The evaluation must consider the combination of probability and severity, often represented on a risk matrix.
Important: The standard requires that risk acceptability criteria be established before beginning risk analysis, not after the fact. This helps avoid bias and ensures consistency across projects.
Risk Control
Risk control applies a hierarchical approach based on the following order of priority:
- Inherent safety by design – Eliminate the hazard or reduce the probability/severity through design choices (e.g., using lower voltage, designing rounded corners).
- Protective measures in the medical device itself or in the manufacturing process – Implement guards, alarms, redundant systems, or automated tests.
- Information for safety – Provide warnings, contraindications, and instructions for use to inform the user of residual risks.
After implementing control measures, the residual risk must be re-evaluated. If the residual risk still exceeds the acceptability criteria, additional controls must be applied until the risk is acceptable. If all practical controls have been applied and the residual risk remains unacceptable, the manufacturer may consider the overall benefit-risk ratio, but this must be documented with clear justification.
Residual Risk Acceptance and Risk Management Review
Once risk controls are implemented and the residual risk for each hazard has been assessed as acceptable, the manufacturer conducts a Risk Management Review to verify that the overall residual risk of the device is acceptable according to their criteria. The review also ensures that the risk management process has been executed correctly, all planned controls are in place, and all relevant hazards have been considered.
The standard requires that the manufacturer document the overall residual risk acceptability decision and make the risk management file available for audit by regulatory bodies.
| Risk Component | Definition | Example |
|---|---|---|
| Hazard | Potential source of harm | Sharp needle, high voltage, software logic error |
| Hazardous Situation | Circumstance where people, property, or environment are exposed to a hazard | Needle stick during disposal due to lack of shield |
| Harm | Physical injury or damage to health | Infection, electric shock, misdiagnosis |
| Severity | Measure of the possible consequences of a hazard | Minor (transient discomfort), Serious (life-threatening) |
| Probability of Occurrence | Likelihood that a harm will occur | Rare, Unlikely, Probable, Frequent |
| Residual Risk | Risk remaining after risk control measures are applied | After adding a needle shield, infection risk is reduced but not eliminated |
Implementation Highlights
Integrating with Quality Management Systems
A successful implementation of CAN CSA Z15190-05 requires seamless integration with the manufacturer’s QMS, particularly design controls, document controls, and corrective and preventive action (CAPA). The risk management file should link directly to design history files (DHF) and serve as input for design reviews, verification, and validation activities. The standard also obliges the manufacturer to collect and evaluate data from production and post-market surveillance (e.g., complaints, adverse events, service reports) to update the risk management file as needed. This post-production feedback loop is a cornerstone of the standard and ensures that risks are managed throughout the entire device lifecycle.
Documentation Requirements
The risk management file must include at minimum:
- A risk management plan (which outlines the scope, activities, responsibilities, and criteria).
- Risk analysis output (hazard identification, severity estimation, probability estimation).
- Risk evaluation results (acceptability of initial risks).
- Risk control measures and verification of implementation.
- Residual risk evaluation and overall residual risk acceptance.
- A risk management report (summarizing the review).
The standard encourages the use of traceability tools (e.g., matrices) to show that each hazard has been addressed and that each control measure is verified. The document must be maintained in a language acceptable to Health Canada (i.e., English, French, or both depending on the device and target market).
Best Practice: Many manufacturers implement a dedicated electronic risk management software to ensure version control, traceability, and easier auditing. This can significantly reduce the administrative burden of maintaining large risk management files across multiple device families.
Compliance Notes
Regulatory Acceptance in Canada
Health Canada recognizes CAN CSA Z15190-05 as a voluntary standard that, if used, provides a presumption of conformity with the safety requirements of the Medical Devices Regulations. For Class III and IV devices (the highest risk classes), demonstrating compliance with this standard is often mandatory via the mandatory mandatory “Design Review” process. The standard is also referenced in Health Canada’s guidance documents, including GD 91 and the “Draft Guidance on Software as a Medical Device (SaMD)” for risk management of software-based devices.
It is important to note that CAN CSA Z15190-05 is not identical to the current version of ISO 14971 (now ISO 14971:2019). The 2005 edition includes Canadian deviations and additional explanatory material. Specifically, it clarifies the application of risk management for in vitro diagnostic devices and emphasizes the inclusion of laboratory staff as potential users. Devices approved under earlier versions of the standard may need gap analysis if transitioning to the latest edition.
Regulatory Note: Although Health Canada accepts risk management per CAN CSA Z15190-05, the manufacturer is still fully responsible for demonstrating that the device’s benefits outweigh the residual risks. Noncompliance, especially regarding post-market risk management, can lead to license suspension, recalls, or enforcement actions.
Auditing and Certification
Audits of the risk management process are typically performed by the manufacturer’s internal audit team, regulatory authorities (such as the Health Canada inspectorate), or third-party certification bodies (e.g., BSI, SGS) under the Medical Device Single Audit Program (MDSAP). The MDSAP audit checklist includes extensive questions on the risk management process, linking it to design controls, supplier management, and CAPA. An effective risk management system can streamline the audit process and demonstrate the manufacturer’s commitment to patient safety.
Key audit focus areas include:
- Existence and content of the risk management plan.
- Consistency of risk classification with the applicable regulatory class.
- Rationale for acceptance criteria and residual risk decisions.
- Evidence of risk management input into design changes.
- Post-market surveillance data that is fed back into the risk management process.
Manufacturers should also be aware that the standard requires that personnel involved in risk management be competent and adequately trained. This includes understanding the device technology, the applicable hazards, and the risk management methods used.
Frequently Asked Questions
Q: Is CAN CSA Z15190-05 the same as ISO 14971:2000?
A: Not exactly. CAN CSA Z15190-05 is the Canadian adoption of ISO 14971:2000 with modifications and clarifications specific to the Canadian regulatory environment, such as additional guidance for in vitro diagnostic devices and updates to references to Canadian legislation. For Canadian submissions, the CSA version is the authoritative reference.
A: Not exactly. CAN CSA Z15190-05 is the Canadian adoption of ISO 14971:2000 with modifications and clarifications specific to the Canadian regulatory environment, such as additional guidance for in vitro diagnostic devices and updates to references to Canadian legislation. For Canadian submissions, the CSA version is the authoritative reference.
Q: Can I use ISO 14971:2019 instead of CAN CSA Z15190-05 for compliance with Health Canada?
A: Health Canada permits the use of the most current edition of ISO 14971 (i.e., 2019) as an alternative, provided the manufacturer also addresses any Canadian deviations not covered by the international standard. A gap analysis between the two standards is recommended to identify differences, particularly in definitions and emphasis on IVD devices.
A: Health Canada permits the use of the most current edition of ISO 14971 (i.e., 2019) as an alternative, provided the manufacturer also addresses any Canadian deviations not covered by the international standard. A gap analysis between the two standards is recommended to identify differences, particularly in definitions and emphasis on IVD devices.
Q: What are the most common non-conformities found during MDSAP audits of risk management?
A: Frequent issues include: lack of defined risk acceptability criteria before risk analysis, insufficient traceability between hazards and controls, absence of justification for not applying controls, and failure to re-evaluate risk when design changes occur. Another common problem is not closing the loop by using post-market data to update the risk management file.
A: Frequent issues include: lack of defined risk acceptability criteria before risk analysis, insufficient traceability between hazards and controls, absence of justification for not applying controls, and failure to re-evaluate risk when design changes occur. Another common problem is not closing the loop by using post-market data to update the risk management file.
Q: Does CAN CSA Z15190-05 apply to IVD devices in Canada?
A: Yes, the standard explicitly covers in vitro diagnostic devices, including IVD reagents, instruments, and software. It includes specific guidance on hazard identification for laboratory environments (e.g., biological agents, chemical hazards) and the role of laboratory staff in risk management.
A: Yes, the standard explicitly covers in vitro diagnostic devices, including IVD reagents, instruments, and software. It includes specific guidance on hazard identification for laboratory environments (e.g., biological agents, chemical hazards) and the role of laboratory staff in risk management.
Last updated: September 2026