Background

Effective medical device risk management is essential to ensuring patient safety and regulatory compliance across a product’s lifecycle. While early design phases often include robust risk identification and mitigation strategies, sustaining engineering (the phase concerned with post-market support, i.e., updates, maintenance, and modifications) often lacks equally rigorous risk management practices.

Methods

A narrative, scoping-style review was conducted to examine risk management practices during sustaining engineering, following PRISMAScR reporting principles. Searches spanned databases (PubMed, IEEE Xplore, etc.), engineering portals, and regulatory/standards sources (ISO/BSI, FDA, European Commission/MDCG, IMDRF, AAMI), supplemented by gray literature from reputable organizations. Inclusion criteria targeted works published between 2007 and 2025 addressing ISO 14971 application, post-market risk integration, or sustaining engineering workflows. Narrower date windows were applied in specific cases to manage search volume or improve relevance. Of 202 records screened, 16 full-text articles were assessed for eligibility, and 11 were included in the final synthesis. Quality appraisal used JBI tools for peer-reviewed studies and AACODS for gray literature.

Results

The evidence base included peer-reviewed studies, regulatory guidance, and scholarly frameworks. Key barriers to effective risk management in sustaining engineering include fragmented workflows, unclear responsibilities, lack of traceability, and weak quality system integration between engineering changes and risk management.

Conclusions

Integrating ISO 14971 principles into sustaining engineering workflows transforms risk management from a static compliance task into a dynamic, continuous process. This approach strengthens traceability, enhances patient safety, and ensures regulatory alignment across the device lifecycle by proactively identifying, assessing, and mitigating emerging risks in sustaining changes.