Risk Management Documentation Requirements for Overseas Registration of Home-Use Medical Devices

Risk management documentation is a core component of the technical file for overseas registration of home-use medical devices and is a key review focus in several GHWP member states. Manufacturers must first determine whether the product falls within the scope of medical device regulation in the target country, then select the registration pathway and applicant based on risk classification, and subsequently evaluate whether existing NMPA, CE, FDA, ISO 13485, MDSAP and other documentation can be reused. The risk management file typically includes risk analysis, risk evaluation, risk control measures, evaluation of overall residual risk, a risk management report, and a risk management plan. It should also address usability engineering, cybersecurity, software verification, labeling and instructions, and patient training materials, taking into account the intended use, user environment, operational capability of lay users, and maintainability. For markets such as Southeast Asia, the Middle East, and Latin America, attention must be paid to local language labeling, local agents or authorized representatives, and post-market surveillance and adverse event reporting requirements. Manufacturers often overlook risks of misuse in the home environment, electrical safety, risks involving children, and re-evaluation of risk after product changes. It is recommended to perform a gap analysis first, then build a reusable core risk management file and make localized adaptations for different countries while retaining a complete chain of evidence. Common pitfalls include fragmented documentation, inconsistent versions, and disconnection from the quality system, leading to requests for correction and delays.

Published: August 4, 2026 08:45 | Updated: August 4, 2026 08:45

Applicable Scenarios and Core Questions

Home-use medical devices (such as blood pressure monitors, blood glucose meters, thermometers, home ventilators, home physiotherapy devices, and rehabilitation equipment) require risk management documentation as an essential part of the technical file when registering overseas. Many manufacturers already hold NMPA registration in China and have accumulated ISO 14971 risk management documents, but may still receive deficiency letters when submitting abroad. The core issue is not usually the absence of documents but rather the mismatch between the risk management file and the target market requirements.

This article applies to scenarios where a manufacturer is preparing to export home-use medical devices to GHWP member countries or other overseas markets, is currently organizing registration files, or has already submitted an application and received risk management-related requests for correction. The decision logic and implementation recommendations provided here can assist regulatory affairs teams in establishing a clearer working path in the early stages of a project.

The special nature of home-use medical devices lies in the non-clinical environment, and the users are often patients or family members with varying risk awareness and operational capabilities. Therefore, the risk management file must not only cover the inherent safety performance of the product but also address foreseeable misuse in the home environment, drops, electromagnetic interference, cybersecurity, access by children, label readability, and user training. Review authorities typically require a complete risk management plan and report demonstrating that the overall residual risk is acceptable.

Registration Decision Logic

Step 1: Determine Whether the Product Is a Medical Device in the Target Country

Different countries have different definitions of medical devices. For example, a traditional blood pressure monitor may be regulated as a medical device in some countries, while an app or wearable device with health management functions may or may not be regulated as a medical device. The product's regulatory status must first be confirmed under the target country's regulations; otherwise, the risk management file will lack a proper foundation.

Step 2: Determine Risk Classification and Registration Pathway

Most home-use medical devices fall into Class II or an equivalent moderate risk level, but some may be considered higher risk or be placed in special categories due to measuring functions, invasiveness, or duration of use. The risk classification determines the registration pathway, depth of review, and whether clinical evaluation or a quality management system audit is required. Manufacturers should make preliminary predictions based on the target country's classification rules and prepare the corresponding depth of risk management.

Step 3: Evaluate Reusability of Existing Documentation

If the manufacturer already has NMPA registration, CE certification, or FDA 510(k) submission data, a systematic review should be conducted to identify the risk management-related content, including ISO 14971 risk management reports, usability engineering reports, software lifecycle documentation, clinical evaluation data, and labeling. These materials can significantly reduce the initial preparation effort, but they cannot be submitted directly to all countries. Regional gap analysis and localization are required.

Step 4: Confirm Special Requirements of the Target Market

In addition to general technical files, it is necessary to confirm whether a local agent or authorized representative is required, whether local language risk information must be provided, and whether a post-market surveillance plan and adverse event reporting procedure are required. In particular, GHWP member states have recently tended to adopt harmonized documents, but local details still vary. A "core file + country-specific difference file" approach can be used to establish a multi-country registration documentation system.

Step 5: Establish a Tree Structure for Risk Management Documents

It is recommended to organize the documents into three layers: the top layer is the overall risk management report; the support layer includes specific reports on risk analysis, evaluation, control measures, usability, software, and clinical data; and the evidence layer contains test reports, standards, literature, and user studies. This structure facilitates review and provides a clear mapping for future changes and updates.

Documentation and Evidence

Risk management documentation is not a single report; it is an evidence chain covering the entire process from planning and evaluation to post-market updates.

Core documents typically include: risk management plan, risk analysis report, risk evaluation report, summary of risk control measures, evaluation of overall residual risk, and risk management report. These are generally structured according to ISO 14971, which is also the framework accepted by most overseas regulators.

For home-use medical devices, a usability engineering report should be added to describe the target users (patients, elderly, children), the use environment, and use scenarios, and to assess the risks arising from use errors.

If the product contains software, software lifecycle documentation, cybersecurity risk analysis and verification records, and the correlation between software version and the risk management report should be provided.

Labeling and instructions for use are important components of the risk management file. Family members may rely on icons, color coding, and multi-language explanations to understand the product. Manufacturers should retain verification records for translated instructions, label readability test records, and the rationale for warning information.

Clinical evaluation or clinical evidence is also part of the risk management file. For home-use devices that are high risk or lack comparative data from equivalent devices, literature, clinical study reports, or locally accepted clinical evaluations may be required.

A post-market surveillance plan, periodic safety update reports, complaint handling procedures, adverse event reporting procedures, and a regular update mechanism for the risk management file should all be part of the quality management system and remain consistent with the registration dossier.

Special attention should also be given to electromagnetic compatibility and electrical safety documentation. The home environment may contain various electrical and wireless devices, power supply quality may vary, and test data for leakage current, electrostatic discharge, and radiated immunity need to be re-evaluated according to target country standards.

When preparing documentation, version control and a document list should be implemented to ensure the name, number, version, date, and approval status of each document are clear and traceable.

Common Errors

Common risk management-related errors in overseas registration of home-use medical devices include:

• Directly using risk analysis for clinical environments without supplementing risks associated with the home environment such as misuse, child contact, household power, and network conditions.
• Risk management reports are disconnected from the quality management system; the content does not align with actual R&D, production, and change control processes, raising questions about credibility during review.
• Labeling and instructions for use are provided only in English or Chinese, without localization to the target country language, and without evidence that the instructions can be understood by home users.
• After software updates or hardware changes, risk re-evaluation is not performed, resulting in outdated risk management reports in the registration file.
• No local agent or authorized representative designated in the target country, leaving product liability and post-market obligations unclear.
• Data in the risk management report lack sources or have inconsistent citations, such as missing test report numbers, standard versions, or expiry dates.
• Special risk requirements of the target country regarding electromagnetic compatibility, cybersecurity, power consumption, and power adapters are overlooked.
• Post-market surveillance plan is omitted from the registration application, leading to repeated requests for correction.
• Risk information for different models is combined without a model difference matrix, leading to requests to split the submission.
• Meeting records and decision-making rationale for risk management reviews are not retained, failing to demonstrate that risk acceptance is supported by an organizational process.

Preparation Checklist for Companies

When preparing for overseas registration of home-use medical devices, manufacturers should at least complete the following tasks:

• Establish or update an ISO 14971 risk management procedure covering the entire product lifecycle.
• Map the user profile and use scenarios to identify foreseeable misuse in the home environment.
• Compile existing NMPA, CE, FDA, or MDSAP documentation to form a reusable core file.
• Develop a risk management plan that defines risk acceptance criteria, responsible parties, and review timelines.
• Complete risk analysis and risk control, supplemented by risk control measures specific to the home scenario.
• Complete usability engineering and software lifecycle documentation, if applicable.
• Prepare labeling and instructions for use in the target country language and retain verification records.
• Appoint a local agent or authorized representative and sign a quality agreement.
• Establish a post-market surveillance plan and adverse event reporting procedure.
• Perform an internal gap analysis before submitting the registration application to ensure all document versions are consistent and integrated into the quality system.
• Establish a mechanism for linking risk management documents to design changes, procurement changes, and production changes.
• Provide regular risk management training to ensure R&D, quality, and regulatory personnel understand current requirements.

AIMEILI Perspective

From AIMEILI's perspective, the most common misjudgment is thinking that risk management documentation can be finalized at one time. In reality, risk management is a dynamic process that runs through pre- and post-registration, change control, and post-market surveillance. The most worthwhile early task is to spend about one week on a gap analysis, comparing the risk management content in existing NMPA, CE, FDA, ISO 13485, or MDSAP files with the requirements of the target country to identify missing items and version conflicts.

Documents that can be reused as a core file include the ISO 14971 risk management report framework, existing test data, and clinical data. What must be localized includes labeling and instructions, local regulatory compliance declarations, local agent information, and certain risk control measures. Manufacturers should note that a local agent is not just an administrative attachment; the agent bears responsibilities for local regulatory communication and after-sales supervision, and the certificate control rights and renewal/change procedures are linked to the agreement with the agent or authorized representative.

For multi-country registration, repeated preparation and correction risks can be avoided by adopting a "core file + country-specific chapter" model. The core file remains stable, while the country-specific chapter contains the risk information, language versions, agent information, and regulatory format unique to each country. A document version matrix should be established to record the version and usage status of each document in each country. This reduces duplicate work and allows rapid identification of the impact scope when regulators request updates.

It is recommended that companies treat the risk management report as the "central processor" of the product file. Whenever a change occurs, first analyze the risk impact, then decide whether to update the registration file. In the market, continuation failures often occur not because of product safety issues themselves, but because risk management documents were not updated in a timely manner, leading to consistency gaps discovered during system audits.

Frequently Asked Questions

Does the risk management report have to be prepared by qualified personnel?

Most regulators do not require a specific qualification certificate, but they do require the manufacturer to designate a responsible person and a team with the necessary competence. The report must be linked to the design and development, procurement, production, and after-sales processes in the quality management system. If the manufacturer lacks a dedicated risk management expert, a CRO or consulting organization may be engaged to assist, but the signing and responsibility still lie with the manufacturer.

Can the ISO 14971 risk management report for CE certification be used directly for FDA or GHWP member state registration?

No, it cannot be used directly, but the analysis data and evidence can be reused. FDA and GHWP member states have different review emphases for risk management, particularly regarding the home environment, real-world performance, recalls, and change control. Manufacturers should use the CE report as a basis and supplement it with gap analysis and localization, rather than simply converting the format.

Is a separate risk management file required for each model of a home-use medical device?

If multiple models belong to the same risk management family and have similar technical characteristics, intended use, and risk profiles, a single risk management report with a model difference matrix can be used. If risk equivalence cannot be demonstrated, reviewers may require separate evaluations. It is recommended to define the family boundaries and model differences early in the risk management plan to reduce the number of duplicate documents.

If new adverse event information is obtained after market launch, does the risk management file need to be updated?

Yes. Post-market adverse events, corrective actions, user feedback, and literature information should all feed back into the risk analysis process. If the overall residual risk changes, the risk management report must be updated and an assessment must be made as to whether to report to the regulator or amend the registration file.

How are risk acceptance criteria set in the risk management file?

Risk acceptance criteria should be established based on regulatory requirements, available technology, clinical practice, and the manufacturer's own policies. Common methods include risk matrices, frequency-severity combinations, and the ALARP principle. Manufacturers should define these criteria in the risk management plan and ensure consistent standards are used across the same product family.

Related Reading

• How should clinical evaluation data be prepared for overseas registration of software medical devices?
• How should technical files for home-use medical devices be organized for overseas registration?
• How should labels and instructions for use be prepared for overseas registration of medical devices?
• How should labels and instructions for software medical devices be localized for overseas registration?
• How are responsibilities divided for authorized representatives of software medical devices overseas registration?
• How can multiple models of software medical devices be grouped in a single submission for overseas registration?

Content Review and Applicability

Author: AIMEILI Regulatory Editorial Department

Professional Review: AIMEILI Medical Device International Registration Project Team

Source Principles: Priority is given to official regulatory authorities, international organizations, standards bodies, and public regulatory information; industry media and project experience are used only as supplementary reference.

Applicability: This article is intended for preliminary understanding, document preparation, and project planning, and does not substitute for the formal requirements of the target country regulators, testing conclusions, or legal advice.