What Are the Requirements for Risk Management Documentation for Overseas Registration of Rehabilitation Devices?

Key Summary

For rehabilitation devices such as electric wheelchairs, exercise rehabilitation equipment, and physical therapy devices, risk management documentation is not optional—it is a core component of the technical file during overseas registration. Manufacturers should first determine whether the product falls under the medical device regulatory scope of the target country and identify its risk class and applicable registration pathway. Second, they should assess whether existing risk management documentation under NMPA, CE, FDA, ISO 13485, or MDSAP can be reused, with particular attention to alignment with ISO 14971, coverage of actual use scenarios and injury patterns, and consistency with performance verification, clinical evaluation, and labeling. Common risks include directly copying risk management reports from EU CE technical files into other countries, ignoring local regulatory requirements on report structure, language, and local representative document control. Risk management is a continuous process; post-market adverse events, change applications, and certificate renewals all require corresponding risk management maintenance. For multi-country registrations in GHWP member states, Southeast Asia, the Middle East, and Latin America, it is recommended to build a complete, reusable core risk management file and adapt it to target country requirements through localization, reducing repeated compilation and deficiency risks.

Applicable Scenarios and Core Issues

Rehabilitation devices cover a broad range of products, including electric wheelchairs, physiotherapy devices, rehabilitation training equipment, walking aids, and cognitive rehabilitation software. Regulatory boundaries for such devices vary by country; some products may be classified as medical devices, while others may fall under personal care devices or fitness equipment. Before starting overseas registration, manufacturers should confirm the regulatory classification of the product in each target country.

Risk management documentation is a critical part of the technical file and key evidence for safety evaluation during registration review. Many companies focus on product testing reports but underestimate the review weight of risk management documentation. Regulators examine whether the risk management report identifies major hazards, implements control measures, and demonstrates that overall residual risk is acceptable, forming a basis for assessing post-market safety.

This article is intended for manufacturers of rehabilitation devices planning to enter GHWP member states, Southeast Asia, the Middle East, and Latin America, providing a clear and actionable path for preparing risk management files.

Registration Decision Logic

Before preparing risk management documentation, manufacturers should complete a four-step assessment. First, confirm whether the product falls under the medical device regulatory scope in the target country. Second, determine the risk class based on intended use, contact time, energy type, and implantability, typically corresponding to Class I, II, or III (classification systems vary by country). The risk class directly affects the registration pathway, review stringency, and the number of technical documents required. Third, take stock of existing quality system and marketing application documents. If the company already holds NMPA registration, CE certification, FDA 510(k), or MDSAP certification, evaluate whether the risk management information in these files can be reused. For instance, an ISO 14971 risk management report in CE technical documentation can usually serve as a base document for other countries, but it must be checked against the target country's standard versions and additional requirements. Fourth, confirm technical files, performance verification, risk management, clinical evaluation or evidence, labeling, local representative, authorized representative, and post-market maintenance requirements. These dimensions collectively determine whether an existing risk management file is sufficient or must be redeveloped.

For multi-country registrations in GHWP member states, Southeast Asia, the Middle East, and Latin America, manufacturers should adopt a 'one core risk management file plus localized difference attachments' approach. The core file retains product risk analysis, evaluation, and control measures, while the difference attachment contains only supplemental information required by the target country's regulations.

Documentation and Evidence

Risk management documentation typically includes a risk management plan, risk analysis, risk evaluation, risk control measures, overall residual risk evaluation, and a risk management report. These documents must be based on the actual characteristics of the product, not simply assembled from templates.

The risk management plan should define the product scope, intended use, applicable standards, risk acceptability criteria, evaluation methods, and responsibilities for review and approval. It is recommended to use clear qualitative or quantitative criteria that align with the expectations of target country reviewers.

Risk analysis should cover hazard identification, hazardous situations, harm sequences, and risk estimation. Common risks for rehabilitation devices include electric shock, mechanical injury, thermal burns, falls due to functional failure, software misdiagnosis, and electromagnetic interference. Hazard identification should not rely solely on standard clauses but must consider real-world usage scenarios, such as home environments rather than hospital settings.

Risk control measures should be prioritized: first consider inherent safety design, then protective measures and alarms, and finally use information. Each control measure should reference specific standards or verification results, such as IEC 60601 series, ISO 14971, or ISO 13485 records.

The overall residual risk evaluation must consolidate results from all identified risks and determine whether the total risk is acceptable. The risk management report should conclude clearly that 'overall residual risk is acceptable' and provide the chain of evidence supporting that conclusion.

In addition to core documents, manufacturers should prepare test evidence related to risk management, including electrical safety, electromagnetic compatibility, biocompatibility, software lifecycle, usability engineering, and performance testing. If the product involves programmable systems, cybersecurity risk assessment is also required.

When reusing existing documents, verify that the standard versions cited are still valid. For example, ISO 14971:2019 used in CE marking is generally accepted in most GHWP member states, but some countries may have additional guidelines. Compare clauses item by item before reuse.

Common Mistakes

• Directly copying CE or FDA risk management reports without adapting structure and content to the target country's regulations.
• Risk analysis does not cover real-world use scenarios, such as risks from non-professional users in home environments.
• Risk management files inconsistent with contraindications and warnings in labels and instructions for use, leading to review questions.
• Reports state conclusions without supporting verification records and evidence for risk control measures.
• Ignoring local language, format, issuance subject, and local representative signature requirements for risk management documents.
• Treating risk management as a one-time submission document without post-market updates, causing issues in subsequent changes and renewals.

Manufacturer Preparation Checklist

• Confirm the target country's regulatory scope and risk class, and match the appropriate registration pathway.
• Establish ISO 14971 risk management system documents, ensuring the risk management plan, risk analysis, and risk management report are complete.
• Inventory existing NMPA, CE, FDA, and MDSAP documentation, identify gaps, and create a reuse-and-addition list.
• Cross-reference risk management conclusions with performance testing, biocompatibility, electrical safety, and software verification reports.
• Update labels and instructions for use to ensure contraindications, precautions, and residual risk information align with risk management documents.
• Confirm whether the target country requires a local representative or authorized representative, and clarify their responsibilities in document control.
• Develop a risk management file maintenance plan defining processes for post-market adverse events, changes, and periodic reviews.
• For multi-country projects, establish a unified master document and a localization difference table to avoid version confusion.

AIMEILI Perspective

From the perspective of a regulatory consultancy, the most common misconception is treating risk management documentation as an accessory to ISO 14971 system audits, rather than recognizing it as cross-cutting safety evidence in registration review. Well-prepared risk management documentation can significantly reduce review questions and deficiency responses.

In the early stage of a project, we advise manufacturers to conduct a gap analysis first, rather than immediately translating existing reports. Compare the target country's regulatory guidance, review concerns, and standard versions against the existing risk management files.

Risk management reports in existing NMPA registration files are often reusable, and documentation from CE and FDA files also has high reuse value. However, what must be localized are the regulatory environment, label language, local clinical usage habits, and the local representative's requirements for document signing and change notification.

A local representative is not just a courier for documents. Their responsibilities include monitoring local regulatory changes, replying to review questions, maintaining registration certificates, and communicating updates to risk management files with regulatory authorities. The manufacturer's ability to manage the local representative directly affects control over the certificate and the efficiency of changes and renewals.

For multi-country registrations, we recommend treating the core risk management document as part of the product master file. Using a single core analysis to cover all major product risks, then adding localized differences as required by each country, will significantly reduce the risk of duplicate work and deficiencies.

Frequently Asked Questions

Is a risk management document required to be submitted separately during registration application?

Most countries do not require a separate 'risk management document' to be submitted with the application. Instead, risk management content is embedded in the technical file. Reviewers may examine risk management evidence in the technical summary, test summaries, or specific regulatory requirements. Manufacturers should clearly reference the risk management report and state its conclusions within the technical file.

What is the relationship between ISO 14971 and ISO 13485?

ISO 13485 is a quality management system standard that requires a documented system. ISO 14971 is a risk management standard that defines a specific process within that system. Registration review examines the combination of these standards, so manufacturers must demonstrate the inputs and outputs of the risk management process within the quality system, as well as continual improvement.

Is it necessary to translate risk management documents into the target country's language?

It depends on local regulations. For example, Saudi Arabia and Indonesia usually require labels and instructions in Arabic or Indonesian. The risk management report itself may generally be in English, but follow-up questions may require partial translation into the local language. We recommend consulting the local representative in advance.

Do all rehabilitation devices require a full risk management report?

In principle, all medical devices should undergo risk management in accordance with ISO 14971 and produce documentation. However, reports for low-risk devices can be simplified. Manufacturers should determine the required depth based on the target country's classification and guidance, but must not omit the risk analysis process.