Risk classification

The risk classification of a medical device falls into one of four categories:

• Class I: Generally low risk
• Class IIa: Generally medium risk
• Class IIb: Generally medium risk
• Class III: Generally high risk

How a medical device is classified will depend on factors including the intended purpose of the device, how long it’s intended to be in use for and if the device:

• is invasive/surgically invasive
• is implantable or active
• contains a substance, which in its own right is considered to be a medicinal substance

Higher risk devices are subject to more stringent regulatory requirements before they can be placed on the market (which includes NHS adoption). Key guidance for risk classification in the UK is a sub-section of the European Union Medical Device Regulation, MEDDEV 2.4/1.

Risk classification of medical devices is central to navigating regulation, and requires the appointment of a suitably qualified person, usually a Clinical Safety Officer (CSO). The CSO must be a clinician with experience in the application of risk assessments as they are expected to sign off the documentation and often also write it. Many organisations choose to outsource the CSO to an independent professional.

In addition to medical device regulations, risk classification needs to comply with two legally mandated standards set out by the Data Alliance Partnership Board (DAPB, previously Data Coordination Board [DCB]) DCB 0129 and DCB 0160 under section 250 of the Health and Social Care Act 2012, which provide a framework for clinical risk management.