Rakenne vs ChatGPT for an ISO 14971 Risk Management File

An ordinary chat prompt can help a team turn known risk information into a draft. It does not, by itself, make a risk-management plan complete, prove a risk control works, or decide whether residual risk is acceptable. This comparison shows where a checked-in workflow adds explicit structure and a deterministic check—without presenting the result as a regulatory decision.

We use the same fixed, fictional LumaFlow scenario for both approaches. The examples are synthetic and focus on one setup-selection hazard in a first draft. They are not a customer record, a clinical evaluation, a regulatory submission, or a benchmark of all ChatGPT configurations.

The same drafting brief

LumaFlow is a fictional battery-powered infusion pump for trained clinicians in supervised outpatient settings. Its hypothetical manufacturer needs a first-pass risk-management-plan excerpt and one risk-analysis row for an incorrect-rate-selection hazard.

The brief supplies intended use, foreseeable misuse, a P1/P2/severity assessment, a fictional unacceptable-risk threshold, candidate controls, and a planned usability-test record. It requires the drafter to show the control hierarchy, verification need, residual-risk status, and any questions for a qualified reviewer.

This is a workflow comparison, not a claim that a model in plain chat cannot draft a useful table. A knowledgeable team can add equivalent review steps manually; the distinction is whether the process and checks are available as part of the drafting workflow.

What the workflow adds

The Rakenne entries above are verifiable in the checked-in skill instructions and extension source. They describe the workflow and its checker, not a promise of regulatory compliance or approval.

The output difference is a reviewable risk record

Both approaches can format a risk table. The useful question is whether the draft makes the initial risk, control priority, verification requirement, and unresolved decision visible to a reviewer.

Synthetic prompt-only illustration — this intentionally incomplete excerpt is not an executed ChatGPT transcript:

## Risk analysis

Hazard: Incorrect rate selected during setup
Severity: 4; P1: 3; P2: 2
Risk level: Unacceptable

The excerpt tells a reviewer that the starting risk is serious, but it does not capture risk-control options, whether a control is verified, the residual-risk decision, or an overall conclusion.

Synthetic structured illustration — the same fictional facts arranged in the target shape of the Rakenne workflow:

## Risk analysis — incorrect rate selected during setup

**Risk estimate:** Severity 4; P1 3; P2 2. Initial risk: unacceptable under
the plan's acceptability criteria.

**Control options considered in priority order:**
1. Inherent safety by design: constrain rate entry to the prescribed range.
2. Protective measure: require an independent confirmation screen before start.
3. Information for safety: state the setup verification step in the IFU.

**Verification required:** Usability-test record demonstrating the constrained
entry and confirmation flow were implemented and evaluated.

**Residual-risk decision:** Pending the verification record and human review.

The structured illustration is not a completed risk-management file. In particular, it does not assert the controls are effective or that residual risk is acceptable; it makes the missing verification and reviewer decision explicit.

A finding that an ordinary prompt does not enforce

The fictional fixture includes the intentionally incomplete unacceptable-risk excerpt above. When the checked-in check_risk_acceptance_criteria tool evaluates that text, it finds an unacceptable risk but no risk-control measure or benefit-risk justification. It emits an ERROR explaining that the uncontrolled risk is a regulatory non-conformity, then reports missing plan elements.

This does not mean ChatGPT cannot identify the omission if a user asks it to. It establishes a narrower, reproducible fact: the plain-chat baseline has no built-in Rakenne validator applying this rule. The team must inspect the draft manually or provide an equivalent control.

Where human review remains essential

Rakenne does not make a medical-device risk decision, certify conformity, replace regulatory affairs expertise, or replace the manufacturer’s quality-system responsibilities. A qualified reviewer should still:

• confirm intended use, foreseeable misuse, hazard sequences, and all risk estimates;
• decide the risk acceptability criteria and evaluate risk-control feasibility;
• review verification evidence before concluding that a control is implemented and effective;
• make and approve residual-risk and benefit-risk determinations; and
• maintain the risk-management file and post-market feedback process.

Plain chat can be a practical drafting aid when that review discipline and the governing risk-file structure already exist. The Rakenne workflow is most useful when a team wants the plan, hierarchy, verification prompts, and repeatable checker close to the drafting work.

Continue the ISO 14971 workflow

Use the ISO 14971 risk management file template for a template-first route, read the ISO 14971 risk file structure guide for the full workflow, or inspect the ISO 14971 Risk File Author skill and its validation scope.

Try the ISO 14971 risk-file workflow

For the cybersecurity counterpart, see Rakenne vs ChatGPT for SOC 2 control narratives .

Methodology, limitations, and review

• Method: Both columns use the same checked-in fictional scenario. Product statements are limited to the current skill instructions, references, and extension code. Output excerpts are synthetic illustrations labelled as such; no performance, accuracy, time, or cost benchmark is claimed.
• Limitations: Results vary with the prompt, model, supplied source material, and reviewer. The generic-chat baseline is one deliberately untooled workflow, not a review of ChatGPT as a product or of all integrations.
• Last reviewed: 2026-07-10. Editorial owner: Ricardo Cabral. Review this page quarterly and after a material skill or validation change.
• Measurement: With analytics consent, the primary CTA records the try_skill_cta_clicked event from the #295 taxonomy with this page path, iso14971-risk-file-author, and comparison_primary placement. Review organic/referral entrances, CTA starts, first-document completions, signups, and assisted conversions after 30 days.