Agent skill · research science · borghei
risk-management-specialist
Medical device risk management specialist implementing ISO 14971 throughout product lifecycle. Provides risk analysis, risk evaluation, risk control, and post-production information analysis.
Why this skill is useful
Provides specific risk analysis methodologies and scripts for ISO 14971 compliance that the AI wouldn't reliably generate on its own.
What it needs
Requires python installed locally. About 4k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
Risk Management Specialist ISO 14971:2019 risk management implementation throughout the medical device lifecycle — planning, hazard analysis, risk evaluation, risk control, residual-risk assessment, and post-production monitoring — extended for AI/ML, cybersecurity (IEC 81001-5-1), supply chain, and cross-framework alignment (NIST CSF, DORA, NIS2). Core Capabilities Risk management planning — scope, 5x5 acceptability matrix, RACI, verification and post-production planning Risk analysis & evaluation — hazard identification across 9 categories, P1-P5 / S1-S5 estimation, ALARP, benefit-risk triggers Risk control — priority hierarchy (inherent safety → protective measures → information for safety), verification methods, residual-risk evaluation Post-production monitoring — information sources, review triggers, RM-file update procedures, periodic review Extended domains — AI/ML risk (bias, drift, adversarial inputs), health-software cybersecurity, supply chain risk, cross-framework mapping When to Use Implementing ISO 14971:2019 across the device lifecycle Building a hazard analysis / risk register using FMEA, FTA, HAZOP, or Use Error Analysis Evaluating residual risk and demonstrating ALARP or benefit-risk acceptability Extending risk management to AI/ML devices, cybersecurity, or supply chain Setting up post-production risk monitoring and Risk Management File update triggers Clarify First Before running the risk assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume: [ ] Device and intended use — what it is and its use context (drives the hazard categories and benefit-risk analysis) [ ] Lifecycle stage — planning, hazard analysis, risk control, or post-production (picks the workflow) [ ] Acceptability criteria — the 5x5 matrix thresholds and ALARP definition (determines the risk-evaluation outcomes) Stop rule: ask only the 2-3 that most change the output. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/risk-management-specialist