Risk Management Maturity Model
RM3 is being developed as a shared way to describe what effective medical product risk management looks like, so that organizations can assess where they are and decide how to improve. This page sets out the model itself.
Organizations may comply with ISO 14971 and ICH Q9 while their practices and outcomes still vary significantly. Risk management can remain compliance-driven, fragmented, and focused on documentation rather than decisions.
With QMSR, the expectation is elevated: risk management is expected to be integrated, consistent, and effective across the quality system. That raises a practical question the model exists to answer: what does effective risk management actually look like, and how would an organization measure it?
AI-enabled systems, combination products, and other emerging medicinal technologies are evolving quickly, and they require faster, higher-confidence decisions under uncertainty.
Teams repeatedly ask what good, and great, risk management looks like, and whether a benchmark exists to assess where they are and how to improve. RM3 is being developed to answer that.
First principles and stakeholder needs together shape what RM3 is for. RM3 Purpose then defines the intent of the RM3 Manual, and a set of companion resources supports implementation outside the Manual itself.
These four principles define what must be true for risk management to be effective. They are distinct from the ten RM3 guiding principles, which translate stakeholder-derived objectives into operating commitments.
Risk management is not a separate documentation exercise. Forward thinking and inversion thinking feed the same decision, that decision is weighed against objectives, context, and consequences under uncertainty, and it is integrated across the product lifecycle.
How do we achieve success?
What could cause failure or harm?
Made under uncertainty, and evaluated through three lenses before they are relied upon.
What the decision is meant to achieve
The conditions the decision is made under
What follows if it is wrong
Integrated across the lifecycle
Lifecycle learning returns to future decisions
RM3 describes five overall levels of maturity. Each level describes how an organization reasons, decides, and evidences its decisions, not how much documentation it produces.
RM3 maturity ascends through L1 Ad Hoc, L2 Defined, L3 Integrated, L4 Optimized, L5 Assured. Each level is drawn as a more complete structure than the one before it; only the final level, Assured, carries the validated green state.
The five RM3 maturity levels.
L1
Reactive, siloed, surprises
L2
Documented, inconsistent execution
L3
Cross-functional, traceable, aligned
L4
Proactive, prevention-focused, predictable
L5
Strategic, first-principles, continuous evidence
At the June 5, 2026 IMSC panel, the RM3 working group reported that the RM3 Manual V1.0 draft was ready for broad community review and comment. The Manual is a working draft, not a finalized standard.
Companion resources that support implementation outside the scope of the RM3 Manual.
RM3 is the shared benchmark and best-practice roadmap for risk management excellence across pharmaceutical, medical device, and combination product organizations, recognized worldwide for enabling safe and effective outcomes for patients.
The working group has set two criteria for what success would look like. Neither describes the position RM3 holds today; both describe what it is working toward.
The RM3 working group seeks to define, maintain, and evolve a first-principles-driven risk management maturity model grounded in First Principles of Safety and aligned with stakeholder needs.
Participate in RM3 to support first principles-based best practices for medical product risk management.
Participate in RM3