Essential Performance Requirements and How to Identify Them

A patient hoist performs two clinical functions, raising a patient and lowering one. A risk analysis may accept a hoist’s failure to lift a patient while treating failure to lower the patient as unacceptable risk. In that analysis, only the lowering function qualifies as essential performance.

That asymmetry sits at the center of essential performance analysis. The manufacturer leads the risk-based determination. In some cases, the manufacturer may conclude the device has no essential performance. Essential performance analysis separates clinical function risk from basic safety risk and anchors the determination within ISO 14971 risk analysis. 

This guide covers how essential performance differs from basic safety, how to identify it through risk analysis, and how to test, document, and maintain it as designs change.

What Is an Essential Performance Requirement?

IEC 60601-1 defines essential performance as the performance of a clinical function whose loss or degradation beyond the limits specified by the manufacturer results in an unacceptable risk. That definition gives teams a direct screening question. Would the function’s absence or degradation cross the manufacturer’s acceptable-risk threshold?

An essential performance requirement (EPR) is a documented requirement that captures the clinical function, its performance limits, and the conditions under which those limits apply. Essential performance became a compliance requirement through an amendment to IEC 60601-1. Manufacturers must establish specific performance limits, evaluate essential performance characteristics under abnormal or fault conditions, and declare specific essential performance criteria in the product’s technical description.

Those limits must sit between fully functional and total loss of the identified performance, under both normal and single-fault conditions. The standard notes that the limits can differ between the two conditions. The current Edition 3.2 was published in August 2020, and its requirements have been in effect for U.S. certification since December 17, 2023.

Essential Performance vs. Basic Safety and the Difference

Every requirement in IEC 60601-1 serves one or both of two objectives, basic safety and essential performance. The two concepts answer different questions about the same device.

How IEC 60601-1 Defines Basic Safety

Basic safety covers unacceptable risk directly caused by the device’s physical hazards under normal and single-fault conditions. The physical hazards inherent to the device are electric shock, thermal hazards, and mechanical hazards. Manufacturers typically address them through passive protective measures such as electrical insulation, thermal fuses, and fireproof casings.

Why Clinical Function Is the Dividing Line

Essential performance concerns whether the device delivers its intended clinical benefit. Above that threshold, the harm comes from the failure to treat, monitor, or diagnose. The device’s own physical hazards fall under basic safety. Clinical functions include therapeutic and patient-monitoring functions, along with diagnostic functions built into the equipment itself, such as imaging or waveform analysis. Standalone in vitro diagnostic devices fall outside this scope, as covered below. The split is easiest to see in devices that carry both dimensions at once.

Dimension	Defibrillator	Infusion pump	Blood pressure monitor
Basic safety	Electrical safety of the discharge circuit	Enclosure and electrical insulation	Insulation and touch-current limits
Essential performance	Delivering the correct energy level to restart the heart	Dose delivery within specified accuracy limits	Accurate measurement and display of blood pressure

Both dimensions must survive single fault condition testing. The tested failure differs. One protects against a physical hazard, the other confirms continued delivery of the clinical function.

How to Identify Essential Performance Requirements

Manufacturers identify essential performance through a risk management process that complies with ISO 14971. Essential performance identification must connect directly to risk management under IEC 60601-1.

Starting With a Risk-Based Assessment Under ISO 14971

Identification starts by enumerating every clinical function the device performs, then treating the loss or degradation of each as a potential source of harm. Manufacturers must identify and document known and foreseeable hazards based on the device’s safety characteristics across the intended use and reasonably foreseeable misuse, under both normal and fault conditions, as required by ISO 14971. A risk analysis limited to component failures will miss functions that drift out of specification during ordinary operation, so the normal-condition analysis has to be included.

Teams can use guidance questions from the companion technical report, ISO/TR 24971, to identify device characteristics that affect safety. Those questions help teams avoid narrowing the analysis too early.

Mapping Each Clinical Function to Its Risk

For each function, teams ask whether operation beyond specified performance levels would result in harm. The performance range at which harm occurs establishes the essential performance limits, and if variation in the function doesn’t result in injury, it isn’t essential performance. The manufacturer’s documented policy defines acceptable risk levels.

Teams should assess essential performance before applying risk control measures, because the essential performance they define determines those controls. Assessing after mitigation inverts the logic.

Common Tools for Essential Performance Risk Analysis

Manufacturers choose risk analysis techniques that fit the device and hazard profile. ISO/TR 24971 lists methods such as the following:

• Failure Mode and Effects Analysis (FMEA): A bottom-up method that starts from components and failure modes and works toward hazards. FMEA only identifies risks associated with fault conditions, so it can’t be the sole tool for an analysis that must also cover normal operation.
• Fault Tree Analysis (FTA): A top-down method that starts from a defined top event, such as loss of accurate drug delivery. It decomposes the event into contributing failure combinations with AND and OR gates. Minimal cut sets expose single points of failure threatening an essential performance function.
• Hazard and Operability Analysis: A guide-word technique that examines deviations from design intent. Guide words such as “more than,” “less than,” and “no flow” map directly onto loss or degradation of essential performance.

The directional differences explain why teams combine methods rather than pick one. Running both against the same function surfaces failure paths that a single technique alone would miss.

Deciding When a Device Has No Essential Performance

When the evidence supports no essential performance, the team still follows the same analysis as any other outcome. The same sequence applies when the team believes no essential performance exists:

1. All functions of the device are listed.
2. Non-clinical functions are removed.
3. Functions outside the intended use are removed.
4. Loss or degradation of each remaining function is assessed for unacceptable risk.
5. Every function that fails that test is identified as essential performance.

Caution is warranted with backup-system arguments, because the risk analysis still needs to account for harm the primary system may cause before the backup engages. Auditors may scrutinize a bare no-essential-performance statement, so the supporting risk assessment must be retrievable when a test laboratory or regulator requests it.

How to Test and Document Essential Performance Requirements

Identifying an EPR creates testing and documentation obligations that follow the device through certification and beyond. Each requirement needs preplanned acceptance criteria, standards mapping, and traceability to verification evidence.

Setting Acceptance Criteria for Each EPR

Pass/fail criteria for immunity testing must be quantitative, specific to the medical device and its functions, observable, and documented in the electromagnetic compatibility (EMC) test plan before testing begins. Criteria defined after the fact invite challenge during regulatory review. Essential performance and basic safety must not be affected by electromagnetic disturbances under IEC 60601-1-2, the EMC collateral standard, and degradation that produces unacceptable risk isn’t allowed, even when an alarm accompanies it.

Measurable criteria can include the accuracy of a life-supporting function and the correct operation of an alarm whose failure would pose an unacceptable risk. Teams should make the required performance limit testable before laboratory work starts.

Mapping EPRs to Applicable Standards

For covered device types, particular standards name essential performance explicitly and are the first place to look. For infusion pumps, a later edition of IEC 60601-2-24 added a table of EPRs where an earlier edition had none. Defibrillator EPR areas include charging time, endurance, synchronizer function, and recovery of electrocardiogram (ECG) inputs after defibrillation, as identified in EN 60601-2-4.

A pulse oximeter’s essential performance is the accuracy of peripheral oxygen saturation (SpO2) and pulse rate, or an indication of abnormal operation, under ISO 80601-2-61. Where no particular standard applies, risk assessment and knowledge of predicate devices define essential performance. If a particular standard specifies no additional essential performance requirements, the manufacturer reverts to the general standard.

Recording Rationale for Audit and Regulatory Review

For audit and regulatory review, the risk management file should connect essential performance, failure modes, risk controls, and verification results. Each identified hazard must be traceable in accordance with ISO 14971. Reviewers evaluate the whole file for consistency, and non-conformities often cluster at document interfaces. The auditable chain needs to hold at each interface:

• Hazard to risk control: each identified hazard links to the risk control that mitigates it.
• Risk control to requirement: each risk control links to the requirement that implements it.
• Requirement-to-test result: each requirement links to the test protocol and the pass/fail result that verifies it.

The chain looks largely the same across U.S. Food and Drug Administration (FDA) and European Union Medical Device Regulation (EU MDR) reviews. Keeping those links current makes the rationale easier to defend.

Common Challenges When Defining Essential Performance

Teams that run the risk process correctly still stumble on recurring problems. Essential performance can sit in supporting functions, connected products, and later design changes.

Overlooking Secondary or Monitoring Functions

Alarm functions can be essential to the performance of devices such as patient monitors, neonatal warmers and incubators, anesthesia delivery systems, dialysis machines, infusion pumps, and ventilators. Raising visual and auditory alarms to alert caregivers is itself a clinical function whose loss can create unacceptable risk. Later editions of IEC 60601-1 expanded the scope to capture performance such as the accuracy of physiological monitoring equipment.

Identification has to cover supporting functions as well as the primary therapeutic one. Otherwise, teams can miss the function that distinguishes safe intervention from delayed response.

Added Complexity in Combination Products

Drug-device combination products can carry a second layer of analysis, because teams need to assess, characterize, and control interactions of the constituent parts in addition to the parts themselves. EPRs for combination products are design input requirements for safe and effective operation, and they’re usually a subset of Critical Quality Attributes (CQAs) in drug Quality by Design language.

Keeping EPRs Current Through Design Changes

Any change to a device’s intended use can change its essential performance, and a predicate device with essential performance can create the expectation that yours will need it too. Alarm system changes sit in the same trap, since teams must assess the significance of removing, adding, or modifying alarm handling. Teams that push alarm changes through routine engineering change orders without an essential performance impact assessment create a documented compliance gap.

Retroactive documentation of changes can become an audit finding. A living essential performance analysis makes those impacts easier to spot before the record falls behind the design.

How Jama Connect Supports Essential Performance Requirements

When EPR artifacts live in disconnected spreadsheets, Jama Connect® can support regulated teams by keeping risk activities such as FMEA and hazard analysis alongside the requirements they trace to. Its medical device framework is aligned to ISO 13485, IEC 62304, ISO 14971, and FDA design controls.

When designs change, Live Traceability™ helps keep requirements, risk records, design outputs, and test evidence connected. If an essential performance limit changes, suspect links flag linked test cases and risk assessments for review before the gap becomes a finding.

Keep Essential Performance Requirements Audit Ready

Changes to standards and design inputs can alter EPRs after release. Intended-use changes can do the same. Teams should keep the hazard-to-requirement-to-test rationale up to date as those inputs evolve.

If your team is still rebuilding traceability before each audit, Jama Connect helps keep requirements, risks, and tests connected in one place. You can see how connected requirements, risks, and tests work together with a free trial of Jama Connect.

Frequently Asked Questions About Essential Performance Requirements

What is the difference between essential performance and basic performance?

Essential performance covers clinical functions that cross the IEC 60601-1 unacceptable-risk threshold. Basic performance is what the device delivers per manufacturer specifications, labeling, public claims, or risk controls, and standardized performance covers requirements published in national or international standards. Teams can document those distinctions in design input requirements to avoid over-declaring or under-declaring EPRs.

Does essential performance apply to in vitro diagnostic devices or standalone software?

IEC 60601-1 does not apply to in vitro diagnostic (IVD) devices or standalone software. IEC 61010-1, its sister standard, is a safety-only standard that doesn’t address essential performance. Embedded software that controls or monitors a device, such as a heart-lung machine’s pump control, can still implement essential performance characteristics and needs linked test cases.

Can a manufacturer treat all functions as essential performance for immunity testing?

Yes. For immunity testing, manufacturers may either identify essential performance with guidance in Annex GGG or consider all functions essential under IEC 60601-1-2. The current edition also requires notifying end users about any expected loss of performance, even when the degradation doesn’t affect basic safety or essential performance.

This article was authored by Tom Rish and published on August 7, 2026.