When bringing a new product to market, much of the focus goes to developing and growing the business as quickly as possible. While managing growth is crucial, there is another important aspect to ensuring the product can achieve sustainable business results. It is managing risk. Although growth and risk sound like completely different aspects, they are actually two sides of the same coin. Managing product risk has a wider scope. And it includes growth.

Launching or repositioning a product comes with risk. This applies whether the product targets a market that the company already operates in or whether the company positions the product in new markets to diversify its offering. Risk management is therefore a crucial job for anyone involved in product development or market expansion.

Managing product risk is like navigating a ship at sea. The direction is set, and the crew works together to reach the destination. However, variables such as wind, rain, fuel, food, ship conditions, and more can unexpectedly change the outcome of the journey. And it is not just a matter of planning for risk upfront. It is also about monitoring and mitigating risks along the journey. Ultimately, it is the management of risk that allows the ship to successfully reach its destination.

The scope of product risk

Product risk management is not a one-off activity. Risk is probabilistic, meaning that it may or may not turn into an actual issue. Moreover, what doesn’t seem like a threat today may very well become one tomorrow. Unfortunately risk doesn’t go away with the tick of a box on a checklist. Managing risk requires a continuous effort spread across the full product lifecycle, with more weight on the first phases, where uncertainty is naturally greater and risk comes from different directions.

Product risk also varies depending on product complexity and industry-specific regulation. Complex products typically have more types of users, more components, and a tightly-integrated architecture. Hence, the probability of functional defects, non-compliance, or users misunderstanding how the product operates increases. This is why product complexity drives up risk. Similarly, highly regulated industries have a wider scope for risk, which is not just a matter of compliance but also the impact of unforeseeable events.

The good news is that managing product risk doesn’t necessarily require a formal, dedicated risk manager role. In fact, those in charge of dealing with product risks are usually product managers, who typically have a wide product view. Nevertheless, product risk is multi-dimensional and product managers are not experts in everything. They instead act as orchestrators, pulling together the right people at the right time to evaluate and control risk. Specialists do the heavy lifting when it comes to implementation

When product risk becomes existential to a company

High-stakes products frequently face strict regulatory constraints, high technical complexity, and multiple stakeholders. These factors make risks interconnected. A failure in one area can cascade across the product and ultimately threaten the entire business.

Consider Pear Therapeutics, a US company that developed a pioneering digital health product: the first FDA-cleared prescription digital therapeutic for substance use disorder. Delivered through a mobile app, it enabled patients to access cognitive behavioral therapy as part of their treatment, without needing to attend every session in person.

There are different interpretations of what led Pear to file for bankruptcy in 2023. One key factor, highlighted in MobiHealthNews, was its difficulty securing insurance reimbursement at scale. Although Pear took regulatory compliance seriously, it faced another critical risk: evidence. Beyond demonstrating clinical effectiveness, the company needed to convince insurers that its products delivered sufficient economic value to justify reimbursement. Despite investing in clinical and health-economic evidence, Pear struggled to secure broad coverage and adoption. This created a direct viability risk: without sufficient reimbursement and revenue, the business model could not sustain the company’s operating costs.

This is not an isolated case. Many digital health products, despite their immense innovative potential, fail to achieve market adoption or even make it to launch. They often fail because they do not identify critical risks early enough to manage them effectively. This pattern frequently applies across other sectors where risk is multi-sided. In these complex domains, bringing an innovation to market requires far more than just sleek technology, user appeal, the right pricing strategy, or a strong distribution model. It requires an active product risk management strategy.

The 7 categories of product risk

As the Pear Therapeutics case shows, healthcare is a high-stakes industry with multi-sided risk. But it is not the only one. Financial services companies are strongly affected by operations risk, as a cyber-attack can destroy a brand instantaneously. Other highly regulated industries such as utilities, telecommunications follow suite. The reality is that no industry is completely immune from product risk. While some industries may be less exposed to some categories of risk, they are still exposed to risk. Marty Cagan from the Product Group points out that the 4 major risks are: desirability, viability, usability and feasibility.

In many cases those four are good enough to deal with the greatest part of product risk. From my experience, high-stakes products require three more risk categories to pay attention to: compliance, evidence, and operations. The following sections describe, one by one, all the seven risk categories.

1. Desirability risk

Desirability, often called value or marketability, is probably the first risk category worth assessing when launching a new product. Indeed, for a product to have a reason to exist, it must create value for a specific market. Value may consists of solving a problem, satisfy a need or help reaching a goal. For complex products with multiple stakeholders, value is not only related to specific segments of users, but to all the stakeholders who have an interest in the product. Assessing desirability, therefore, requires to identify stakeholder groups and map how value is created, or destroyed, for each of them. But what is value actually? Value is not only a measure of cost reduction or revenue generation. Value often includes qualitative benefits, not easily mapped to economics, that makes a product more appealing than others. In B2C, according to research by Bain & Company, there can be 30 (yes, thirty) different elements of value.

2. Viability risk

A close relative of desirability is viability. While managing desirability risk ensures that the product delivers value to users, buyers, and external stakeholders in general, viability assesses whether the product is economically sustainable.

Practically speaking, viability ensures that the product pricing is right and that the overall business case, including production and distribution costs, is sound. This also means considering the entire business model: how the product is positioned in front of potential customers, how it attracts customers to try it, and how it converts non-paying customers into paying ones.

Finally, it is equally important to consider how the product will retain customers and grow its customer base. A product might be viable right after launch, but it may become unviable if the business model does not scale.

3. Feasibility risk

There are multiple ways to solve a problem and provide customers with benefits. Whatever the solution of choice, the product team must ensure that it is technically feasible and implementable. In other words, even if the necessary technology works in general, the company itself must possess the specific capabilities, resources, and engineering skills to apply it to the product.

Feasibility risk is often related to proving that a process, a technology, or even a business model works “as a concept”. Although proving the concept is essential, feasibility goes well beyond a simple proof of concept. While proving that a solution works is essential to secure funding and get everyone enthusiastic, turning a prototype into a working solution that reliably gets the job done in the real world is a completely different story. This is because, in real-world environments conditions are more volatile and less controlled than in the lab.

Finally, building a working solution that satisfies a single customer, is entirely different from building a scalable product that addresses multiple customer constraints across all possible conditions. Put it shortly, a custom solution is not a product.

4. Usability risk

Usability is about ensuring that user can use the product without frustration, confusion and errors. According to the International Standard for Human-Computer Interaction (ISO 9241), usability means three things:

• Effectiveness: Can users complete their tasks accurately and completely?
• Efficiency: How much time, effort, or mental energy does it take to complete that task?
• Satisfaction: How comfortable and positive was the user’s experience while using the system?

When neglecting usability, the consequences go far beyond a dropped user session or a bad product review. They can impact user retention and consequently viability. In high-stake domains like healthcare, finance, and critical infrastructure, poor usability may even threaten user safety.

For B2B products, where buyers are rarely the actual end-users, usability is critical for driving adoption. Why? Because a product can be perfectly compliant and highly valuable from buyers and sponsors. But, if unusable by the actual end-users, its actual deployment can face fierce resistance. This friction inevitably leads to failed implementations and poor long-term adoption. In some industries, it is crucial, therefore, to involve users early on with usability testing.

5. Compliance risk

Compliance is a broad domain that covers everything from hard legal regulations to internal ethical standards. For products in highly regulated industries, such as healthcare and financial services, compliance is typically a top priority. This is because in such domains every aspect of the user journey is subject to strict regulation, and product success is first and foremost tied to regulatory compliance.

But regulatory compliance can also be an opportunity for emerging industries where regulation is currently lighter but likely to increase in the coming years. Examples of such industries are AI infrastructure, biotechnology, unmanned vehicles, and environmental sustainability. In such fields, addressing regulatory compliance reactively can be far more expensive than dealing with it proactively. Therefore, compliance risk management should be properly weighted for almost every product. The actual objective is not to burden the product with excessive rules. Rather, it is to adopt good business practices, industry standards, and self-regulatory frameworks that lower compliance risk.

Ultimately, what is commonly feared as a regulatory risk can actually create a powerful window of competitive advantage. Apple, for example, proactively built stringent data-minimization frameworks directly into iOS. By the time privacy laws caught up, Apple had already captured the market’s trust, turning a compliance constraint into a strong value proposition.

6. Evidence risk

Evidence risk is the danger that a product fails to achieve market trust and adoption because it lacks tangible, verifiable proof of its safety, efficacy, or real-world value.

This type of risk holds high relevance in healthcare and life sciences, where trust is earned through literature analysis, clinical studies, and trials demonstrating safety and efficacy.

However, evidence is equally vital in many other industries. In fact, evidence does not always require statistical proof of functionality or peer-reviewed scientific studies. Instead, it can take the form of customer testimonials, industry endorsements, or pilot programs. This is especially true when a B2B customer needs to justify a massive financial investment. Most of the time, a promise of value is simply not enough without tangible proof. So, running a pilot or showcasing how the product has successfully impacted other clients is a highly effective way to build that commercial trust.

But there is usually a “chicken and egg problem with evidence risk. Early-stage products typically have a short runway and cannot afford to generate exhaustive evidence without paying customers or corporate sponsors. Because of this, onboarding influential early adopters is essential. In healthcare, for example, product teams rely heavily on Key Opinion Leaders (KOLs). These experts derive their authority from peer recognition, deep academic credentials, and proven technical expertise. Securing their backing is essential to gaining the market visibility and credibility required for mainstream adoption.

7. Operations risk

Operations risk is the danger that a product fails due to inadequate internal processes, system vulnerabilities, security breaches, or external dependencies. It covers everything from active cybersecurity threats to long-term technical maintenance and systemic resilience. With advances in artificial intelligence, cybersecurity-related operational risk has increased, as AI can make it easier to identify and exploit vulnerabilities.

Research shows that managing compliance risk can help reduce operational risk. Indeed, regulatory requirements often impose controls on internal processes, security, and system reliability source. However, compliance alone cannot eliminate operations risk, which also comes from technical weaknesses, process failures, and external dependencies.

Operations risk can have consequences that extend far beyond the product itself. For instance, if a product’s core value proposition is to predict and detect industrial equipment failures, a single failure to do so can result in undetected machine breakdowns, halted production lines, and substantial financial losses for the customer. Similarly, if a critical supplier, such as a cloud hosting provider, experiences a prolonged outage, the resulting disruption can affect the product’s availability and bring essential business operations to a halt. Ultimately, managing operational risk means ensuring continuous reliability and preventing internal weaknesses or external dependencies from triggering a wider business crisis.

Beyond risk: dealing with uncertainty

Should you try to eliminate all risks at once? Absolutely not. Depending on the product phase, different types of risks will emerge within each category. This means risk must be prioritized and managed iteratively. Even when you believe a specific risk has been mitigated, reassessing it as the product advances through development and adoption is essential to ensure that “risk creep” doesn’t catch you off guard.

If you manage product risks, is that enough to make the product a winner? In other words, does flawless risk management guarantee a product’s success? Unfortunately, not. While managing risk is essential for success, it is not the only condition. Beyond risk lies uncertainty, which covers a different spectrum of unpredictable events that can cause a product to go sideways. Unlike risk, which can be assessed and mitigated, managing uncertainty is not a matter of prediction. Instead, it is about adaptability and dealing with events on a case-by-case basis. Ultimately, robust risk management builds the stable foundation you need to handle uncertainty through strategic decision-making and day-to-day execution.

Ultimately, managing risk is not enough to guarantee a product’s success. A successful product also requires a strategy for navigating uncertainty and a capable product team that can adapt and make sound decisions as the product evolves.