--- title: "IEC 62304 vs ISO 14971 - side-by-side comparison | MedTech Terms" description: "Software lifecycle standard vs medical device risk management standard" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "WebPage", "@id": "https://medtechterms.com/compare/iec-62304-vs-iso-14971", "name": "IEC 62304 vs ISO 14971 - MedTech Terms", "description": "Software lifecycle standard vs medical device risk management standard", "url": "https://medtechterms.com/compare/iec-62304-vs-iso-14971", "about": [ { "@type": "DefinedTerm", "name": "IEC 62304", "url": "https://medtechterms.com/terms/iec-62304" }, { "@type": "DefinedTerm", "name": "ISO 14971", "url": "https://medtechterms.com/terms/iso-14971" } ], "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" } }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Compare", "item": "https://medtechterms.com/compare" }, { "@type": "ListItem", "position": 3, "name": "IEC 62304 vs ISO 14971", "item": "https://medtechterms.com/compare/iec-62304-vs-iso-14971" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/compare/iec-62304-vs-iso-14971#faq", "mainEntity": [ { "@type": "Question", "name": "Can I use IEC 62304 without ISO 14971?", "acceptedAnswer": { "@type": "Answer", "text": "No. IEC 62304 explicitly requires a risk management process compliant with ISO 14971. The software safety class, the single biggest driver of required activities, cannot be assigned without a hazard analysis from ISO 14971." } }, { "@type": "Question", "name": "Does ISO 14971 require IEC 62304?", "acceptedAnswer": { "@type": "Answer", "text": "Not directly. ISO 14971 is technology-agnostic. But when the device contains software, IEC 62304 is the accepted way to demonstrate that software-related risk controls have been designed, verified, and maintained rigorously enough for the assigned safety class." } }, { "@type": "Question", "name": "How do these standards relate to FDA cybersecurity expectations?", "acceptedAnswer": { "@type": "Answer", "text": "FDA's premarket cybersecurity guidance and Section 524B expect a Secure Product Development Framework (SPDF) that layers on top of IEC 62304 and feeds ISO 14971. Cybersecurity threats are treated as hazards under 14971, and cybersecurity controls are software risk controls under 62304." } }, { "@type": "Question", "name": "What are IEC 62304 software safety classes?", "acceptedAnswer": { "@type": "Answer", "text": "Class A: no injury or damage to health is possible. Class B: non-serious injury is possible. Class C: death or serious injury is possible. The class is set based on the hazard analysis and may be reduced by external risk controls (hardware safeguards, alarms, procedural controls)." } }, { "@type": "Question", "name": "Is IEC 62304 mandatory?", "acceptedAnswer": { "@type": "Answer", "text": "IEC 62304 itself is a consensus standard, but FDA recognizes it and EU MDR treats it as harmonized. In practice, complying with IEC 62304 is the accepted route to demonstrating adequate software lifecycle processes in both regions." } }, { "@type": "Question", "name": "What is SOUP under IEC 62304?", "acceptedAnswer": { "@type": "Answer", "text": "Software of Unknown Provenance is software not developed for the purpose of being incorporated into the medical device (e.g. open-source libraries, third-party components, RTOS). Manufacturers must identify SOUP, specify requirements for it, and evaluate anomalies affecting the device." } }, { "@type": "Question", "name": "How does IEC 62304 relate to IEC 81001-5-1?", "acceptedAnswer": { "@type": "Answer", "text": "IEC 81001-5-1 extends IEC 62304 with security activities across the software lifecycle. FDA cites 81001-5-1 as a way to satisfy Section 524B secure product development expectations." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About [All comparisons](/compare) Compare # IEC 62304 vs ISO 14971 Software lifecycle standard vs medical device risk management standard IEC 62304 and ISO 14971 are the two standards regulators expect on every software-containing medical device, and they are frequently confused. ISO 14971 is the risk management standard for the whole device. IEC 62304 is the software lifecycle standard for the software item inside it. They are complementary: 14971 drives what risks matter, 62304 drives how the software is built, verified, and maintained to control those risks. Attribute Standards [IEC 62304](/terms/iec-62304) Standards [ISO 14971](/terms/iso-14971) Full title IEC 62304, Medical device software, Software life cycle processes ISO 14971, Medical devices, Application of risk management to medical devices Scope Software items: design, development, integration, verification, and maintenance of software The entire medical device across its lifecycle, from concept through post-production Applies to SaMD and SiMD, any software that is itself a medical device or contained in one All medical devices, whether or not they contain software Core concept Software safety class (A, B, C) based on hazard severity, driving process rigor Risk = probability x severity, controlled to reduce residual risk to acceptable levels Classification output Class A (no injury), Class B (non-serious injury), Class C (serious injury or death) Risk levels defined by the manufacturer's risk acceptability policy; hazards, hazardous situations, harms Key deliverables Software development plan, software requirements, architecture, unit and integration test records, SOUP list, problem resolution records Risk management plan, hazard analysis, risk evaluation, risk control measures, risk management file, risk management report Relationship to the other standard Uses the risk analysis from ISO 14971 as input to determine software safety class Cites IEC 62304 as an acceptable process for software risk control Post-market obligations Problem resolution, change control, SOUP anomaly monitoring across the maintenance process Post-production information review, feedback into risk file, benefit-risk re-evaluation Regulatory recognition FDA recognized consensus standard; harmonized to EU MDR and IVDR FDA recognized consensus standard; harmonized to EU MDR and IVDR; adopted globally Most recent revision IEC 62304:2006 + Amd 1:2015 (Ed. 2 under development) ISO 14971:2019 (accompanied by ISO/TR 24971:2020 guidance) Common misuse Applying Class C process rigor to a Class A utility feature, or skipping SOUP evaluation Treating risk management as a one-time premarket exercise instead of a lifecycle activity ## When to use which Choose IEC 62304 Apply IEC 62304 to decide how rigorously to build the software: which processes are required, which documents are needed, and how strict verification and change control must be. Software safety class flows from the ISO 14971 risk analysis. [Full IEC 62304 page](/terms/iec-62304) Choose ISO 14971 Apply ISO 14971 first, at the device level. It identifies hazards, evaluates risks, defines risk control measures, and sets acceptability criteria. Its outputs feed IEC 62304 (software), IEC 60601-1 (electrical safety), and IEC 62366-1 (usability). [Full ISO 14971 page](/terms/iso-14971) ## Frequently asked questions Can I use IEC 62304 without ISO 14971? No. [IEC 62304](/terms/iec-62304) explicitly requires a risk management process compliant with [ISO 14971](/terms/iso-14971). The software safety class, the single biggest driver of required activities, cannot be assigned without a hazard analysis from ISO 14971. Does ISO 14971 require IEC 62304? How do these standards relate to FDA cybersecurity expectations? What are IEC 62304 software safety classes? Is IEC 62304 mandatory? What is SOUP under IEC 62304? How does IEC 62304 relate to IEC 81001-5-1? Comparison built from the sourced definitions and FAQs on the linked term pages. MedTech Terms is a vendor-neutral community resource sponsored by Blue Goat Cyber. Definitions are written for educational use and are not legal or regulatory advice. MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)