--- title: "IEC 62304, Definition | MedTech Terms" description: "Lifecycle requirements for medical device software. Plain-English Standards definition for MedTech teams, with examples and related terms." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-62304#term", "name": "IEC 62304", "description": "IEC 62304:2006 (with Amendment 1:2015) defines the lifecycle requirements for medical device software, including software development planning, requirements analysis, architectural design, implementation, integration, testing, release, and maintenance - scaled by software safety classification (Class A, B, C).", "url": "https://medtechterms.com/terms/iec-62304", "termCode": "iec-62304", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/iec-62304#article", "headline": "IEC 62304", "description": "Lifecycle requirements for medical device software.", "url": "https://medtechterms.com/terms/iec-62304", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/iec-62304" }, "about": { "@id": "https://medtechterms.com/terms/iec-62304#term" }, "articleSection": "Standards", "inLanguage": "en", "keywords": "IEC 62304, Standards, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "IEC 62304:2006/AMD1:2015", "url": "https://www.iso.org/standard/64686.html", "publisher": { "@type": "Organization", "name": "ISO" } }, { "@type": "CreativeWork", "name": "FDA Recognized Consensus Standards", "url": "https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfstandards/search.cfm", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "IEC Webstore - Medical Equipment", "url": "https://webstore.iec.ch/searchform&q=medical", "publisher": { "@type": "Organization", "name": "IEC" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/samd#term", "name": "Software as a Medical Device", "alternateName": "SaMD", "url": "https://medtechterms.com/terms/samd" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/soup#term", "name": "Software of Unknown Provenance", "alternateName": "SOUP", "url": "https://medtechterms.com/terms/soup" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/software-safety-class#term", "name": "Software Safety Classification", "url": "https://medtechterms.com/terms/software-safety-class" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-81001-5-1#term", "name": "IEC 81001-5-1", "url": "https://medtechterms.com/terms/iec-81001-5-1" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iso-14971#term", "name": "ISO 14971", "url": "https://medtechterms.com/terms/iso-14971" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Standards", "item": "https://medtechterms.com/terms?cat=Standards" }, { "@type": "ListItem", "position": 4, "name": "IEC 62304", "item": "https://medtechterms.com/terms/iec-62304" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/iec-62304#faq", "mainEntity": [ { "@type": "Question", "name": "What are IEC 62304 software safety classes?", "acceptedAnswer": { "@type": "Answer", "text": "Class A: no injury or damage to health is possible. Class B: non-serious injury is possible. Class C: death or serious injury is possible. The class is set based on the hazard analysis and may be reduced by external risk controls (hardware safeguards, alarms, procedural controls)." } }, { "@type": "Question", "name": "Is IEC 62304 mandatory?", "acceptedAnswer": { "@type": "Answer", "text": "IEC 62304 itself is a consensus standard, but FDA recognizes it and EU MDR treats it as harmonized. In practice, complying with IEC 62304 is the accepted route to demonstrating adequate software lifecycle processes in both regions." } }, { "@type": "Question", "name": "What is SOUP under IEC 62304?", "acceptedAnswer": { "@type": "Answer", "text": "Software of Unknown Provenance is software not developed for the purpose of being incorporated into the medical device (e.g. open-source libraries, third-party components, RTOS). Manufacturers must identify SOUP, specify requirements for it, and evaluate anomalies affecting the device." } }, { "@type": "Question", "name": "How does IEC 62304 relate to IEC 81001-5-1?", "acceptedAnswer": { "@type": "Answer", "text": "IEC 81001-5-1 extends IEC 62304 with security activities across the software lifecycle. FDA cites 81001-5-1 as a way to satisfy Section 524B secure product development expectations." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Standards](/terms?cat=Standards) 6. / 7. IEC 62304 [All terms](/terms) Standards [Software Lifecycle](/ecosystems/software-lifecycle)[Quality System](/ecosystems/quality-system) # IEC 62304 Lifecycle requirements for medical device software. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition IEC 62304:2006 (with Amendment 1:2015) defines the lifecycle requirements for medical device software, including software development planning, requirements analysis, architectural design, implementation, integration, testing, release, and maintenance - scaled by [software safety classification](/terms/software-safety-class) (Class A, B, C). ## What this means in practice IEC 62304 is a recognized consensus standard by FDA and a harmonized standard under EU [MDR](/terms/mdr-reporting). It is foundational for [SaMD](/terms/samd) and software-containing devices. The standard scales its expectations by software safety class: Class A (no injury possible) requires the lightest process, Class B (non-serious injury) adds detailed design and integration testing, and Class C (death or serious injury) adds unit testing, more rigorous architecture, and stronger [SOUP](/terms/soup) controls. ## Examples - A Class C infusion pump control application with unit tests, formal architectural design records, and full SOUP evaluation for the RTOS and TLS stack. - A Class B mobile SaMD dose calculator with documented software requirements, integration tests, and a maintained anomaly list. ## Use cases 1 scenario 1 ### Legacy infusion pump firmware refresh Software lead A team refactoring 10-year-old C firmware classifies the safety class as C, retrofits a software development plan, traces requirements to unit tests, and documents [SOUP](/terms/soup) for the RTOS and TCP/IP stack. Outcome The refresh ships with full IEC 62304 evidence, satisfying both 510(k) reviewers and an EU [MDR](/terms/mdr-reporting) [notified body](/terms/notified-body). Common pitfalls - • Under-classifying software to avoid Class C obligations. Auditors and reviewers actively challenge classifications that do not align with the device's hazard analysis. - • Skipping SOUP (Software of Unknown Provenance) requirements for open-source libraries and third-party components. - • Treating IEC 62304 as an alternative to ISO 14971. It complements risk management; it does not replace it. - • Losing traceability between software requirements, architecture items, unit tests, and integration tests. ## Frequently asked questions What are IEC 62304 software safety classes? Class A: no injury or damage to health is possible. Class B: non-serious injury is possible. Class C: death or serious injury is possible. The class is set based on the hazard analysis and may be reduced by external risk controls (hardware safeguards, alarms, procedural controls). Is IEC 62304 mandatory? What is SOUP under IEC 62304? How does IEC 62304 relate to IEC 81001-5-1? ## Cross-references ### Governs Things this term applies rules or requirements to. - [ Software as a Medical Device(SaMD) ](/terms/samd) - [ Software in a Medical Device(SiMD) ](/terms/simd) ### Uses Concepts or artefacts this term builds on. - [ Software Safety Classification ](/terms/software-safety-class) - [ Software of Unknown Provenance(SOUP) ](/terms/soup) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Software & AI Software Safety Classification IEC 62304 classes A, B, C reflecting potential harm from software failure. ](/terms/software-safety-class)[ Software & AI Software as a Medical Device(SaMD) Software intended for medical purposes that performs without being part of a hardware device. ](/terms/samd)[ Software & AI Software of Unknown Provenance(SOUP) Software not developed for medical device use, or lacking adequate development records, incorporated into a device. ](/terms/soup)[ Standards ISO 14971 International standard for the application of risk management to medical devices. ](/terms/iso-14971) ### SaMD & AI/ML Devices · From this learning path [ Software & AI Software in a Medical Device(SiMD) Software embedded in or required to operate a hardware medical device. Adjacent lesson ](/terms/simd?from=samd-and-ai)[ Software & AI Clinical Decision Support(CDS) Software providing healthcare professionals with knowledge and patient-specific information. ](/terms/cds?from=samd-and-ai)[ Software & AI Predetermined Change Control Plan(PCCP) FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices. ](/terms/ai-ml-pccp?from=samd-and-ai)[ Software & AI Good Machine Learning Practice(GMLP) Guiding principles for the development of AI/ML-enabled medical devices. ](/terms/good-machine-learning-practice?from=samd-and-ai) ### Standards Stack for Medical Devices · From this learning path [ Cybersecurity IEC 81001-5-1 International standard defining secure-product-lifecycle activities for health software, including medical devices. ](/terms/iec-81001-5-1?from=standards-stack)[ Standards IEC 60601-1-2 EMC requirements for medical electrical equipment. Adjacent lesson ](/terms/iec-60601-1-2?from=standards-stack)[ Standards IEC 62366-1 Application of usability engineering to medical devices. Adjacent lesson ](/terms/iec-62366-1?from=standards-stack)[ Standards IEC 60601-1 General requirements for basic safety and essential performance of medical electrical equipment. ](/terms/iec-60601-1?from=standards-stack) ### Software Team Onboarding · From this learning path [ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b?from=software-team-onboarding)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf?from=software-team-onboarding)[ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. ](/terms/sbom?from=software-team-onboarding)[ Cybersecurity Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. ](/terms/threat-modeling?from=software-team-onboarding) Cited by Where this term appears across MedTech Terms. Learning paths (3) - [SaMD & AI/ML Devices](/paths/samd-and-ai)Lesson 3 of 9 - [Standards Stack for Medical Devices](/paths/standards-stack)Lesson 5 of 10 - [Software Team Onboarding](/paths/software-team-onboarding)Lesson 3 of 12 Ecosystems (2) - [Software Lifecycle](/ecosystems/software-lifecycle) - [Quality System](/ecosystems/quality-system) Comparisons (1) - [IEC 62304 vs ISO 14971](/compare/iec-62304-vs-iso-14971)vs ISO 14971 ## Primary references 3 sources Link health: 2 verified 1 unchecked · last checked 2026-06-20 ISO· 1 FDA· 1 IEC· 1 1. [1 IEC 62304:2006/AMD1:2015 Verified ISO · iso.org ](https://www.iso.org/standard/64686.html) 2. [2 FDA Recognized Consensus Standards Unchecked FDA · accessdata.fda.gov ](https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfstandards/search.cfm) 3. [3 IEC Webstore - Medical Equipment Verified IEC · webstore.iec.ch ](https://webstore.iec.ch/searchform&q=medical) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Implementing this standard on a device program? Blue Goat Cyber helps MedTech teams operationalize cybersecurity standards across the design and post-market lifecycle. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Standards Sources 3 Use cases 1 Updated 5/5/2026 [Compare with another term](/compare?a=iec-62304) Learn in 60 seconds Card Lesson Quiz Lifecycle requirements for medical device software. - · IEC 62304 is a recognized consensus standard by FDA and a harmonized standard under EU MDR. - · It is foundational for SaMD and software-containing devices. Remember this Watch out: Under-classifying software to avoid Class C obligations. Auditors and reviewers actively challenge classifications that do not align with the device's hazard analysis. Related terms - [Software as a Medical Device(SaMD) ](/terms/samd) - [Software of Unknown Provenance(SOUP) ](/terms/soup) - [Software Safety Classification ](/terms/software-safety-class) - [IEC 81001-5-1 ](/terms/iec-81001-5-1) - [ISO 14971 ](/terms/iso-14971) You may also need Auto-suggested from Standards and shared keywords. - [AAMI TIR45(TIR45) ](/terms/aami-tir45) - [Software Maintenance Plan ](/terms/software-maintenance-plan) - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [IEC 82304-1 ](/terms/iec-82304-1) - [ISO 11135 ](/terms/iso-11135) - [Clinical Evaluation Plan(CEP) ](/terms/clinical-evaluation-plan) [All Standards terms](/terms?cat=Standards) From the Blue Goat network Related resources and services on this topic. - [ AI SaMD Insights How AI is changing SaMD - risk, regulation, and good machine-learning practice. ](https://ai-samd.com) - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)