Is IEC 62304 mandatory?

IEC 62304 itself is a consensus standard, but FDA recognizes it and EU MDR treats it as harmonized. In practice, complying with IEC 62304 is the accepted route to demonstrating adequate software lifecycle processes in both regions.

What is SOUP under IEC 62304?

Software of Unknown Provenance is software not developed for the purpose of being incorporated into the medical device (e.g. open-source libraries, third-party components, RTOS). Manufacturers must identify SOUP, specify requirements for it, and evaluate anomalies affecting the device.

How does IEC 62304 relate to IEC 81001-5-1?

IEC 81001-5-1 extends IEC 62304 with security activities across the software lifecycle. FDA cites 81001-5-1 as a way to satisfy Section 524B secure product development expectations.

All terms

StandardsSoftware Lifecycle Quality System

IEC 62304

Lifecycle requirements for medical device software.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

Definition

IEC 62304:2006 (with Amendment 1:2015) defines the lifecycle requirements for medical device software, including software development planning, requirements analysis, architectural design, implementation, integration, testing, release, and maintenance - scaled by software safety classification (Class A, B, C).

What this means in practice

IEC 62304 is a recognized consensus standard by FDA and a harmonized standard under EU MDR. It is foundational for SaMD and software-containing devices. The standard scales its expectations by software safety class: Class A (no injury possible) requires the lightest process, Class B (non-serious injury) adds detailed design and integration testing, and Class C (death or serious injury) adds unit testing, more rigorous architecture, and stronger SOUP controls.

Examples

A Class C infusion pump control application with unit tests, formal architectural design records, and full SOUP evaluation for the RTOS and TLS stack.
A Class B mobile SaMD dose calculator with documented software requirements, integration tests, and a maintained anomaly list.

Use cases

1 scenario

Legacy infusion pump firmware refresh

Software lead

A team refactoring 10-year-old C firmware classifies the safety class as C, retrofits a software development plan, traces requirements to unit tests, and documents SOUP for the RTOS and TCP/IP stack.

OutcomeThe refresh ships with full IEC 62304 evidence, satisfying both 510(k) reviewers and an EU MDR notified body.

Common pitfalls

•Under-classifying software to avoid Class C obligations. Auditors and reviewers actively challenge classifications that do not align with the device's hazard analysis.
•Skipping SOUP (Software of Unknown Provenance) requirements for open-source libraries and third-party components.
•Treating IEC 62304 as an alternative to ISO 14971. It complements risk management; it does not replace it.
•Losing traceability between software requirements, architecture items, unit tests, and integration tests.

Frequently asked questions

Class A: no injury or damage to health is possible. Class B: non-serious injury is possible. Class C: death or serious injury is possible. The class is set based on the hazard analysis and may be reduced by external risk controls (hardware safeguards, alarms, procedural controls).

Cross-references

Governs

Things this term applies rules or requirements to.

Uses

Concepts or artefacts this term builds on.

Shared paths + category

Software & AI

Software Safety Classification

IEC 62304 classes A, B, C reflecting potential harm from software failure.

SaMD & AI/ML Devices · adjacentSoftware Team Onboarding · adjacent

Software & AI

Software as a Medical Device(SaMD)

Software intended for medical purposes that performs without being part of a hardware device.

SaMD & AI/ML DevicesSoftware Team Onboarding

Software & AI

Software of Unknown Provenance(SOUP)

Software not developed for medical device use, or lacking adequate development records, incorporated into a device.

SaMD & AI/ML DevicesSoftware Team Onboarding

Standards

ISO 14971

International standard for the application of risk management to medical devices.

Standards Stack for Medical Devices

Cybersecurity

IEC 81001-5-1

International standard defining secure-product-lifecycle activities for health software, including medical devices.

Standards Stack for Medical Devices

Software & AI

Software in a Medical Device(SiMD)

Software embedded in or required to operate a hardware medical device.

SaMD & AI/ML Devices · adjacentSoftware Team Onboarding · adjacent

Latest in MedTech

Primary references

3 sources

Link health: 2 verified 1 unchecked· last checked 2026-06-20

ISO·1FDA·1IEC·1

Inline markers like [1] jump to the matching reference above.

On this term

Category: Standards
Sources: 3
Use cases: 1
Updated: 5/5/2026

Compare with another term

Learn in 60 seconds

Lifecycle requirements for medical device software.

·IEC 62304 is a recognized consensus standard by FDA and a harmonized standard under EU MDR.
·It is foundational for SaMD and software-containing devices.

Remember this

Watch out: Under-classifying software to avoid Class C obligations. Auditors and reviewers actively challenge classifications that do not align with the device's hazard analysis.

Related terms

You may also need

Auto-suggested from Standards and shared keywords.

All Standards terms

From the Blue Goat network

Related resources and services on this topic.