MedTech Terms
    The authoritative reference
    All terms

    Software Safety Classification

    IEC 62304 classes A, B, C reflecting potential harm from software failure.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    Per IEC 62304 clause 4.3, software is assigned to Class A (no injury or damage to health is possible), Class B (non-serious injury is possible), or Class C (death or serious injury is possible) based on the hazardous situation to which the software system can contribute, assuming failure of any external risk controls.
    What the regulation says
    IEC 62304 is the globally recognized standard for medical device software lifecycle processes. It mandates a software safety classification system (Classes A, B, C) based on the potential for the software to contribute to a hazardous situation, influencing the rigor of development, verification, and validation activities. The FDA highlights the importance of hazard analysis in determining appropriate software classification, while the EU MDR emphasizes the general safety and performance requirements that are directly impacted by software classification.

    What this means in practice

    Classification is done at the software system level after the hazard analysis, then propagated to items and units. Amendment 1:2015 allows decomposition so an item can be assigned a lower class than its parent system when there is segregation of concerns with justification. Class B and C add required activities (detailed design, integration testing, verification of software units, unit testing, documented software architecture). Regulators (FDA and Notified Bodies) frequently challenge under-classification, especially when external risk controls are software-based or unproven.

    Examples

    • A radiation therapy dose calculator: Class C (miscalculation could cause serious injury or death).
    • An insulin pump bolus algorithm: Class C.
    • A patient monitor waveform display: Class B (missed alarm could delay clinical response but hardware alarms remain).
    • A cosmetic image-viewer with no clinical claim: Class A.
    Common pitfalls
    • •Claiming Class A because 'a clinician always checks the output' without documenting that check as a validated external risk control in the risk file.
    • •Assigning a class to the whole system when segregation would allow a lower class for isolated items - and losing effort savings.
    • •Not re-classifying after a design change that removes an external risk control (change control gap).
    • •Confusing software safety class with IEC 60601-1 basic safety or with ISO 14971 risk levels - they are separate axes.

    Frequently asked questions

    No. Risk (ISO 14971) is severity times probability of harm. Software safety class (IEC 62304) is severity-only and assumes failure of external risk controls. A device can be low risk overall but Class C in software if the software failure mode is severe.

    Cross-references

    Used by

    Things that build on this term.

    Grouped by theme

    Primary references

    3 sources
    Link health: 2 verified 1 unchecked· last checked 2026-06-20
    ISO·1FDA·1MDCG·1
    1. 1
      IEC 62304:2006/AMD1:2015
      Verified
      ISOiso.org
    2. 2
      FDA Content of Premarket Submissions for Device Software Functions (2023)
      Unchecked
      FDAfda.gov
    3. 3
      MDCG Software Guidance
      Verified
      MDCGhealth.ec.europa.eu

    Inline markers like [1] jump to the matching reference above.