--- title: "Software Safety Classification, Definition | MedTech Terms" description: "IEC 62304 classes A, B, C reflecting potential harm from software failure. Plain-English Software & AI definition for MedTech teams, with examples and related t" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/software-safety-class#term", "name": "Software Safety Classification", "description": "Per IEC 62304 clause 4.3, software is assigned to Class A (no injury or damage to health is possible), Class B (non-serious injury is possible), or Class C (death or serious injury is possible) based on the hazardous situation to which the software system can contribute, assuming failure of any external risk controls.", "url": "https://medtechterms.com/terms/software-safety-class", "termCode": "software-safety-class", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/software-safety-class#article", "headline": "Software Safety Classification", "description": "IEC 62304 classes A, B, C reflecting potential harm from software failure.", "url": "https://medtechterms.com/terms/software-safety-class", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/software-safety-class" }, "about": { "@id": "https://medtechterms.com/terms/software-safety-class#term" }, "articleSection": "Software & AI", "inLanguage": "en", "keywords": "Software Safety Classification, Software & AI, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "IEC 62304:2006/AMD1:2015", "url": "https://www.iso.org/standard/64686.html", "publisher": { "@type": "Organization", "name": "ISO" } }, { "@type": "CreativeWork", "name": "FDA Content of Premarket Submissions for Device Software Functions (2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/content-premarket-submissions-device-software-functions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "MDCG Software Guidance", "url": "https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en", "publisher": { "@type": "Organization", "name": "MDCG" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-62304#term", "name": "IEC 62304", "url": "https://medtechterms.com/terms/iec-62304" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iso-14971#term", "name": "ISO 14971", "url": "https://medtechterms.com/terms/iso-14971" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/risk-management-file#term", "name": "Risk Management File", "alternateName": "RMF", "url": "https://medtechterms.com/terms/risk-management-file" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Software & AI", "item": "https://medtechterms.com/terms?cat=Software%20%26%20AI" }, { "@type": "ListItem", "position": 4, "name": "Software Safety Classification", "item": "https://medtechterms.com/terms/software-safety-class" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/software-safety-class#faq", "mainEntity": [ { "@type": "Question", "name": "Is software safety classification the same as risk level?", "acceptedAnswer": { "@type": "Answer", "text": "No. Risk (ISO 14971) is severity times probability of harm. Software safety class (IEC 62304) is severity-only and assumes failure of external risk controls. A device can be low risk overall but Class C in software if the software failure mode is severe." } }, { "@type": "Question", "name": "Can I lower a class using external risk controls?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, if the external control is not implemented in the same software item and its effectiveness is documented. A hardware watchdog or an independent hardware limit is a common example." } }, { "@type": "Question", "name": "Does FDA accept IEC 62304 classification?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. FDA recognizes IEC 62304 and its amendments. The Level of Concern concept in the 2005 Premarket Software guidance was largely replaced by the 2023 Content of Premarket Submissions for Device Software Functions guidance, which uses Basic vs Enhanced documentation instead." } }, { "@type": "Question", "name": "How do I document classification?", "acceptedAnswer": { "@type": "Answer", "text": "In the software development plan and the software architecture, with a rationale linked to the hazard analysis and any external risk controls relied upon." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Software & AI](/terms?cat=Software%20%26%20AI) 6. / 7. Software Safety Classification [All terms](/terms) Software & AI [Software Lifecycle](/ecosystems/software-lifecycle)[Startup Lifecycle](/ecosystems/startup-lifecycle) # Software Safety Classification IEC 62304 classes A, B, C reflecting potential harm from software failure. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Per [IEC 62304](/terms/iec-62304) clause 4.3, software is assigned to Class A (no injury or damage to health is possible), Class B (non-serious injury is possible), or Class C (death or serious injury is possible) based on the hazardous situation to which the software system can contribute, assuming failure of any external risk controls. What the regulation says [IEC 62304](/terms/iec-62304) is the globally recognized standard for medical device software lifecycle processes. It mandates a software safety classification system (Classes A, B, C) based on the potential for the software to contribute to a hazardous situation, influencing the rigor of development, verification, and validation activities. The FDA highlights the importance of hazard analysis in determining appropriate software classification, while the EU [MDR](/terms/mdr-reporting) emphasizes the [general safety and performance requirements](/terms/gspr) that are directly impacted by software classification. ## What this means in practice Classification is done at the software system level after the hazard analysis, then propagated to items and units. Amendment 1:2015 allows decomposition so an item can be assigned a lower class than its parent system when there is segregation of concerns with justification. Class B and C add required activities (detailed design, integration testing, verification of software units, unit testing, documented software architecture). Regulators (FDA and Notified Bodies) frequently challenge under-classification, especially when external risk controls are software-based or unproven. ## Examples - A radiation therapy dose calculator: Class C (miscalculation could cause serious injury or death). - An insulin pump bolus algorithm: Class C. - A patient monitor waveform display: Class B (missed alarm could delay clinical response but hardware alarms remain). - A cosmetic image-viewer with no clinical claim: Class A. Common pitfalls - • Claiming Class A because 'a clinician always checks the output' without documenting that check as a validated external risk control in the risk file. - • Assigning a class to the whole system when segregation would allow a lower class for isolated items - and losing effort savings. - • Not re-classifying after a design change that removes an external risk control (change control gap). - • Confusing software safety class with IEC 60601-1 basic safety or with ISO 14971 risk levels - they are separate axes. ## Frequently asked questions Is software safety classification the same as risk level? No. Risk ( [ISO 14971](/terms/iso-14971)) is severity times probability of harm. Software safety class ( [IEC 62304](/terms/iec-62304)) is severity-only and assumes failure of external risk controls. A device can be low risk overall but Class C in software if the software failure mode is severe. Can I lower a class using external risk controls? Does FDA accept IEC 62304 classification? How do I document classification? ## Cross-references ### Used by Things that build on this term. - [ IEC 62304 ](/terms/iec-62304) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Standards IEC 62304 Lifecycle requirements for medical device software. ](/terms/iec-62304)[ Standards ISO 14971 International standard for the application of risk management to medical devices. ](/terms/iso-14971)[ Quality & Risk Risk Management File(RMF) Set of records and outputs from the ISO 14971 risk management process. ](/terms/risk-management-file) ### SaMD & AI/ML Devices · From this learning path [ Software & AI Software of Unknown Provenance(SOUP) Software not developed for medical device use, or lacking adequate development records, incorporated into a device. Adjacent lesson ](/terms/soup?from=samd-and-ai)[ Software & AI Clinical Decision Support(CDS) Software providing healthcare professionals with knowledge and patient-specific information. ](/terms/cds?from=samd-and-ai)[ Software & AI Predetermined Change Control Plan(PCCP) FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices. ](/terms/ai-ml-pccp?from=samd-and-ai)[ Software & AI Software as a Medical Device(SaMD) Software intended for medical purposes that performs without being part of a hardware device. ](/terms/samd?from=samd-and-ai) ### Software Team Onboarding · From this learning path [ Software & AI Software in a Medical Device(SiMD) Software embedded in or required to operate a hardware medical device. ](/terms/simd?from=software-team-onboarding)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b?from=software-team-onboarding)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf?from=software-team-onboarding)[ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. ](/terms/sbom?from=software-team-onboarding) Cited by Where this term appears across MedTech Terms. Learning paths (2) - [SaMD & AI/ML Devices](/paths/samd-and-ai)Lesson 4 of 9 - [Software Team Onboarding](/paths/software-team-onboarding)Lesson 4 of 12 Ecosystems (2) - [Software Lifecycle](/ecosystems/software-lifecycle) - [Startup Lifecycle](/ecosystems/startup-lifecycle) ## Primary references 3 sources Link health: 2 verified 1 unchecked · last checked 2026-06-20 ISO· 1 FDA· 1 MDCG· 1 1. [1 IEC 62304:2006/AMD1:2015 Verified ISO · iso.org ](https://www.iso.org/standard/64686.html) 2. [2 FDA Content of Premarket Submissions for Device Software Functions (2023) Unchecked FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/content-premarket-submissions-device-software-functions) 3. [3 MDCG Software Guidance Verified MDCG · health.ec.europa.eu ](https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Building software-as-a-medical-device? We help SaMD and AI/ML device teams meet IEC 62304 and the FDA's evolving expectations for software cybersecurity. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Software & AI Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=software-safety-class) Learn in 60 seconds Card Lesson Quiz IEC 62304 classes A, B, C reflecting potential harm from software failure. - · Classification is done at the software system level after the hazard analysis, then propagated to items and units. - · Amendment 1:2015 allows decomposition so an item can be assigned a lower class than its parent system when there is segregation of concerns with justification. - · Class B and C add required activities (detailed design, integration testing, verification of software units, unit testing, documented software architecture). Remember this Watch out: Claiming Class A because 'a clinician always checks the output' without documenting that check as a validated external risk control in the risk file. Related terms - [IEC 62304 ](/terms/iec-62304) - [ISO 14971 ](/terms/iso-14971) - [Risk Management File(RMF) ](/terms/risk-management-file) You may also need Auto-suggested from Software & AI and shared keywords. - [Hazard, Hazardous Situation, and Harm ](/terms/hazard-vs-harm) - [FDA Recall Classifications I, II, III ](/terms/recall-classifications) - [Class III Device ](/terms/class-iii) - [IVDR Risk Classes A–D ](/terms/ivdr-classes) - [Unanticipated Adverse Device Effect(UADE) ](/terms/uade) - [MLOps for Medical Devices(MLOps) ](/terms/mlops-medical-device) [All Software & AI terms](/terms?cat=Software%20%26%20AI) From the Blue Goat network Related resources and services on this topic. - [ AI SaMD Insights How AI is changing SaMD - risk, regulation, and good machine-learning practice. ](https://ai-samd.com) - [ Med Device Cyber Podcast Conversations with medical device cybersecurity practitioners. ](https://mdcpodcast.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)