IEC 62304

How it applies

• Safety classes: Class A where no injury or damage to health is possible, class B where non-serious injury is possible, class C where death or serious injury is possible. The class determines which activities and documents are required.
• Processes: Software development planning, requirements, architecture, detailed design, unit implementation and verification, integration, system testing and release; plus maintenance, configuration management and problem resolution. Risk management follows ISO 14971.
• SOUP: Software of unknown provenance, such as open-source libraries or operating systems, must be identified with its version, requirements and known anomalies.
• Scope limit: IEC 62304 covers the software life cycle, not the validation of the whole device. Validation of the medical device software against its intended purpose sits at device level. Security activities are covered by IEC 81001-5-1.
• Status: A new edition is in preparation; check the current status before citing it, and check the current list of harmonized standards.
• Technical documentation: Development plan, requirements, architecture, SOUP list, test records, known residual anomalies and release notes form the software evidence in the technical documentation. Changes after release run through the maintenance process and change control.

IEC 62304 vs. IEC 61508

IEC 61508 is the generic functional safety standard for E/E/PE safety-related systems and assigns Safety Integrity Levels with quantified failure targets. IEC 62304 is specific to medical device software, doesn't quantify failure rates and scales its requirements by the severity of possible harm. A SIL rating says nothing about the IEC 62304 class, and vice versa.

Compared with the USA

The FDA recognizes IEC 62304 as a consensus standard. Its guidance on the content of premarket submissions for device software functions asks for a documentation level (basic or enhanced) based on risk, which is related to but not the same as the IEC 62304 safety class.