> iec_62304:2006+amd1:2015
IEC 62304:2006+AMD1:2015
Medical Device Software — Software Life Cycle Processes
IEC 62304 establishes a comprehensive lifecycle framework for medical device software across safety classes A, B, and C. It defines mandatory processes for software development planning, requirements analysis, architectural design, software verification, integration testing, release management, maintenance, and systematic risk management feedback loops.
Scope & Applicability
Applies to the development and maintenance of medical device software when software is itself a medical device (SaMD) or is an embedded component of a medical device.
Non-Coverage Boundaries
Does not cover software validation or the ultimate release-for-distribution decision for the medical device system as a whole, which are governed by ISO 13485 and ISO 14971.
Key Clauses & Control Requirements
Software Development Process
Mandates development planning, requirements analysis, architectural design, detailed design, unit verification, and integration testing.
Software Maintenance Process
Defines controlled procedures for problem resolution, modification evaluation, regression analysis, and release of patches.
Software Risk Management Process
Requires identification of software hazards, traceability of risk control measures into software requirements, and verification of mitigation effectiveness.
Software Configuration Management
Controls source code, build environments, third-party libraries (SOUP), and change documentation to ensure reproducible builds.
Required Regulatory & Audit Evidence Artifacts
- [✓]Software Development Plan (SDP)
- [✓]Software Requirements Specification (SRS) with safety classifications
- [✓]Software Architecture Document (SAD) documenting SOUP segregation
- [✓]Requirements Traceability Matrix (RTM) linking hazard -> requirement -> test -> result
- [✓]Unit and Integration Test Execution Records with code coverage analysis
- [✓]Software Release Record signed by authorized quality and engineering roles
“Do not attempt to separate quality from engineering in medical software. IEC 62304 compliance fails when treated as retrospective documentation rather than automated CI/CD gating.”
Cross-Surface Ecosystem Relationships
- IEC 62304:2006/AMD1:2015 Medical device software ↗(International Electrotechnical Commission)
Frequently Asked Questions
What are the three software safety classes in IEC 62304?
Class A (no injury or damage to health), Class B (non-serious injury possible), and Class C (death or serious injury possible). Higher classes require deeper architectural documentation and unit testing rigor.
How does IEC 62304 treat third-party or open-source software?
Third-party components are classified as Software of Unknown Provenance (SOUP) and require documented functional requirements, known defect analysis, and regression shielding.