IEC 62304: Medical Device Software Lifecycle
IEC 62304 is the international standard that defines the software development and maintenance lifecycle for medical device software, with the required rigor scaled to the software's safety class (A, B, or C).
What it is
IEC 62304 specifies the processes, activities, and tasks a manufacturer must follow when software is itself a medical device or is part of one. It does not prescribe a specific methodology — it works with agile or plan-driven development — but it requires that you plan the work, control it, verify it, and document it in proportion to the harm the software could cause.
Who needs it
Any organization placing software-containing medical devices on the market under FDA or EU MDR rules, plus the development partners who write that software. Regulators expect IEC 62304 evidence as part of a 510(k), De Novo, PMA, or CE technical file.
Key requirements
Software safety classification
Assign Class A, B, or C based on possible harm; the class sets which activities are mandatory.
Development planning
A software development plan covering process, deliverables, and traceability.
Requirements & architecture
Documented software requirements and an architecture that supports risk control.
Verification
Unit, integration, and system-level verification with recorded results traced to requirements.
Risk management
Software risk management integrated with ISO 14971, including risks from SOUP.
SOUP management
Identify, justify, and monitor software of unknown provenance (libraries, RTOS, OS).
Configuration & problem resolution
Version control, change control, and a defined process for handling anomalies.
Safety classes
No injury or damage to health is possible — the lightest process burden.
Non-serious injury is possible — adds detailed design and integration testing.
Death or serious injury is possible — the most rigorous activities and documentation.
How Rapid Circuitry helps
Rapid Circuitry develops medical device firmware to IEC 62304 — classifying the software, defining an architecture that isolates safety-critical functions, managing SOUP such as the RTOS, and producing verification evidence and traceability your quality team can submit.
Frequently asked questions
Is IEC 62304 required by the FDA?
The FDA recognizes IEC 62304 as a consensus standard, and following it is the practical way to satisfy the agency's expectations for software lifecycle processes in a premarket submission. It is mandatory under EU MDR via harmonized standards.
What is SOUP in IEC 62304?
SOUP is 'software of unknown provenance' — software you did not develop to IEC 62304, such as an RTOS, third-party library, or operating system. The standard requires you to identify it, specify its requirements, and manage its risks.
Does IEC 62304 allow agile development?
Yes. IEC 62304 defines required outcomes and documentation, not a methodology, so it can be applied within agile or iterative development as long as the planning, verification, and traceability activities are met.
Designing to IEC 62304?
Our engineers build medical electronics to this standard and produce the evidence your quality and regulatory team needs. Let's talk about your project.
Talk to an engineer