Medical standard
IEC 62304: Medical Device Software Lifecycle
IEC 62304 is the international standard for the software development lifecycle of medical device software, scaled to safety class A, B, or C.
What is IEC 62304?
IEC 62304 specifies the processes, activities, and tasks a manufacturer must follow when software is itself a medical device or is part of one. It does not prescribe a specific methodology — it works with agile or plan-driven development — but it requires that you plan the work, control it, verify it, and document it in proportion to the harm the software could cause. The current edition is IEC 62304:2006 + Amendment 1:2015 (FDA-recognised; EN 62304:2006/A1:2015 in the EU). A second edition is in development; its drafts replace safety classes A/B/C with two software process-rigor levels, so check its status before planning a new program against it.
Who needs IEC 62304?
Any organization placing software-containing medical devices on the market under FDA or EU MDR rules, plus the development partners who write that software. The FDA (via its 2023 guidance on the content of premarket submissions for device software functions) and EU notified bodies accept IEC 62304 conformity as the usual way to demonstrate software lifecycle processes in a 510(k), De Novo, PMA or CE technical file.
Key requirements
Software safety classification
Assign Class A, B, or C based on possible harm; the class sets which activities are mandatory.
Development planning
A software development plan covering process, deliverables, and traceability.
Requirements & architecture
Documented software requirements and an architecture that supports risk control.
Verification
Unit, integration, and system-level verification with recorded results traced to requirements.
Risk management
Software risk management integrated with ISO 14971, including risks from SOUP.
SOUP management
Identify, justify, and monitor software of unknown provenance (libraries, RTOS, OS).
Configuration & problem resolution
Version control, change control, and a defined process for handling anomalies.
Safety classes
No injury or damage to health is possible — the lightest process burden.
Non-serious injury is possible — adds software architecture, unit verification and integration testing.
Death or serious injury is possible — adds detailed design of each software unit and additional unit acceptance criteria: the most rigorous activities and documentation.
How Rapid Circuitry helps
Rapid Circuitry develops medical device firmware to IEC 62304 requirements — classifying the software, defining an architecture that isolates safety-critical functions, managing SOUP such as the RTOS, and producing verification evidence and traceability your quality team can submit.
Frequently asked questions
Is IEC 62304 required by the FDA?
The FDA recognizes IEC 62304 as a consensus standard, and following it is the practical way to satisfy the agency's expectations for software lifecycle processes in a premarket submission. Under EU MDR it is not mandatory by name, but Annex I §17.2 requires software to be developed according to the state of the art for the development lifecycle, and EN 62304 is the recognised way to demonstrate that.
What is SOUP in IEC 62304?
SOUP is 'software of unknown provenance' — software you did not develop to IEC 62304, such as an RTOS, third-party library, or operating system. The standard requires you to identify it, specify its requirements, and manage its risks.
Does IEC 62304 allow agile development?
Yes. IEC 62304 defines required outcomes and documentation, not a methodology, so it can be applied within agile or iterative development as long as the planning, verification, and traceability activities are met.