IEC 62304

IEC 62304
Title	IEC 62304
Type	International standard
First published	2006
Latest revision	2015 (amendment 1)
Publisher	International Electrotechnical Commission
Scope	Software life cycle processes for medical device software

IEC 62304 IEC 62304 is an international standard specifying life cycle requirements for the development and maintenance of medical device software. It defines processes, activities, and tasks that provide a framework for safe design and risk management of software used in medical devices, aligning with regulatory expectations across jurisdictions.

Scope and Purpose

The standard addresses the software life cycle for standalone Microsoft Windows-hosted applications, embedded firmware used with Siemens hardware, and cloud-hosted services like those provided by Amazon Web Services or Google Cloud Platform when used in medical contexts. Its purpose is similar to objectives found in ISO 13485 and complements directives such as the Medical Device Regulation and statutes enforced by agencies like the Food and Drug Administration and the European Commission. The scope extends to software that may be part of devices produced by firms like Medtronic, Johnson & Johnson, or General Electric Healthcare, and interfaces with systems from vendors like Philips and Boston Scientific. It is intended for use by manufacturers, notified bodies such as TÜV SÜD and BSI Group, and conformity assessors involved with standards including IEC 60601 and ISO 14971.

Structure and Content of the Standard

IEC 62304 is organized into sections that define process requirements and guidance similar in role to sections in ISO 9001 and parts of IEC 61508. It includes normative requirements and informative annexes, paralleling structural approaches used in publications by the International Organization for Standardization and the International Electrotechnical Commission. Major clauses cover processes for software development, software maintenance, software risk management, configuration management, problem resolution, and software verification and validation—comparable to workflow delineations used by organizations such as IEEE and SAE International. The structure facilitates integration with quality management systems maintained by firms like Abbott Laboratories and Roche.

Software Safety Classification and Risk Management

The standard mandates classification of software items by safety/classes frequently compared to classification schemes used in ISO 14971 and risk matrices applied by manufacturers including Baxter International and Stryker Corporation. Software safety classes influence required rigor for development, testing, and documentation similar to the way IEC 61508 assigns integrity levels to systems used by industrial firms like Schneider Electric. Risk management must be coordinated with clinical risk assessments akin to processes employed by Mayo Clinic and Cleveland Clinic during device adoption, and should align with regulatory reporting obligations observed by companies such as Medtronic and Philips. Traceability from hazards to mitigations and verification activities is required, a practice familiar from projects at NASA and European Space Agency where safety-critical software is managed.

Development and Maintenance Processes

Defined software development processes require planning, requirements analysis, architectural design, detailed design, implementation, integration, and testing; these mirror life-cycle stages used in projects by Intel, Apple Inc., and Oracle Corporation. Maintenance processes cover problem and modification tracking similar to practices at GitHub and Atlassian for issue management. The standard stresses documentation and change control comparable to procedures at Lockheed Martin and Boeing for avionics software, and aligns with auditing practices performed by PwC and Deloitte during supplier assessments for regulated products.

Verification, Validation, and Configuration Management

Verification and validation activities defined in the standard require evidence generation such as unit tests, integration tests, system tests, and acceptance tests, consistent with methodologies employed by IBM and Red Hat. Configuration management mandates baselining, version control, and release management processes like those implemented with tools from Microsoft Corporation and GitLab. Problem resolution and corrective action processes mirror incident response and post-market surveillance frameworks used by Johnson & Johnson and Pfizer when addressing field safety notices and recalls. Documentation must support audit trails maintained by conformity assessment bodies such as UL and Intertek.

Compliance, Certification, and Regulatory Context

Compliance with the standard is assessed by notified bodies and regulators including FDA review teams and European notified bodies such as TÜV Rheinland; certification per se is generally part of a conformity assessment rather than a separate “IEC 62304 license.” The standard is frequently cited in submissions to authorities like Health Canada and the Therapeutic Goods Administration for market authorization. Harmonization efforts relate it to other frameworks including IEC 60601-1, ISO 13485, and guidance documents from agencies such as European Medicines Agency and FDA's Center for Devices and Radiological Health. Major vendors and manufacturers—Siemens Healthineers, GE Healthcare, Philips Healthcare, and Medtronic—implement the standard as part of regulatory strategy to mitigate risk, support post-market surveillance, and demonstrate due diligence in high-profile regulatory matters similar to cases handled before tribunals such as the Court of Justice of the European Union.

Category:Medical device standards